\documentclass[%
version=last,%
a5paper,%
10pt,%
headings=small,%
bibliography=totoc,%
index=totoc,%
twoside,%
reqno,%
cleardoublepage=empty,%
open=any,%
%draft=false,%
draft=true,%
%BCOR=2mm,%
DIV=18,%
%DIV=12,%
%DIV=10,%
%DIV=9,%
headinclude=false,%
pagesize]%
{scrbook}

%\usepackage[nosolutionfiles]{answers}
%\usepackage{answers}
%\Newassociation{soln}{rawsolution}{math-365-text-raw-solutions}

%\usepackage{showlabels}

\makeindex
\usepackage{makeidx}

\usepackage{scrpage2}
\pagestyle{scrheadings}
\ohead{}
\ihead{}
\ofoot{\pagemark}
\ifoot{\headmark}


%\usepackage{float}
%\floatstyle{boxed} 
%\floatstyle{ruled} 
%\restylefloat{figure}

\renewcommand*{\captionformat}{ }  % This does not work with the float
                                % package 


\usepackage{relsize} % Here \smaller scales by 1/1.2; \relscale{X} scales by X

\renewenvironment{quote}{\begin{list}{}
{\relscale{.90}\setlength{\leftmargin}{0.05\textwidth}
\setlength{\rightmargin}{\leftmargin}}
\item[]}
{\end{list}}


\usepackage{cclicenses}

\usepackage{amssymb,amsmath,amsthm}
\usepackage{url}
\usepackage{verbatim}  % allows a comment environment:
\usepackage[all]{xy}
\usepackage{pstricks}
\usepackage{textcomp}  % supposedly useful with \oldstylenums
\usepackage{multicol}
\usepackage[neverdecrease]{paralist}
\usepackage{flafter}  % floats appear after they are mentioned
\usepackage{layout}
\usepackage{hfoldsty} % this didn't work until I added missing
		      % brackets to some of the files.
\usepackage[polutonikogreek,english]{babel}
\newcommand{\Gk}[1]{\selectlanguage{polutonikogreek}#1\selectlanguage{english}}

\usepackage{graphicx,rotating}

\hyphenation{Arith-metic}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\renewcommand{\leq}{\leqslant}
\renewcommand{\geq}{\geqslant}
\renewcommand{\setminus}{\smallsetminus}
\renewcommand{\phi}{\varphi}

\newcommand{\Exists}[1]{\exists{#1}\;}
\renewcommand{\emptyset}{\varnothing}
\renewcommand{\epsilon}{\varepsilon}

%%%%%%%%%%%%%%%%%%%%%%%

%\newcommand{\lto}{\Rightarrow}
%\renewcommand{\land}{\mathrel{\&}}

%\newcommand{\size}[1]{\left|#1\right|}
\newcommand{\size}[1]{\lvert#1\rvert}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\renewcommand{\theenumi}{\alph{enumi}}
\renewcommand{\labelenumi}{\textnormal{\theenumi)}}

\renewcommand{\theenumii}{\roman{enumii}}
\renewcommand{\labelenumii}{\textnormal{(\theenumii)}}

%%%%%%%%%%%%%%%

\newcommand{\divides}{\mathrel{|}}
\newcommand{\ndivides}{\mathrel{\nmid}}

\newcommand{\ord}[2]{\operatorname{ord}_{#1}(#2)}

\newcommand{\ls}[2]{\Bigl(\displaystyle\frac{#1}{#2}\Bigr)}

% set-theoretic relations:

\newcommand{\included}{\subseteq}      % [the name suggests the meaning here]
\newcommand{\nincluded}{\not\subseteq} % not included
\newcommand{\pincluded}{\subset}       % proper inclusion    
\newcommand{\includes}{\supseteq}

\usepackage{bm}
\newcommand{\class}[1]{\bm{#1}}
\newcommand{\on}{\mathbf{ON}}

\newcommand{\stnd}[1]{\mathbb{#1}}
\newcommand{\N}{\stnd{N}}         % natural numbers
\newcommand{\Z}{\stnd{Z}}         % integers
\newcommand{\Q}{\stnd{Q}}         % rationals
\newcommand{\Qp}{\stnd Q^+}       % positive rationals
%\newcommand{\Pri}{\stnd{P}}         % primes
\newcommand{\R}{\stnd{R}}         % reals
\newcommand{\C}{\stnd{C}}         % complex numbers
\newcommand{\Ham}{\stnd H}        % quaternions

\newcommand{\mi}{\mathrm i}
\newcommand{\me}{\mathrm e}
\newcommand{\mj}{\mathrm j}
\newcommand{\mk}{\mathrm k}
\usepackage{upgreek}
\newcommand{\mpi}{\uppi}
\newcommand{\ephi}{\upvarphi}
%\renewcommand{\theta}{\vartheta}
\newcommand{\mtheta}{\upvartheta}
\newcommand{\id}{\mathrm{id}}
\newcommand{\mep}{\upvarepsilon}
\newcommand{\mmu}{\upmu}
\newcommand{\msig}{\upsigma}
\newcommand{\mtau}{\uptau}
\newcommand{\mpsi}{\uppsi}
\newcommand{\rzeta}{\upzeta}

\newcommand{\units}[1]{#1{}\!^{\times}}
\newcommand{\Zmod}[1][n]{\Z_{#1}}
\newcommand{\Zmodu}[1][n]{\units{\Zmod[#1]}}

\newcommand{\scr}[1]{\operatorname{s}(#1)}
\newcommand{\pred}[1]{\operatorname{pred}(#1)}
\DeclareMathOperator{\lcm}{lcm}

\DeclareMathOperator{\dee}{d}      % 
\newcommand{\Lap}[1]{\mathcal L\{#1\}}

\let\oldsqrt\sqrt
\renewcommand{\sqrt}[1]{\oldsqrt{\vphantom1}{#1}}
\newcommand{\rten}{\sqrt{10}}
%\newcommand{\dsp}{\,}   % space between blocks of three digits


%%%%%%%%%%%%%%  For the Sieve of Eratosthenes
%\usepackage{cancel}
%\newcommand{\os}[1]{\,\cancel{#1}\,}

\newcommand{\os}[1]{\,\makebox[0pt][l]{/}#1\,}
\newcommand{\pb}[1]{\fbox{$#1$}}

%\usepackage{ulem}
%\newcommand{\pb}[1]{\,\uline{#1}\,}

\newcommand{\mymod}{\operatorname{mod}}

\newcommand{\rem}[1]{\operatorname{rem}(#1)}

\numberwithin{equation}{chapter}
\renewcommand{\theequation}{\fnsymbol{equation}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%  Theorem-like environments  %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% Main text:

\newtheorem*{lemma}{Lemma}
\newtheorem*{corollary}{Corollary}
\newtheorem{theorem}{Theorem}

\newtheorem*{axdef}{Axiom and definition}

\theoremstyle{definition}

\newtheorem*{definition}{Definition}

\theoremstyle{remark}

\newtheorem*{remark}{Remark}

% Appendix B: Exercises

\theoremstyle{definition}

\newtheorem{xca}{Exercise}%[section]


\newenvironment{soln}{\emph{Solution:}}{}
% Appendix C: Examinations

\theoremstyle{plain}

\newtheorem{problem}{Problem}[section]
\renewcommand{\theproblem}{\arabic{section}.\arabic{problem}}

\theoremstyle{definition}

\newtheorem*{solution}{Solution}

\theoremstyle{remark}

\newtheorem*{remark*}{Remark}

\newcommand{\hw}[1]{\hfill{}\textnormal{[#1]}} % to show a homework
                                % source for an exam problem 

\begin{document}

\title{Elementary Number Theory}
\author{David Pierce}
\date{\today}
\publishers{Mathematics Department\\
Mimar Sinan Fine Arts University\\
Istanbul\\
\url{dpierce@msgsu.edu.tr}\\
\url{http://mat.msgsu.edu.tr/~dpierce/}}

\uppertitleback{\centering
This work is licensed under the\\
Creative Commons\\
Attribution-NonCommercial-ShareAlike 3.0\\
Unported License.\\
To view a copy of this license, visit\\
\url{http://creativecommons.org/licenses/by-nc-sa/3.0/}\\
or send a letter to\\
Creative Commons,\\
444 Castro Street, Suite 900,\\
Mountain View, California, 94041, USA.  

\mbox{}\\
Bu \c cal\i\c sma\\
 Creative Commons Attribution-Gayriticari-ShareAlike 3.0\\
Unported Lisans\i\ ile lisansl\i.\\
Lisans\i n bir kopyas\i n\i\ g\"orebilmek i\c cin,\\
\url{http://creativecommons.org/licenses/by-nc-sa/3.0/}\\
adresini ziyaret edin ya da mektup at\i n:\\
Creative Commons,\\
444 Castro Street, Suite 900,\\
Mountain View,
California, 94041, USA.\\
\mbox{}\\
\cc \ccby David Austin Pierce \ccnc \ccsa\\
\mbox{}\\
Matematik B\"ol\"um\"u\\
Mimar Sinan G\"uzel Sanatlar \"Universitesi\\
Bomonti, \c Si\c sli, \.Istanbul, 34380\\
\mbox{}\\
\url{dpierce@msgsu.edu.tr}\\
\url{http://mat.msgsu.edu.tr/~dpierce/}
}

\maketitle


\tableofcontents
\listoffigures
\listoftables


\addchap{Preface}

This book started out as a record of my lectures in the course called
Elementary Number Theory I (Math 365) at Middle East Technical
University in Ankara in 2007--8.  When I was to teach the same course in 2010--1, I revised my lecture-notes and made
them the official text for the course.  That text, dated September 29, 2011, was 139 pages long.
After the course, filled with enthusiasm, I made many revisions and
additions.  The result is this book.

The standard text for Math 356 at METU was Burton's  
\emph{Elementary Number Theory}~\cite{Burton}.  My lectures of
2007--8 more or less followed this.  The catalogue description of the
course was:  
\begin{quote}%\sloppy
Divisibility, congruences, Euler, Chinese Remainder and Wilson's
Theorems. Arithmetical functions. Primitive roots. Quadratic
resi\-dues and quadratic reciprocity. Diophantine equations.   
\end{quote}
In 2010--1, without realizing that \emph{I} had written the course textbook, one
student complained that it was hard to read.  I am glad he felt free
to criticize.  But I had not aimed to create a textbook that could
replace classroom lectures.  I had written summarily, without trying
to give all of the explanations that anybody could possibly want.  

Among the many changes I have made since the 2010--1 course, I have:
\begin{compactenum}[1)]
\item
put proofs of theorems \emph{after} their statements, and not before
as is sometimes natural in lectures (an omitted proof in the present
text is left to the reader as an 
exercise); 
\item
 removed the Fermat factorization method~\cite[\S5.4]{Burton} as being
 out of the main stream of the course;  
 \item
 added Dirichlet convolution, which gives a streamlined way of
 understanding M\"obius inversion \emph{and} of defining the
 phi-function; 
\item
added forward references, to show better how everything is interconnected;
\item
added citations for the theorems, when I have been able to find them.
\end{compactenum} 
Precisely because these changes are significant, the book must still be
considered as a work in progress, a rough draft. 

As I suggested, Burton's text was the original model for this book,---but
not in style, only in arrangement of topics.  Models for style, as well
as sources of content, include the sparer texts of
Landau~\cite{MR0092794} and Hardy and Wright~\cite{MR568909}.  Much of
the mathematics in the present text can be found in Gauss's
\emph{Disquisitiones Arithmeticae}~\cite{Gauss} of 1801, written when
Gauss was the age of many undergraduate students.  
Some of the mathematics is two thousand years older than Gauss.

I have made some attempt to trace theorems to their origins; but this
work is not complete.  I prefer to see the primary source myself before
attributing a theorem.  In this case, I cite the source \emph{near}
the theorem itself, possibly in a footnote, and not in some extra section
at the end of the chapter.  Even when I can
find the primary source, usually a secondary source has led
me there.  The secondary source helps to determine what the primary
source \emph{is.}  The best history would arise from reading all
\emph{possible} primary sources; but I have not done this. 

Full names and dates of mathematicians named in the text are generally taken
from the MacTutor History of Mathematics
archive,\footnote{\url{http://www-gap.dcs.st-and.ac.uk/~history/index.html}}
or from Wikipedia.  

I ask students to learn something of the logical
foundations of number theory.  Section~\ref{sect:N} contains
an account of these foundations, namely a derivation of basic
arithmetic from the so-called Peano Axioms.  This section was originally an
appendix, but I have decided that it belongs in the main body of text,
even if most number theory texts do not have such a section.
Chapter~\ref{ch:foundations} is filled out with a summary review of
the constructions of the other standard number systems, of integers,
rationals, reals, and complex numbers.  All of these systems have
their place in number theory.  Their constructions alone could
constitute a course, and I 
do not expect number theory students as such to go through them all;
but students should be aware that the constructions \emph{can} be
done, and they themselves can do them.  

Readers will already know most of the \emph{results} of
Chapter~\ref{ch:foundations}.  Assuming some of these results, the preceeding
Chapter~\ref{ch:look} is a general exploration of
what \emph{can} be done with numbers and, in some cases, what
\emph{has} been done for over two thousand years.  The chapter begins
with the \emph{visual} display of certain numbers as triangles or
squares. 
Throughout the text,
 where it
makes sense, I try to display the mathematics in pictures or tables,
as for example in the account of the
Chinese Remainder Theorem in \S\ref{sect:CRT-again}. 

Appendix~\ref{ch:foundations-again} begins with the
\emph{construction} of the natural numbers by von Neumann's method.
This is a part of set theory and is beyond the scope of the course as
such, but it is good for everybody to know that the construction can
be done.  The appendix continues with a discussion of common
misunderstandings of foundational matters. 

I do not like to quote a theorem without either proving it or being able
to expect readers to prove it for themselves.  In the original
course, I did quote theorems, some recent, without myself knowing the
proofs; I have now relegated these to Appendix~\ref{ch:unproved}. 

Appendix~\ref{ch:exercises} consists of exercises, most of which were
made available in installments to the students in 
the 2007/8 class.  I have not incorporated the
exercises into the main text.  One reason for this is to make it less
obvious how the exercises should be done.  The position of an exercise
in a text is often a hint as to how the exercise should be done; and
yet there are no such hints on examinations.  The exercises here are strung together in one numbered sequence.  (So, by the way, are the theorems in the main text.)

  Appendices~\ref{ch:exams} and \ref{ch:exams-2} contain the
  examinations given to 
the 2007--8 and 2010--1 classes, along with my solutions and remarks on
students' solutions. 

In 2007--8, I treated $0$ as a natural number; in 2010--1, I did not.
In the present book, I intend to use the symbol $\N$ for the set
$\{1,2,3,\dots\}$; if a symbol for the set $\{0,1,2,\dots\}$ is
desired, this symbol can be $\upomega$.  I have tried to update
Appendix~\ref{ch:exams} (as well as my original lecture-notes from 2007--8) accordingly.

\chapter{Proving and seeing}\label{ch:look}

\section{The look of a number}

What can we say about the following sequence of numbers?
\begin{equation*}
  1,3,6,10,15,21,28,\dots
\end{equation*}
The terms increase by $2$, $3$, $4$, and so on.  A related observation is that the numbers in the sequence can be given an appearance, a \textbf{look,}\index{look} as shown in Figure~\ref{fig:triangular}.
\begin{figure}[ht]
\begin{center}
\psset{xunit=1cm,yunit=1.73cm}
  \begin{pspicture}(0,-0.8)(8,0)
%\psgrid    
\psdots(0,0)
(1.0,-0.2)(1.4,-0.2)
     (1.2,0.0)
(2.4,-0.4)(2.8,-0.4)(3.2,-0.4)
     (2.6,-0.2)(3,-0.2)
          (2.8,0.0)
(4.2,-0.6)(4.6,-0.6)(5,-0.6)(5.4,-0.6)
     (4.4,-0.4)(4.8,-0.4)(5.2,-0.4)
          (4.6,-0.2)(5,-0.2)
               (4.8,0.0)
(6.4,-0.8)(6.8,-0.8)(7.2,-0.8)(7.6,-0.8)(8.0,-0.8)
    (6.6,-0.6)(7.0,-0.6)(7.4,-0.6)(7.8,-0.6)
          (6.8,-0.4)(7.2,-0.4)(7.6,-0.4)
              (7.0,-0.2)(7.4,-0.2)
                    (7.2,0.0)
  \end{pspicture}
\end{center}
\caption{Triangular numbers}\label{fig:triangular}
\end{figure}
In particular, the numbers are
the 
\textbf{triangular numbers.}%
\index{triangular number}%
\index{number!triangular ---} 
Let us designate them by $t_1$, $t_2$, $t_3$, and so on.
Then they can be given 
\textbf{recursively}\index{recursive definition} by the equations
\begin{align*}
  t_1&=1,& t_{n+1}&=t_n+n+1.
\end{align*}
This definition can be abbreviated as
\begin{equation*}
t_n=\sum_{k=1}^nk.
\end{equation*}
The triangular numbers can also be given non-recursively, in
\textbf{closed form}%
\index{closed form}
(so that $t_n$ can be calculated directly): 

\begin{theorem}
For all numbers $n$,
\begin{equation}\label{eqn:tn}
  t_n
  %=\sum_{k=1}^nk
  %=\binom{n+1}{2}
  =\frac{n(n+1)}{2}.
\end{equation}
\end{theorem}

\begin{proof}
We prove the claim~\eqref{eqn:tn} for all $n$ by
\textbf{induction:}\index{induction}  
\begin{compactenum}[1.]
\item
The claim is true when $n=1$.
\item
If the claim is true when $n=k$, so that $t_k=k(k+1)/2$, then
\begin{align*}
  t_{k+1}
  &=t_k+k+1\\
  &=\frac{k(k+1)}{2}+k+1\\
  &=\frac{k(k+1)}{2}+\frac{2(k+1)}2\\
&=\frac{(k+2)(k+1)}{2}\\
&=\frac{(k+1)(k+2)}{2},  
\end{align*}
so the claim is true when $n=k+1$.  
\end{compactenum}
By induction then, \eqref{eqn:tn} is true for all $n$. 
\end{proof}

So equation~\eqref{eqn:tn} \emph{is} true; but we might ask further:
\emph{why} is it true?  One answer can be seen
 in
a picture.  First rewrite~\eqref{eqn:tn} as
\begin{equation*}
2t_n=n(n+1).
\end{equation*}
Two copies of $t_n$ do indeed fit together to make an $n\times(n+1)$
array of dots,
\begin{figure}[ht]
\begin{center}
  \begin{pspicture}(0,-1.2)(1.6,0)
\psdots(0,0)   (0.4,0)   (0.8,0)  (1.2,0)
       (0,-0.4)(0.4,-0.4)(0.8,-0.4)
       (0,-0.8)(0.4,-0.8)
       (0,-1.2)
\psdots[dotstyle=o]           (1.6,-0)
                    (1.2,-0.4)(1.6,-0.4)
          (0.8,-0.8)(1.2,-0.8)(1.6,-0.8)
(0.4,-1.2)(0.8,-1.2)(1.2,-1.2)(1.6,-1.2)
  \end{pspicture}
\end{center}
\caption{A pair of equal triangular numbers}\label{fig:equal-tri}
\end{figure}
 as in Figure~\ref{fig:equal-tri}.
One may establish other identities in the same way.
\begin{figure}[ht]
\begin{center}
  \begin{pspicture}(0,-1.6)(1.6,0)
    \psdots(0,0)(0.4,0)(0.8,0)(1.2,0)(1.6,0)
(0,-0.4)(0.4,-0.4)(0.8,-0.4)(1.2,-0.4)
(0,-0.8)(0.4,-0.8)(0.8,-0.8)
(0,-1.2)(0.4,-1.2)
(0,-1.6)
    \psdots[dotstyle=o]
(1.6,-0.4)
(1.2,-0.8)(1.6,-0.8)
(0.8,-1.2)(1.2,-1.2)(1.6,-1.2)
(0.4,-1.6)(0.8,-1.6)(1.2,-1.6)(1.6,-1.6)
  \end{pspicture}
\end{center}
\caption{A pair of consecutive triangular numbers}\label{fig:cons-tri}
\end{figure}
For example, Figure~\ref{fig:cons-tri}
suggests the next theorem.\footnote{The theorem is mentioned by Nicomachus
  of Gerasa (c.~60--c.~120) in his \emph{Introduction to
    Arithmetic}~\cite[II.XII.1--2, p.~247]{Nicomachus}.  For him, the
  picture alone seems to have been sufficient proof.  (Gerasa is now
  Jerash, in Jordan.)}

\begin{theorem}
For all numbers $n$,
\begin{equation*}
t_{n+1}+t_n=(n+1)^{2}.
\end{equation*}
\end{theorem}
\begin{proof}
Just compute:
\begin{equation*}
  t_{n+1}+t_n=\frac{(n+1)(n+{2})}{2}+\frac{n(n+1)}{2}
=\frac{n+1}{2}(n+{2}+n)=(n+1)^{2}.\qedhere
\end{equation*}
\end{proof}

What can we say about the following sequence?
\begin{equation*}
  {1,3,5,7,9,11,13,15,17,19,21,23,25,27,29,\dots}
\end{equation*}
It is the sequence of odd numbers.  Also, the first $n$ terms seem to
add up to $n^{2}$.  Indeed we do have:

\begin{theorem}\label{thm:n^2}
For all numbers $n$,
\begin{equation}\label{eqn:n2}
  \sum_{k=1}^n({2}k-1)=n^{2}.
\end{equation}
\end{theorem}

\begin{proof}
We use induction.  
\begin{compactenum}[1.]
\item
The claim is true when $n=1$.
\item
If the claim is
true when $n=k$, then
\begin{equation*}
\sum_{j=1}^{k+1}({2}j-1)
  =\sum_{j=1}^k({2}j-1)+{2}k+1
  =k^{2}+{2}k+1
  =(k+1)^{2},
  \end{equation*}
so the claim is true when $n=k+1$.  
\end{compactenum}
Therefore~\eqref{eqn:n2} is true for all $n$.  
\end{proof}

Figure~\ref{fig:odds}
\begin{figure}[ht]
\begin{center}
\psset{unit=4mm}
  \begin{pspicture}(1,1)(5,5)
    \psdots
(1,1)(3,1)(5,1)(3,2)(5,2)(1,3)(2,3)(3,3)(5,3)(5,4)(1,5)(2,5)(3,5)(4,5)(5,5)
\psdots[dotstyle=o](2,1)(4,1)(1,2)(2,2)(4,2)(4,3)(1,4)(2,4)(3,4)(4,4)
  \end{pspicture}
\end{center}
\caption{Consecutive odd numbers}\label{fig:odds}
\end{figure}
 shows why the theorem is true.  The point here is that, once a
 numerical sequence is defined
recursively, then identities involving the sequence can be
\emph{proved} by induction; but the identities will probably be first
\emph{discovered} in other ways, possibly through pictures. 

From figure~\ref{fig:odds}, we may derive two more
observations.\footnote{These observations are suggested by two
  possible interpretations of a passage in Aristotle's \emph{Physics.}
   In \emph{A History
    of Greek Mathematics}~\cite[p.~77]{MR654679}, Thomas Heath asserts that
  Aristotle (384--322) alludes to Figure~\ref{fig:odds} in that passage.
  Here is Apostol's translation of the passage~\cite[$\Gamma$
    4]{Aristo-Phy-Apost}: 
  `Moreover, the Pythagoreans posit the infinite as being the
  \emph{Even;} for they say that it is this which, when cut off and
  limited by the \emph{Odd,} provides [as matter] for the infinity of
  things.  A sign of this, they say, is what happens to numbers; for
  if gnomons are placed around the one and apart, in the latter case
  the form produced is always distinct, but in the former it is
  unique.' 
Here a \emph{gnomon} is apparently a figure in the shape of the letter
\textsf L (the word originally refers to the part of a sundial
whose shadow shows the time).  So Figure~\ref{fig:odds} results from
placing gnomons around one dot.  If we then remove the dot, we get
Figure~\ref{fig:n^2-1}; if we start with two dots rather than one, we
get Figure~\ref{fig:evens}.

A few centuries later, Theon\index{Theon of Smyrna} of Smyrna
(c.~70--c.~135) states Theorem~\ref{thm:n^2} in his \emph{Mathematics
  useful for understanding Plato}~\cite[pp.~52--55]{Theon}.  (Smyrna
is today's \.Izmir.)} 
  The
rearrangement shown in Figure~\ref{fig:n^2-1}
\begin{figure}[ht]
\mbox{}\hfill
\psset{unit=4mm}
  \begin{pspicture}(1,1)(5,5)
    \psdots
(3,1)(5,1)(3,2)(5,2)(1,3)(2,3)(3,3)(5,3)(5,4)(1,5)(2,5)(3,5)(4,5)(5,5)
\psdots[dotstyle=o](2,1)(4,1)(1,2)(2,2)(4,2)(4,3)(1,4)(2,4)(3,4)(4,4)
  \end{pspicture}
\hfill
  \begin{pspicture}(0,1)(5,5)
    \psdots
(3,2)(5,2)(0,3)(1,3)(2,3)(3,3)(5,3)(5,4)(0,5)(1,5)(2,5)(3,5)(4,5)(5,5)
\psdots[dotstyle=o](0,2)(1,2)(2,2)(4,2)(4,3)(0,4)(1,4)(2,4)(3,4)(4,4)
  \end{pspicture}
\hfill\mbox{}
\caption{Consecutive odd numbers, without one}\label{fig:n^2-1}
\end{figure}
suggests the identity
\begin{equation*}
  n^2-1=(n+1)(n-1),
\end{equation*}
while Figure~\ref{fig:evens}
\begin{figure}[ht]
\centering
\psset{unit=4mm}
  \begin{pspicture}(1,2)(5,5)
    \psdots
(3,2)(5,2)(1,3)(2,3)(3,3)(5,3)(5,4)(1,5)(2,5)(3,5)(4,5)(5,5)
\psdots[dotstyle=o](1,2)(2,2)(4,2)(4,3)(1,4)(2,4)(3,4)(4,4)
  \end{pspicture}
\caption{Consecutive even numbers}\label{fig:evens}
\end{figure}
 suggests
 \begin{equation*}
   \sum_{k=1}^n2k=n(n+1).
 \end{equation*}
Observe finally:
\begin{equation*}
  {1},\underbrace{{3,5}}_8,\underbrace{{7,9,11}}_{{27}},
  \underbrace{{13,15,17,19}}_{{64}},\underbrace{{21,23,25,27,29}}_{{125}},\dots 
\end{equation*}
Does the pattern continue?  As an exercise, write the suggested
equation, 
\begin{equation*}
n^{3}=\sum_{\dots}^{\dots}\dots, 
\end{equation*}
and prove it.\footnote{This theorem too was apparently
known to Nicomachus~\cite[II.XX.5, p.~263]{Nicomachus}.}

\section{Patterns that fail}

The following passage from V. I. Arnol$'$d's talk `On the teaching of
mathematics'~\cite{Arnold} seems to provide a reasonable description of how
mathematics (and in particular number theory) is done.\footnote{A
  footnote explains the origin of the text: `This is an extended text
  of an address at a discussion on the teaching of mathematics in
  Palais de D\'ecouverte in Paris on 7 March 1997.' 
The text
  is on line at
  \url{http://pauli.uni-muenster.de/~munsteg/arnold.html} (accessed November
  14, 2010).  I do not actually agree that mathematics is a part of physics.}
\begin{quote}
Mathematics is a part of physics. Physics is an experimental science,
a part of natural science. Mathematics is the part of physics where
experiments are cheap\dots 

The scheme of construction of a mathematical theory is exactly the
same as that in any other natural science. First we consider some
objects and make some observations in special cases. Then we try and
find the limits of application of our observations, look for
counter-examples which would prevent unjustified extension of our
observations onto a too wide range of events (example: the number of
partitions of consecutive odd numbers $1$, $3$, $5$, $7$, $9$ into an
odd number of natural summands gives the sequence $1$, $2$, $4$, $8$,
$16$, but then comes $29$). 

As a result we formulate the empirical discovery that we made (for
example, the Fermat conjecture or Poincar\'e conjecture) as clearly as
possible. After this there comes the difficult period of checking as
to how reliable are the conclusions. 

At this point a special technique has been developed in
mathematics. This technique, when applied to the real world, is
sometimes useful, but can sometimes also lead to self-deception. This
technique is called modelling. When constructing a model, the
following idealisation is made: certain facts which are only known
with a certain degree of probability or with a certain degree of
accuracy, are considered to be `absolutely' correct and are accepted
as `axioms'. The sense of this `absoluteness' lies precisely in the
fact that we allow ourselves to use these `facts' according to the
rules of formal logic, in the process declaring as `theorems' all that
we can derive from them.  
\end{quote}
Arnol$'$d's parenthetical example is apparently the following.  For
each number $n$, we consider the number of ways to write the odd number $2n-1$ as a sum
\begin{equation*}
t_1+\cdots+t_{2k-1},
\end{equation*}
where $k$ is an arbitrary number (so that $2k-1$ is an arbitrary odd number), but $t_1\geq\cdots\geq t_{2k-1}$.  Let us call the number of such sums
$a_n$.  Immediately $a_1=1$; and since 
\begin{align*}
3&=1+1+1,&
5&={3}+1+1={2}+{2}+1=1+1+1+1+1,
\end{align*}
we have $a_2=2$ and $a_3=4$.
To find $a_4$, we note
\begin{align*}
&\begin{aligned}
&\phantom{{}={}}7\\
&=5+1+1\\
&=4+{2}+1\\
&={3}+{3}+1
\end{aligned}&
&\begin{aligned}
&={3}+{2}+{2}\\
&={3}+1+1+1+1\\
&={2}+{2}+1+1+1\\
&=1+1+1+1+1+1+1,
\end{aligned}
\end{align*}
so $a_4=8$; and $a_5=16$, by the computations in
Table~\ref{tab:9-as-sum} below.
\begin{table}
\hrulefill
\begin{align*}
&\begin{aligned}
&\phantom{{}={}}9\\
&=7+1+1\\
&=6+2+1\\
&=5+3+1\\
&=5+2+2\\
&=5+1+1+1+1\\
&=4+4+1\\
&=4+3+2
\end{aligned}&
&\begin{aligned}
&=4+2+1+1+1\\
&=3+3+3\\
&=3+3+1+1+1\\
&=3+2+2+1+1\\
&=3+1+1+1+1+1+1\\
&=2+2+2+2+1\\
&=2+2+1+1+1+1+1\\
&=1+1+1+1+1+1+1+1+1
\end{aligned}
\end{align*}
\hrulefill
\caption{The number $9$ as the sum of odd numbers of
  summands}\label{tab:9-as-sum} 
\end{table}
Thus the equation
\begin{equation}\label{eqn:a_n}
  a_n=2^{n-1}
\end{equation}
is correct when $n$ is $1$, $2$, $3$, $4$, or $5$.  However,
there is no obvious reason why it
should be true when $n>5$.  In fact it \emph{fails} when $n=6$.  We
have $a_6=29$, by counting the sums listed in Table~\ref{tab:sums}. 
\begin{sidewaystable}
\begin{align*}
&\begin{aligned}
11
&=9+1+1\\
&=8+2+1\\
&=7+3+1\\
&=7+2+2\\
&=7+1+1+1+1\\
&=6+4+1\\
&=6+3+2\\
&=6+2+1+1+1\\
&=5+5+1\\
&=5+4+2\\
&=5+3+3\\
&=5+3+1+1+1\\
&=5+2+2+1+1\\
&=5+1+1+1+1+1+1
\end{aligned}&
&\begin{aligned}
&=4+4+3\\
&=4+4+1+1+1\\
&=4+3+2+1+1\\
&=4+2+2+2+1\\
&=4+2+1+1+1+1+1\\
&=3+3+3+1+1\\
&=3+3+2+2+1\\
&=3+3+1+1+1+1+1\\
&=3+2+2+2+2\\
&=3+2+2+1+1+1+1\\
&=3+1+1+1+1+1+1+1+1\\
&=2+2+2+2+2+1\\
&=2+2+2+1+1+1+1+1\\
&=2+1+1+1+1+1+1+1+1+1.
\end{aligned}
\end{align*}
\caption{The number $11$ as the sum of odd numbers of
  summands}\label{tab:sums} 
\end{sidewaystable}
If one is so inclined, one can find further information on these
numbers $a_n$ in the \emph{The
  On-Line Encyclopedia of Integer
  Sequences.}\footnote{\url{http://oeis.org/}, accessed November 14,
  2010.} 

Another failed pattern is shown in Chapter 3, `Proofs', of Timothy
Gowers's \emph{Mathematics: A Very Short Introduction}
\cite{MR2147526}.  Suppose $n$ distinct points are chosen on a circle,
and each pair of the $n$ points are connected by a straight line, and
no three of those straight lines have a common point.  Then the circle
is divided into a number of regions, say $a_n$ regions.
Figure~\ref{fig:circles}
\begin{figure}
\hfill
\begin{pspicture}(-1,-1)(1,1)
\pscircle(0,0){1}
\end{pspicture}
\hfill
\begin{pspicture}(-1,-1)(1,1)
\pscircle(0,0){1}
\psdots(0,1)
\end{pspicture}
\hfill
\begin{pspicture}(-1,-1)(1,1)
\pscircle(0,0){1}
\psdots(0,1)(0,-1)
\psline(0,1)(0,-1)
\end{pspicture}
\hfill
\begin{pspicture}(-1,-1)(1,1)
\pscircle(0,0){1}
\psdots(0,1)(0.866,-0.5)(-0.866,-0.5)
\pspolygon(0,1)(0.866,-0.5)(-0.866,-0.5)
\end{pspicture}
\hfill\mbox{}

\psset{unit=1.333cm}
\hfill
\begin{pspicture}(-1,-1)(1,1.2)
\pscircle(0,0){1}
\psdots(0,1)(1,0)(0,-1)(-1,0)
\pspolygon(0,1)(1,0)(0,-1)(-1,0)
\psline(1,0)(-1,0)
\psline(0,1)(0,-1)
\end{pspicture}
\hfill
\begin{pspicture}(-1,-1)(1,1)
\pscircle(0,0){1}
\psdots(0,1)(0.951,0.309)(0.588,-0.809)(-0.588,-0.809)(-0.951,0.309)
\pspolygon(0,1)(0.951,0.309)(0.588,-0.809)(-0.588,-0.809)(-0.951,0.309)
(0,1)(0.588,-0.809)(-0.951,0.309)(0.951,0.309)(-0.588,-0.809)
\end{pspicture}
\hfill
\begin{pspicture}(-1,-1)(1,1)
\pscircle(0,0){1}
\psdots(0,1)(0.643,0.766)(0.866,-0.5)(0.342,-0.940)(-0.866,-0.5)(-0.985,0.174)
\pspolygon(0,1)(0.643,0.766)(0.866,-0.5)(0.342,-0.940)(-0.866,-0.5)(-0.985,0.174)
\pspolygon(0,1)(0.866,-0.5)(-0.866,-0.5)
\pspolygon(0.643,0.766)(0.342,-0.940)(-0.985,0.174)
\psline(0,1)(0.342,-0.940)
\psline(0.643,0.766)(-0.866,-0.5)
\psline(0.866,-0.5)(-0.985,0.174)
\end{pspicture}
\hfill\mbox{}
\caption{Partitions of circles by straight lines}\label{fig:circles}
\end{figure} 
shows that \eqref{eqn:a_n} now holds when
$n$ is one of the numbers $1$, $2$, $3$, $4$, and $5$; but when $n=0$,
then there is $1$ region, not $1/2$; and when $n=6$, there are $31$
regions, not $32$.  

Is there a formula for the number $a_n$ here?  
When we add a new point, so that there are $n+1$
points in all, then the new point will be connected to $n$ other
points.  Suppose we number those $n$ points with the numbers from $1$
to $n$ inclusive.  Then the line going to point $j$ has $j-1$ points
on one side, and $n-j$ on the other, so it crosses $(j-1)(n-j)$ lines.
So this new line is divided into $(j-1)(n-j)+1$ segments, and each of
these corresponds to a new region.  Thus 
\begin{align*}
a_1&=1,&
a_{n+1}&=a_n+\sum_{j=1}^n\bigl((j-1)(n-j)+1\bigr);
\end{align*}
this is a recursive definition of the numbers $a_n$, but it is perhaps
not a very attractive definition.   
We can rewrite the last equation as
\begin{equation*}
a_{n+1}=a_n+n+\sum_{j=2}^{n-1}(j-1)(n-j).
\end{equation*}
The sum $\sum_{j=2}^{n-1}(j-1)(n-j)$ can be understood as the number
of ways to choose $3$ points out of $n$ points.  Indeed, if the points
are again numbered from $1$ to $n$ inclusive, then for each $j$, there
are $(j-1)(n-j)$ ways to choose $i$ and $k$ so that $i<j<k\leq n$. 
Therefore we have
\begin{equation*}
a_{n+1}
=a_n+n+\binom n3
=a_n+\binom n1+\binom n3.
\end{equation*}
Recall that in the so-called Pascal's Triangle (Table~\ref{tab:Pascal}) 
\begin{table}\centering
%\hrulefill
\setcounter{MaxMatrixCols}{17}
\makebox[0pt][c]{  \begin{math}
  \begin{matrix}
&\phantom{99}&\phantom{99}&\phantom{99}&\phantom{99}&\phantom{99}&\phantom{99}&\phantom{99}&
1
&\phantom{99}&\phantom{99}&\phantom{99}&\phantom{99}&\phantom{99}&\phantom{99}&\phantom{99}&\phantom{99}\\
&  & & & &  &  & 1&  & 1&  &  & & & & &\\
&  & & & &  & 1&  & 2&  & 1&  & & & & &\\
&  & & & & 1&  & 3&  & 3&  & 1& & & & &\\
&  & & &1&  & 4&  & 6&  & 4&  &1& & & &\\
&  & &1& & 5&  &10&  &10&  & 5& &1& & &\\
&  &1& &6&  &15&  &20&  &15&  &6& &1& &\\
& 1& &7& &21&  &35&  &35&  &20& &7& &1&\\
\hdotsfor{17}
  \end{matrix}
  \end{math}}
  \caption{Pascal's Triangle}\label{tab:Pascal}
\end{table}
if we start counting with $0$,
then entry $i$ in row $j$ is $\binom ji$; in particular, $\binom
ji+\binom j{i+1}=\binom{j+1}{i+1}$.
Hence
 we have
\begin{equation*}
a_{n+1}=a_n+\binom{n-1}0+\binom{n-1}1+\binom{n-1}2+\binom{n-1}3.
\end{equation*}
Then by induction,
\begin{equation*}
a_n=\binom{n-1}0+\binom{n-1}1+\binom{n-1}2+\binom{n-1}3+\binom{n-1}4.
\end{equation*}
Here we should understand $\binom{n-1}j=0$ if $n-1<j$.

For an alternative derivation of the last formula for $a_n$, we can consider the following.
\begin{compactenum}[1.]
\item
Even if there are no points, there is $1$ region.
\item
When a new line is drawn, one new region is created near one endpoint
of the new line; and there are $\binom n2$ lines.
\item
In addition, whenever the new line crosses an old line, a new region
is created; and there are $\binom n4$ crossings.
\item
Every region can be understood as arising in exactly one of the foregoing ways.
\end{compactenum}
Therefore, again,
\begin{equation*}
a_n=1+\binom n2+\binom n4
=\binom n0+\binom n2+\binom n4
=\sum_{j=0}^4\binom{n-1}4.
%=\binom{n-1}0+\binom{n-1}1+\binom{n-1}2+\binom{n-1}3+\binom{n-1}4.
\end{equation*}



\section{Incommensurability}\label{sect:incomm}

A \textbf{Diophantine equation}%
\index{Diophantine equation}%
\footnote{\label{note:FLT}So called after Diophantus of Alexandria (c.~200--c.~284),
  whose \emph{Arithmetica,} comprising 13 books, treated such problems
  as, `To divide a given square number into two
  squares'~\cite[pp.550--553]{MR13:419b}.  Diophantus works out an
  example when the given square number is $16$.  The aim then is to
  find $x$ such that $16-x^2$ is a square.  We try letting this square
  have the form $(mx-4)^2$, presumably so that $16$ will cancel from
  the resulting equation.  In case $m=2$, we solve
\begin{align*}
&  \begin{aligned}
16-x^2&=(2x-4)^2\\
&=4x^2-16x+16,
   \end{aligned}
  &
16x&=5x^2,&
\frac{16}5&=x,
\end{align*}
so that $16=(16/5)^2+(12/5)^2$.  Thus Diophantus is interested in
\emph{rational} solutions: in the present example, solutions to the
equation $x^2+y^2=z^2$.  It was
in the margin next to this problem, in his own copy of the
\emph{Arithmetica,} that Fermat\index{Fermat} (see below) wrote the
claim that $x^n+y^n=z^n$ has no [rational] solution when $n>2$.  This claim is the so-called \emph{Fermat's Last Theorem,}%
\index{Fermat's Last Theorem}%
\index{theorem!Fermat's Last Th---} although Fermat did not publish a proof, and he almost certainly did not know a correct proof.} 
is a polynomial equation with integral coefficients.  If such a
solution has no \emph{integral} solutions, way to prove
this is the  
method of \textbf{infinite descent,}%
\index{infinite descent}%
\index{proof!--- by infinite descent}
which is attributed to Pierre de Fermat (1601--65).\footnote{In his
  \emph{History of Mathematics}~\cite[\S XVII.16, p. 387]{MR0234791},
  Boyer writes: `Some of his theorems he [Fermat] proved by a method
  that he called his ``infinite descent''---a sort of inverted
  mathematical induction, a process that Fermat was among the first to
  use.'}  A simple application of the method is the following. 

\begin{theorem}
  No integers solve the equation
  \begin{equation*}
    x^{2}={2}y^{2}.
  \end{equation*}
\end{theorem}

\begin{proof}
  Suppose $a^{2}={2}b^{2}$, and $a$ and $b$ are positive.  Then $a>b$.
  Also, $a$ must be even.  Say $a=2c$.  Consequently $4c^2=2b^2$, so
  $b^2=2c^2$.  Thus we obtain a sequence 
  \begin{equation*}
a,b,c,\dots,k,\ell,\dots,
\end{equation*}
where always $k^2=2\ell^2$.  But we have also $a>b>c>\dotsb$, which is
absurd; there is no infinite descending sequence of positive integers.
Therefore no positive $a$ and $b$ exist such that $a^2=2b^2$. 
\end{proof}

In geometric form, the theorem is that the side
and diagonal of a square are 
\textbf{incommensurable:}%
\index{incommensurable}
there is no one line
segment that \textbf{measures,}%
\index{measure}
or evenly divides, each of them.  We can see this as
follows, using propositions from Euclid's \emph{Elements}
\cite{MR1932864}.\footnote{The method is discussed in Heath's edition
  of the \emph{Elements}~\cite[v.~III, p.~19]{MR17:814b}.}  In
Figure~\ref{fig:square}, 
\begin{figure}[ht]
\begin{center}
\psset{unit=6mm}
  \begin{pspicture}(-0.5,-0.5)(5.8,4.5)
    \psline(0,0)(4,0)(4,4)(0,4)(0,0)(4,4)
    \psline(1.172,1.172)(0,2.343)(4,4)
    \psarc[linestyle=dotted](4,4){4}{180}{225}
    \psline(5,1.8)(5.8,1.8)
    \uput[ul](0,4){$A$}
    \uput[ur](4,4){$B$}
    \uput[dr](4,0){$C$}
    \uput[dl](0,0){$D$}
    \uput[dr](1.172,1.172){$E$}
    \uput[l](0,2.343){$F$}
    \uput[u](5.4,1.8){$d$}
  \end{pspicture}
\end{center}
\caption{Incommensurability of diagonal and side}\label{fig:square}
\end{figure}
there is a square, $ABCD$ (constructed by I.46).  On the diagonal
$BD$, the distance $BE$ is marked equal to 
$AB$ (as by drawing a circle with center $B$, passing through $A$).
The perpendicular at $E$ (constructed by I.11) meets $AD$ at $F$.  The
straight line $BF$ is drawn.  Then 
triangles $ABF$ and $EBF$ are congruent, and in particular $EF=AF$ (by
I.4, I.16, and I.32).  Also, triangle
$DEF$ is similar to $DAB$ (by VI.4, since angle $DEF$ is equal to
angle $DAB$, and angle $EDB$ is common), so $DE=EF$.  Suppose a
straight line $G$ measures both 
$AB$ and $BD$.  Then it measures $ED$ and $DF$, since
\begin{align*}
  ED&=BD-AB,&
DF&=AB-ED.
\end{align*}
The same construction can be performed with triangle $DEF$ in place of
$DAB$.  Since $DE<DF$ (by I.19 and I.32), so that ${2}ED<AB$, there
will eventually be segments that are shorter than $G$ (by X.1), but 
are measured by it, which is absurd.  So such $G$ cannot exist.

If we consider $DA$ as a unit, then we can write $DB$ as $\sqrt 2$.
In two ways then, we have shown then the \textbf{irrationality} of
$\sqrt2$.  For yet another proof, suppose $\sqrt2$ \emph{is}
rational. 
Then there are numbers $a_1$ and $a_2$ such that
\begin{equation*}
\frac{a_1}{a_2}=\sqrt 2+1.
\end{equation*}
Consequently
\begin{equation*}
\frac{a_2}{a_1}
=\frac1{\sqrt2+1}
=\frac{\sqrt2-1}{(\sqrt2+1)(\sqrt2-1)}
=\sqrt 2-1=\frac{a_1}{a_2}-2=\frac{a_1-2a_2}{a_2}.
\end{equation*}
Now let $a_3=a_1-2a_2$, so that
\begin{equation*}
  \frac{a_2}{a_1}=\frac{a_3}{a_2}.
\end{equation*}
Continue recursively by defining
\begin{equation*}
  a_{n+2}=a_n-2a_{n+1}.
\end{equation*}
Then by induction
\begin{equation*}
\frac{a_{n+1}}{a_{n+2}}=\frac{a_1}{a_2}=\sqrt2+1.
\end{equation*}
But $a_n=2a_{n+1}+a_{n+2}$, so $a_1>a_2>a_3>\dotsb$, which again is absurd.

The same argument, adjusted, gives us a way to \emph{approximate} $\sqrt2$.
Suppose there are $b_1$ and $b_2$ such that
\begin{equation*}
\frac{b_1}{b_2}=\sqrt 2-1.
\end{equation*}
Then
\begin{equation*}
\frac{b_2}{b_1}=\sqrt 2+1=\frac{b_1}{b_2}+2=\frac{b_1+2b_2}{b_2}.
\end{equation*}
If we define
\begin{equation}\label{eqn:bn2}
  b_{n+2}=b_n+2b_{n+1},
\end{equation}
then by induction
\begin{equation*}
\frac{b_{n+1}}{b_{n+2}}=\sqrt 2-1.
\end{equation*}
Now however the sequence $b_1$, $b_2$, \dots, increases, so there is
no obvious contradiction.  But the definition~\eqref{eqn:bn2} alone
yields 
\begin{align*}
\frac{b_3}{b_2}&=2+\frac{b_1}{b_2},\\
\frac{b_4}{b_3}&=2+\frac{b_2}{b_3}=2+\cfrac1{2+\cfrac{b_1}{b_2}},\\
\frac{b_5}{b_4}&=2+\frac{b_3}{b_4}=
2+\cfrac1{2+\cfrac{b_2}{b_3}}=
2+\cfrac1{2+\cfrac1{2+\cfrac{b_1}{b_2}}},  
\end{align*}
and so on.
If we just let $b_1=1$ and $b_2=2$, then by~\eqref{eqn:bn2} we
sequence of the $b_n$ is the
increasing sequence  
\begin{equation*}
1,2,5,12,29,70,\dots
\end{equation*}
Then the sequence
\begin{equation*}
\frac21,\frac52,\frac{12}5,\frac{29}{12},\frac{70}{29},\dots
\end{equation*}
of fractions converges to $\sqrt2+1$.  That is, we have the following.

\begin{theorem}
When the sequence $b_1$, $b_2$, \dots, is defined recursively by
\begin{align*}
b_1&=1,&
b_2&=2,&
b_{n+2}&=b_n+2b_{n+1},
\end{align*}
then
\begin{equation}\label{eqn:lim}
\lim_{n\to\infty}\frac{b_{n+1}}{b_n}=\sqrt 2+1.
\end{equation}
\end{theorem}

\begin{proof}
Considering successive
differences, we have
\begin{equation*}
  \frac{b_{n+2}}{b_{n+1}}-\frac{b_{n+1}}{b_n}
=2+\frac{b_n}{b_{n+1}}-\frac{b_{n+1}}{b_n} 
=\frac{b_n{}^2+2b_nb_{n+1}-b_{n+1}{}^2}{b_nb_{n+1}}.
\end{equation*}
Replacing $n$ with $n+1$ gives
\begin{align*}
  \frac{b_{n+3}}{b_{n+2}}-\frac{b_{n+2}}{b_{n+1}}&=
\frac{b_{n+1}{}^2+2b_{n+1}b_{n+2}-b_{n+2}{}^2}{b_{n+1}b_{n+2}}\\
&=\frac{b_{n+1}{}^2+2b_{n+1}(2b_{n+1}+b_n)-(2b_{n+1}+b_n)^2}{b_{n+1}b_{n+2}}\\
&=-\frac{b_n{}^2+2b_nb_{n+1}-b_{n+1}{}^2}{b_{n+1}b_{n+2}}\\
&=-\Bigl(\frac{b_{n+2}}{b_{n+1}}-\frac{b_{n+1}}{b_n}\Bigr).
\end{align*}
By induction then,
\begin{equation}\label{eqn:2-ind}
  \frac{b_{n+2}}{b_{n+1}}-\frac{b_{n+1}}{b_n}=\frac{(-1)^{n+1}}{b_nb_{n+1}},
\end{equation}
since this holds when $n=1$.  The sequence of products $b_nb_{n+1}$ is
positive an strictly increasing; so we have
\begin{gather*}
  \frac{b_2}{b_1}<\frac{b_3}{b_1},\\
\frac{b_2}{b_1}<\frac{b_4}{b_3}<\frac{b_3}{b_1},\\
\frac{b_2}{b_1}<\frac{b_4}{b_3}<\frac{b_5}{b_4}<\frac{b_3}{b_1},\\
\frac{b_2}{b_1}<\frac{b_4}{b_3}<\frac{b_6}{b_5}<\frac{b_5}{b_4}<\frac{b_3}{b_1},
\end{gather*}
and in general
\begin{equation*}
  \frac{b_2}{b_1}<\frac{b_4}{b_3}<\frac{b_6}{b_5}<
  \cdots<\frac{b_7}{b_6}<\frac{b_5}{b_4}<\frac{b_3}{b_1}.  
\end{equation*}
A consequence of this and~\eqref{eqn:2-ind} is that the sequence of
fractions $b_{n+1}/b_n$ must be a \textsl{Cauchy sequence.}%
\index{Cauchy sequence}  
The limit is
$\sqrt2+1$, since
\begin{align*}
  \frac{b_{n+2}}{b_{n+1}}<\sqrt2+1
&\iff\Bigl(\frac{b_{n+2}}{b_{n+1}}-1\Bigr)^2<2\\
&\iff\Bigl(\frac{b_n}{b_{n+1}}+1\Bigr)^2<2\\
&\iff\frac{b_n}{b_{n+1}}<\sqrt2-1\\
&\iff\frac{b_{n+1}}{b_n}>\sqrt2+1.\qedhere
\end{align*}
\end{proof}

The limit equation~\eqref{eqn:lim} is written more suggestively as
\begin{equation*}
\sqrt{2}+{1}=
     {2}+ 
 \cfrac{1}{{2}+
\cfrac{1}{{2}+\cfrac{1}{{2}+\cfrac{1}{{2}+\cfrac{1}{\ddots}}}}}.  
\end{equation*}

\chapter{Numbers}\label{ch:foundations}

\section{The natural numbers}\label{sect:N}

Theorems about natural numbers have been known for
thousands of years.  Some of these theorems come down to us in Euclid's
\emph{Elements} \cite{MR1932864}, for example, or Nicomachus's
\emph{Introduction to Arithmetic} \cite{Nicomachus}, which were
referred to in the last chapter.  Certain underlying assumptions on
which the proofs of these theorems are based were apparently not
worked out until more recent centuries.   

It turns out that all theorems about the natural numbers are logical
consequences of the Axiom below.  The Axiom lists five
conditions that the natural numbers meet.  Richard Dedekind published
these conditions in 1888 \cite[II, \S71, p.~67]{MR0159773}.  In 1889,
Giuseppe Peano \cite[\S1, p.~94]{Peano}\nocite{MR0209111} repeated
them in a more symbolic form, along with some logical
conditions, making nine conditions in all, which he called axioms.  Of
these, the five
specifically number-theoretic conditions have come to be known as
the \textbf{Peano Axioms.}%
\index{Peano axioms}

The foundations of number-theory are often not well understood, even today.
Some books give the impression that all theorems about natural numbers
follow from the so-called `Well Ordering Principle'
(Theorem~\ref{thm:wo}).  Others suggest that the possibility of definition by
recursion (Theorem~\ref{thm:rec}) can be proved by induction
(part~\eqref{part:ind} of the Axiom) alone.  These are mistakes about
the foundations of number-theory.  They are perhaps not really mistakes about
number-theory itself; still, they are mistakes, and it is better not
to make them.  This is a reason why I have written this chapter.  

An admirable development of the material in this chapter and more is
found in Edmund Landau's book
\emph{Foundations of Analysis: The Arithmetic of Whole, Rational,
  Irrational, and Complex Numbers: A Supplement to Text-Books on the
  Differential and Integral Calculus}~\cite{MR12:397m}.

In the present chapter, \emph{when proofs of lemmas and theorems here
  are not supplied, I have left them to the reader as exercises.}

An expression like `$f\colon A\to B$' is to
be read as the statement `$f$ is a function from $A$ to $B$.'  This
means $f$ is a
certain kind of subset of the Cartesian product $A\times B$, namely
a subset that, for each $a$ in $A$, has exactly one element of the form
$(a,b)$; then one writes $f(a)=b$.  The function $f$ can also be written
as $x\mapsto f(x)$.

  \begin{axdef}
    The set of 
\textbf{natural numbers,}%
\index{natural number}%
\index{number!natural ---}
denoted by
\begin{equation*}
\N, 
\end{equation*}
meets the
    following five conditions.
    \begin{compactenum}
      \item\label{part:zero}
There is a 
\textbf{first}%
\index{first natural number}%
\index{number!first natural ---, one}
 natural number, called $1$ 
(\textbf{one}%
\index{one}%
\index{number!one}).
\item\label{part:s}
Every $n$ in $\N$ has a unique 
\textbf{successor,}%
\index{successor}%
\index{number!successor}
 denoted (for now) by
$\scr n$.
\item\label{part:not}
The first natural number is not a successor: if $n\in\N$, then
$\scr n\neq1$.
\item\label{part:inj}
Distinct natural numbers have distinct successors: if
$n\in\N$ and $m\in\N$ and $n\neq m$, then $\scr n\neq\scr m$.
\item\label{part:ind}
Proof by 
\textbf{induction}%
\index{induction}%
\index{proof!--- by induction}
is possible: Suppose
$A\included\N$, and two conditions are met, namely
\begin{compactenum}
  \item
the 
\textbf{base condition:}%
\index{base of induction}
 $1\in A$, and
\item
the 
\textbf{inductive condition:}%
\index{inductive condition}%
\index{inductive hypothesis} 
if $n\in A$ (the 
\textbf{inductive hypothesis}), then $\scr n\in A$.
\end{compactenum}
Then $A=\N$.
    \end{compactenum}
The natural number $\scr 1$ is denoted by $2$; the number $\scr 2$, by
$3$; \&c.
   \end{axdef}

  \begin{remark}
  Again, the five conditions satisfied by $\N$ are the \emph{Peano axioms.}
    Parts~\eqref{part:not}, \eqref{part:inj} and~\eqref{part:ind} of
    the axiom are
    conditions concerning a set with a first element and an operation of
    succession.  For each of those conditions, there is an
    example of such a set that meets that condition, but not
    the others.  In short, the three conditions are logically
    independent. 
  \end{remark}

  \begin{lemma}
    Every natural number is either $1$ or a successor. 
  \end{lemma}

  \begin{proof}
Let $A$ be the set comprising every natural number that is either $1$
    or a successor.  In particular, $1\in A$, and if $n\in A$, then
    (since it is a successor) $\scr n\in A$.
    Therefore, by induction, $A=\N$.
  \end{proof}

  \begin{theorem}[Recursion]\label{thm:rec}
    Suppose a set $A$ has an element $b$, and $f\colon A\to A$.
    Then there is a \emph{unique} function $g$ from $\N$ to $A$ such
    that
    \begin{compactenum}
      \item
$g(1)=b$, and
\item
$g(\scr n)=f(g(n))$ for all $n$ in $\N$.
    \end{compactenum}
  \end{theorem}

  \begin{proof}
The following is only a sketch.
One must prove existence and uniqueness of~$g$.  Assuming existence,
one can prove uniqueness by induction.  To prove existence,
let $\mathcal S$ be the set of subsets $R$ of $\N\times A$ such that
\begin{compactenum}
  \item
if $(1,c)\in R$, then $c=b$;
\item
if $(\scr n,c)\in R$, then $(n,d)\in R$ for some $d$ such that $f(d)=c$.
\end{compactenum}
Then $\bigcup\mathcal S$ is the desired function $g$.
  \end{proof}

  \begin{remark}
    In its statement (though not the proof), the Recursion Theorem
    assumes only parts~\eqref{part:zero} and~\eqref{part:s} of
    the Axiom.  The other parts can be proved as consequences
    of the Theorem.  Recursion is a method of \emph{definition;}
    induction is a method of \emph{proof.}  There are sets (with first
    elements and successor-operations) that allow proof by induction,
    but not definition by recursion.  In short, induction is logically
    weaker than recursion.
  \end{remark}

  \begin{definition}[Addition]
    For each $m$ in $\N$, the operation $x\mapsto m+x$ on $\N$ is the
    function $g$ guaranteed by the Recursion Theorem when $A$ is $\N$ and
    $b$ is $m$ and $f$ is $x\mapsto\scr x$.  That is, 
    \begin{align*}
      m+1&=\scr m,&
m+\scr n&=\scr{m+n}.
    \end{align*}
  \end{definition}

  \begin{lemma}
    For all $n$ and $m$ in $\N$,
    \begin{compactenum}
      \item
$1+n=\scr n$;
\item
$\scr m+n=\scr{m+n}$.
    \end{compactenum}
  \end{lemma}

  \begin{theorem}\label{thm:add}
    For all $n$, $m$, and $k$ in $\N$,
    \begin{compactenum}
\item
$n+m=m+n$;
\item
$(n+m)+k=n+(m+k)$;
    \end{compactenum}
  \end{theorem}

  \begin{remark}
    It is possible to prove by induction alone that there is a unique operation of
    addition satisfying the definition and Theorem~\ref{thm:add}. 
  \end{remark}

  \begin{definition}[Multiplication]
    For each $m$ in $\N$, the operation $x\mapsto m\cdot x$ on $\N$ is the
    function $g$ guaranteed by the Recursion Theorem when $A$ is $\N$ and
    $b$ is $1$ and $f$ is $x\mapsto x+m$.   That is,
    \begin{align*}
      m\cdot1&=m,&
m\cdot(n+1)&=m\cdot n+m.
    \end{align*}
  \end{definition}

  \begin{lemma}
    For all $n$ and $m$ in $\N$,
    \begin{compactenum}
      \item
$1\cdot n=n$;
\item
$(m+1)\cdot n=m\cdot n+n$.
    \end{compactenum}
  \end{lemma}

  \begin{theorem}\label{thm:mul}
    For all $n$, $m$, and $k$ in $\N$,
    \begin{compactenum}
\item
$n\cdot m=m\cdot n$;
\item
$n\cdot(m+k)=n\cdot m+n\cdot k$;
\item
$(n\cdot m)\cdot k=n\cdot (m\cdot k)$;
    \end{compactenum}
  \end{theorem}

  \begin{remark}
As with addition, so with multiplication, one can prove by induction
    alone that there is a unique operation satisfying the definition and Theorem~\ref{thm:mul}.  However, the next
    theorem requires also
    parts \eqref{part:not}--\eqref{part:inj} of the Axiom.  
  \end{remark}

  \begin{theorem}[Cancellation]
    For all $n$, $m$, and $k$ in $\N$, 
    \begin{compactenum}
      \item
if $n+k=m+k$, then $n=m$;
\item
if $n\cdot k=m\cdot k$, then $n=m$.
    \end{compactenum}
  \end{theorem}

  \begin{definition}[Exponentiation]
    For each $m$ in $\N$, the operation $x\mapsto m^x$ on $\N$ is the 
    function $g$ guaranteed by the Recursion Theorem when $A$ is $\N$ and
    $b$ is $m$ and $f$ is $x\mapsto x\cdot m$.  That is,
    \begin{align*}
      m^1&=m,&
m^{n+1}&=m^n\cdot m.
    \end{align*}
  \end{definition}

  \begin{theorem}
    For all $n$, $m$, and $k$ in $\N$,
    \begin{compactenum}
\item
$n^{m+k}=n^m\cdot n^k$;
\item
$(n\cdot m)^k=n^k\cdot m^k$;
\item
$(n^m)^k=n^{m\cdot k}$.
    \end{compactenum}
  \end{theorem}

  \begin{remark}
    In contrast with addition and multiplication, exponentiation
    requires more than induction for its existence.
  \end{remark}

  \begin{definition}[Ordering]
If $n,m\in\N$, and $m+k=n$ for some $k$ in $\N$, then this situation
is denoted by
$m<n$.  
That is,
\begin{equation*}
  m< n\iff \exists x\;m+x=n.
\end{equation*}
If $m<n$, we say that
$m$ is a 
\textbf{predecessor}%
\index{predecessor}%
\index{number!predecessor}
of $n$.  If $m<n$ or $m=n$, we write
\begin{equation*}
m\leq n.
\end{equation*}
  \end{definition}

  \begin{theorem}
For all $n$, $m$, and $k$ in $\N$,
    \begin{compactenum}
 \item
$1\leq n$;
\item
$m\leq n$ if and only if $m+k\leq n+k$;
\item
$m\leq n$ if and only if $m\cdot k\leq n\cdot k$.     
    \end{compactenum}
  \end{theorem}

  \begin{theorem}\label{thm:<1}
For all $m$ and $n$ in $\N$,
\begin{compactenum}
  \item
$m<n$ if and only if $m+1\leq n$;
\item\label{item:leq}
$m\leq n$ if and only if $m<n+1$.
\end{compactenum}
  \end{theorem}

  \begin{theorem}
        The binary relation $leq$ is a 
\textbf{linear ordering:}%
\index{linear ordering}%
\index{ordering!linear ---}
for all $n$, $m$, and $k$ in $\N$,
	\begin{compactenum}
	  \item
$n\leq n$;
\item
if $m\leq n$ and $n\leq m$, then $n=m$;
\item
if $k\leq m$ and $m\leq n$, then $k\leq n$;
\item
either $m\leq n$ or $n\leq m$.
	\end{compactenum}
  \end{theorem}

We may say then that $<$ is a \textbf{strict linear ordering,}\index{strict linear ordering} because
\begin{gather*}
	n\not<n,\\
	k<m\And m<n\implies k<n,\\
	m\not<n\And m\neq n\implies n<m.
\end{gather*}

  \begin{theorem}[Strong Induction]\label{thm:SI}
    Suppose $A\included\N$, and one condition is met, namely
    \begin{itemize}
      \item
if all predecessors of $n$ belong to $A$ (the 
\textbf{strong inductive hypothesis}),%
\index{strong inductive hypothesis}%
\index{inductive hypothesis!strong ---}
then $n\in A$.
    \end{itemize}
Then $A=\N$.
  \end{theorem}

  \begin{proof}
    Let $B$ comprise the natural numbers whose predecessors belong to
    $A$.  As~$1$ has no predecessors, they belong to $A$, so $1\in
    B$.  Suppose $n\in B$.  Then all predecessors of $n$ belong to
    $A$, so by assumption, $n\in A$.  Thus, by Theorem~\ref{thm:<1}~\eqref{item:leq}, all
    of the predecessors of $n+1$ belong to $A$, so $n+1\in B$.  By
    induction, $B=\N$.  In particular, if $n\in \N$, then $n+1\in B$,
    so $n$ (being a predecessor of $n+1$) belongs to $A$.  Thus
    $A=\N$. 
  \end{proof}

  \begin{remark}
    In general, strong induction is a proof-technique that can be used
    with some \emph{ordered} sets.  By contrast, `ordinary'
    induction involves sets with first elements and
    successor-operations, but possibly without orderings.  Strong
    induction does not follow from ordinary induction alone; neither
    does ordinary induction follow from strong induction.
  \end{remark}

  \begin{theorem}\label{thm:wo}
    The set of natural numbers is 
\textbf{well ordered}%
\index{well ordered}%
\index{ordering!well ordered}
by $<$: that is,
    every non-empty subset of $\N$ has a least element with respect to
    $\leq$. 
  \end{theorem}
  
  \begin{proof}
    Use strong induction.  Suppose $A$ is a subset of $\N$ with no
    least element.  We shall show $A$ is empty, that is, $\N\setminus
    A=\N$.  Let $n\in\N$.  Then $n$ is not a least element of $A$.
    This means one of two things: either $n\notin A$, or else $n\in
    A$, but also $m\in A$ for some predecessor of $n$.  Equivalently,
    if no predecessor of $n$ is in $A$, then $n\notin A$.  In other
    words, if every predecessor of $n$ is in $\N\setminus A$, then
    $n\in\N\setminus A$.  By strong induction, we are done.
  \end{proof}

  \begin{remark}
    We have now shown, in effect, that if a linear order $(A,\leq)$ admits
    proof by strong recursion, then it is well-ordered.  The converse
    is also true.
  \end{remark}

  \begin{theorem}[Recursion with Parameter]
    Suppose $A$ is a set with an element $b$, and $F\colon\N\times
    A\to A$.  Then there is a \emph{unique} function $G$ from $\N$ to
    $A$ such 
    that
    \begin{compactenum}
      \item
$G(1)=b$, and
\item
$G(n+1)=F(n,G(n))$ for all $n$ in $\N$.
    \end{compactenum}
  \end{theorem}

  \begin{proof}
 %   Adjust the proof of Theorem~\ref{thm:rec}.
Let $f\colon \N\times A\to\N\times A$,
where $f(n,x)=(n+1,F(n,x))$.  By recursion, there is a unique function
$g$ from
$\N$ to $\N\times A$ such that $g(1)=(1,b)$ and $g(n+1)=f(g(n))$.  By
induction, the first entry in $g(n)$ is always $n$.  The desired
function $G$ is given by $g(n)=(n,G(n))$.  Indeed, we now have
$G(1)=b$; also, $g(n+1)=f(n,G(n))=(n+1,F(n,G(n)))$, so
$G(n+1)=F(n,G(n))$.  By induction, $G$ is unique.
  \end{proof}

  \begin{remark}
    Recursion with Parameter allows us to define the set of
    predecessors of $n$ as $\pred n$, where $x\mapsto\pred x$ is the
    function $G$ guaranteed by the Theorem when $A$ is the set of
    subsets of $\N$, and $b$ is the empty set, and $F$ is
    $(x,Y)\mapsto\{x\}\cup Y$.  Then we can write $m<n$ if $m\in\pred
    n$ and prove the foregoing theorems about the ordering.
  \end{remark}

  \begin{definition}[Factorial]
    The operation $x\mapsto x!$ on $\N$ is the function $G$ guaranteed
    by the Theorem of Recursion with Parameter when $A$ is $\N$ and
    $b$ is $1$ and $F$ is $(x,y)\mapsto(x+1)\cdot y$.  That is,
    \begin{align*}
      1!&=1,&
(n+1)!&=(n+1)\cdot n!
    \end{align*}
  \end{definition}

\section{The integers}\label{sect:integers}

Number theory is fundamentally about the natural numbers, but it is sometimes useful to consider natural numbers simply as \textbf{integers.}  These compose the set
\begin{equation}\label{eqn:Z}
  \N\cup\{0\}\cup\{-x\colon x\in\N\},
\end{equation}
which is denoted by
\begin{equation*}
\Z.
\end{equation*}
One may ask what these new elements $0$ and $-x$ are.  In that case, one can define $\Z$ as the quotient 
\begin{equation*}
\N\times\N/\mathord{\sim},
\end{equation*}
where $\sim$ is the equivalence relation given by
\begin{equation*}
(a,b)\sim(x,y)\iff a+y=b+x.
\end{equation*}
The equivalence class of $(a,b)$ is denoted by 
\begin{equation*}
a-b.
\end{equation*}
There are three cases:
\begin{compactenum}[1.]
\item
If $a<b$, then $a+c=b$ for some unique $c$, and
\begin{equation*}
a-b=1-(c+1).
\end{equation*}
\item
If $a=b$, then
\begin{equation*}
a-b=1-1.
\end{equation*}
\item
If $b<a$, then $b+c=a$ for some unique $c$, and
\begin{equation*}
a-b=(c+1)-1.
\end{equation*}
\end{compactenum}
Then $\N$ embeds in $\Z$ under the the map $x\mapsto(x+1)-1$, and one can define
\begin{align*}
0&=1-1,&
-((x+1)-1)&=1-(x+1).
\end{align*}
One can then identify $\N$ with its image in $\Z$.
Then again $\Z$ can be understood as in~\eqref{eqn:Z}.

We extend multiplication to $\Z$ by defining
\begin{align*}
0\cdot x&=0,&
-x\cdot y&-(x\cdot y),&
-x\cdot-y&=x\cdot y.
\end{align*}
It is to be understood that multiplication is still to be commutative, so that also $x\cdot0=0$ and $y\cdot-x=-(x\cdot y)$.

We extend the ordering to $\Z$ by defining
\begin{align*}
-x&<0,&
0&<y,&
-x&<-y\iff y<x.
\end{align*}
Here of course $x$ and $y$ are elements of $\N$, and the two inequalities $-x<0$ and $0<y$ are taken to imply $-x<y$.

Now we can extend addition by defining
\begin{align*}
-x+-y&=-(x+y),&
-x+y&=
\begin{cases}
	z,&\text{if $x<y$ and $x+z=y$}\\
	0,&\text{ if }x=y,\\
	-z,&\text{ if $y<x$ and $y+z=x$}.
\end{cases}
\end{align*}
Finally, we define
\begin{equation*}
-{-x}=x.
\end{equation*}
Now one proves the following, where the letters range over $\Z$.  First,
\begin{gather*}
  a+(b+c)=(a+b)+c,\\
b+a=a+b,\\
a+{0}=a,\\
a+(-a)={0},
\end{gather*}
so that $\Z$ is an \textbf{abelian group}%
\index{abelian group}%
\index{group!abelian ---}
with respect to addition.
Next,
\begin{gather}\notag
a\cdot(b\cdot c)=(a\cdot b)\cdot c,\\\notag
a\cdot 1=a,\\\label{eqn:1a=a}
1\cdot a=a,\\\notag
a\cdot (b+c)=a\cdot b+a\cdot c,\\\label{eqn:abc}
(a+b)\cdot c=a\cdot c+b\cdot c,
\end{gather}
so $\Z$ is a \textbf{ring.}%
\index{ring}
But we need not show~\eqref{eqn:1a=a} and~\eqref{eqn:abc} in particular, because we have finally
\begin{equation*}
a\cdot b=b\cdot a,
\end{equation*}
so $\Z$ is a \textbf{commutative ring.}%
\index{commutative ring}%
\index{ring}
Moreover,
\begin{gather*}
a<b\implies a+c<b+c,\\
{0}<a\And {0}<b\implies {0}<a\cdot b,
\end{gather*}
so $\Z$ is an 
\textbf{ordered} commutative ring.%  
\index{ordered commutative ring}
In particular, if $a\cdot b=0$, then one of $a$ and $b$ is $0$; so $\Z$ is an \textbf{integral domain.}%
\index{integral domain}

An integer $a$ is called 
\textbf{positive}%
\index{positive}
if $a>0$, that is, if $a\in\N$; but
$a$ is 
\textbf{zero,}%
\index{zero}
if $a=0$, and $a$ is 
\textbf{negative,}%
\index{negative}
if $a<0$.

\section{The rational numbers}

It is also useful in number theory to be aware that integers are \textbf{rational numbers.}  In order to define these precisely, it is useful to begin (as one does in school) with the \textbf{positive rational numbers.}  These compose the quotient
\begin{equation*}
\N\times\N/\mathord{\approx},
\end{equation*}
where $\approx$ is the equivalence relation defined by
\begin{equation*}
(a,b)\approx(x,y)\iff a\cdot y=b\cdot x.
\end{equation*}
The equivalence class of $(a,b)$ is denoted by
\begin{equation*}
\frac ab
\end{equation*}
or $a/b$.  Let us denote the set of positive rational numbers by
\begin{equation*}
\Qp.
\end{equation*}
On this set, one shows that the following are valid definitions:
\begin{align*}
\frac ab+\frac xy&=\frac{ay+bx}{by},&
\frac ab\cdot\frac xy&=\frac{ab}{xy},&
\frac ab<\frac xy&\iff ay<bx.
\end{align*}
We can also define
\begin{equation*}
\Bigl(\frac ab\Bigr)^{-1}=\frac ba;
\end{equation*}
then $\Qp$ is an abelian group
with respect to multiplication.
One shows that $\Z$ embeds in $\Qp$ under the map $x\mapsto x/1$.  Now we can identify $\N$ with its image in $\Qp$.  Letting letters stand now for positive rationals, we have, just as in $\N$,
\begin{equation*}
r<s\iff\Exists xr+x=s.
\end{equation*}
Now we can obtain the set $\Q$ of \textbf{rational numbers}%
\index{rational numbers}
from $\Qp$ just as we obtained $\Z$ from $\N$ in the last section.  In particular, $\Q$ is a commutative ring; it is moreover a \textbf{field,}%
\index{field}
because
\begin{equation*}
a\neq0\implies\Exists xax=1.
\end{equation*}
Since also $\Q$ is, like $\Z$, an \emph{ordered} commutative ring, $\Q$ is an \textbf{ordered field.}%
\index{ordered field}
Finally, $\Z$ is an ordered commutative sub-ring of this ordered field.

\section{Other numbers}\label{sect:other}

As a linear order, $\Q$ is \textbf{dense,}%
\index{dense}
that is, between any two distinct elements lies a third:
\begin{equation*}
a<b\implies\Exists x(a<x\And x<b).
\end{equation*}
Moreover, $\Q$ has no \textbf{endpoints,} that is, no greatest or least element.  

An order is called \textbf{complete} if every nonempty subset with an upper bound has a \textbf{supremum,}%
\index{supremum}
namely a least upper bound.  Then $\Q$ is not complete, since the set $\{x\colon 0<x\And x^2<2\}$ has no supremum.

If a dense linear order without endpoints is given, and $a$ is an element, we can define
\begin{equation*}
\pred a=\{x\colon x<a\}.
\end{equation*}
The union of any collection of such subsets is an 
\textbf{open}%
\index{open subset}
subset of the order.\footnote{The open sets, so defined, do indeed compose a \textsl{topology}\index{topology} for the order, but it is not the usual \textbf{order topology.}  In the latter, the open sets are unions of sets $\{x\colon a<x\And x<b\}$.}  In particular, the whole set and the empty set are open; all other open subsets are called \textbf{cuts}%
\index{cut}
of the order.  The set of all cuts of the order is the \textbf{completion}%
\index{completion}
of the order.  The completion is itself linearly ordered by inclusion ($\included$),
and the original order embeds in its completion under the map $x\mapsto\pred x$.  In case the original order is $\Q$, the completion is denoted by
\begin{equation*}
\R.
\end{equation*}
This is the set of \textbf{real numbers.}%
\index{real number}
The operations on $\Q$ extend to $\R$ in such a way that $\R$ is also an ordered field.  then $\R$ is a \textbf{complete ordered field,} and every complete ordered field is isomorphic to $\R$.  

However, all of this takes quite a bit of work to prove.  One approach is to consider first the completion of $\Qp$.  If $X$ and $Y$ are cuts of $\Qp$, one can define
\begin{gather*}
X+Y=\bigcup\{\pred{x+y}\colon\pred x\included X\And\pred y\included Y\},\\
X\cdot Y=\bigcup\{\pred{x\cdot y}\colon\pred x\included X\And\pred y\included Y\}.
\end{gather*}
Then one can obtain $\R$ from the completion of $\Qp$, just as one obtains $\Z$ from $\N$, and $\Q$ from $\Qp$.

Given a commutative ring, we can form $2\times2$ matrices whose entries are from the ring.  These are added and multiplied by the rules
\begin{gather*}
\begin{pmatrix}
a&b\\c&d
\end{pmatrix}
+
\begin{pmatrix}
x&y\\z&w
\end{pmatrix}
=
\begin{pmatrix}
a+x&b+y\\c+z&d+w
\end{pmatrix},\\
\begin{pmatrix}
a&b\\c&d
\end{pmatrix}
\cdot
\begin{pmatrix}
x&y\\z&w
\end{pmatrix}
=
\begin{pmatrix}
ax+bz&ay+bw\\cx+dz&cy+dw
\end{pmatrix}.
\end{gather*}
Then the set of these matrices is a ring, but usually not a commutative ring.  We define $\C$ as the set of $2\times 2$ matrices
\begin{equation}\label{eqn:mat}
\begin{pmatrix}
x&y\\-y&x
\end{pmatrix},
\end{equation}
where $x$ and $y$ range over $\R$.  
One shows that $\C$ is a field.
We identify $\R$ with its image in $\C$ under the map
\begin{equation*}
x\mapsto\begin{pmatrix}
x&0\\0&x
\end{pmatrix},
\end{equation*}
and we define
\begin{equation*}
\mi=\begin{pmatrix}
0&1\\-1&0
\end{pmatrix}.
\end{equation*}
Then every element of $\C$ is uniquely $x+y\mi$ for some $x$ and $y$ in $\R$; moreover, 
$\mi^2=-1$.

One shows that every positive real number $x$ has a 
\textbf{square root,}%
\index{square root}
 namely the positive number $\sqrt x$ such that $(\sqrt x)^2=x$.  Then we define
\begin{equation*}
\size{x+\mi y}=\sqrt{(x^2+y^2)}.
\end{equation*}
 The field $\C$ is \textbf{complete}%
\index{complete}
 in a new sense: every \textsl{Cauchy sequence}%
 \index{Cauchy sequence}
  of complex numbers converges.  Recall that a sequence $(a_n\colon n\in\N)$ of complex numbers is a \textbf{Cauchy sequence} if for every positive real number $\epsilon$, there is a positive integer $k$ such that, if $n>k$ and $m>k$, then
  \begin{equation*}
\size{a_n-a_m}<\epsilon.
\end{equation*}
Then $\R$ itself is also complete in this sense.

The field of complex numbers also has the convenient property of being \textbf{algebraically closed:}%
\index{algebraic} it contains a solution of every polynomial equation
\begin{equation}\label{eqn:alg}
a_0+a_1x+\dotsb+a_{n-1}x^{n-1}+x^n=0,
\end{equation}
for every $n$ in $\N$,
where of course the coefficients $a_k$ range over $\C$.  But there are other algebraically closed fields.

The field $\Q$ is \textbf{countable,}%
\index{countable}
that is, there is a bijection between $\Q$ and $\N$.  The same is not true for $\R$ or $\C$: they are \textbf{uncountable.}%
\index{uncountable}
If we select from $\C$ the solutions of the equations~\eqref{eqn:alg} such that the coefficients are \emph{rational,} the result is the set of 
\textbf{algebraic numbers.}  This set is a countable algebraically closed subfield of $\C$.

Every equation $a+bx=0$, where $a$ and $b$ are integers and $b\neq0$, has a solution in $\Q$, namely $-a/b$ (that is, $-ab^{-1}$).  In particular, there is a solution when $b=1$; but then the solution is just $-a$, an integer.  More generally, if the coefficients in~\eqref{eqn:alg} are integers, then a solution to the equation 
is called an \textbf{algebraic integer.}  In particular, $\sqrt 2$ is an algebraic integer, being a solution of $x^2-2=0$.  The algebraic integers are the subject of \textbf{algebraic number theory;} so we have had a taste of this in \S\ref{sect:incomm}.  The only algebraic integers in $\Q$ are the usual integers---which in this context may be called \textbf{rational integers.}

The study of $\R$ and $\C$ is \textbf{analysis.}  There is a part of number theory that makes use of analysis; this is \textbf{analytic number theory.}  We shall not try to do it here, but if one does prove the Prime Number Theorem (Theorem~\ref{thm:PNT}) for example, then the 
\textbf{Gamma function}%
\index{Gamma function}
may be useful: this is the function $\Gamma$ given by
\begin{equation*}
  \Gamma(x)=\int_{0}^{\infty}\me^{-t}t^{x-1}\dee x
\end{equation*}
when $x\geq1$.
You can show that $\Gamma(n+1)=n\Gamma(n)$, and $\Gamma(1)=1$, so that
$G(n+1)=n!$.

Our subject is mainly \textbf{elementary number theory.}  This means not that the subject is easy, but that our integers are just the rational integers, and we shall not use analysis.  However, the proof of Bertrand's Postulate in \S\ref{sect:B} gives a taste of analysis.\footnote{For an overview of algebraic numbers, analytic number theory, and other areas of mathematics, an excellent print reference is \emph{The Princeton Companion to Mathematics,} edited by Timothy Gowers with June Barrow-Green and Imre Leader~\cite{MR2467561}.}

\chapter{Divisibility}\label{ch:divisibility}

\section{Division}

Henceforth minuscule letters will usually denote integers.
If $n$ is such, let the set $\{nx\colon x\in\Z\}$ be denoted by $\Z n$ or
$n\Z$ or
\begin{equation*}
  (n).
\end{equation*}
To give it a name, we may call $(n)$ the \textbf{ideal}\index{ideal}\footnote{In the original terminology, $(n)$ was an \emph{ideal number.}} of $\Z$ generated by $n$.  Note that
\begin{equation*}
(-n)=(n).
\end{equation*}
Moreover,
\begin{equation*}
a\in(n)\iff (a)\included(n).
\end{equation*}
It is not strictly necessary to introduce ideals, but they may clarify some arguments.
By definition, if $a\in(n)$, that is, if $a=nx$ for some integer $x$, then $n$ \textbf{divides}%
\index{divides, divisor}
$a$, or $n$ is a
\textbf{divisor} of $a$; this situation is
denoted by
\begin{equation*}
  n\divides a.
\end{equation*}
Then the following holds, simply because $\Z$ is a commutative ring in the sense of \S\ref{sect:integers}.

\begin{theorem}\label{thm:div}
In $\Z$:
\begin{gather}\notag
  a\divides {0},\\\notag
{0}\divides a\iff a={0},\\\notag
1\divides a,\\\notag
a\divides a,\\\notag
a\divides b\And b\divides c\implies a\divides c,\\\notag
a\divides b\And c\divides d\implies ac\divides bd,\\\label{eqn:bx}
a\divides b\implies a\divides bx,\\\label{eqn:b+c}
a\divides b\And a\divides c\implies a\divides b+c.
\end{gather}
\end{theorem}

In particular, if $a\divides b$, then both $a$ and $-a$ divide both $b$ and $-b$.  Every divisor of an integer $b$ is a \textbf{proper} divisor if it is not $\pm b$ (this notion will be useful when we discuss \textsl{prime numbers} in Chapter~\ref{ch:primes}).

We have an additional property because $\Z$ is an \emph{ordered} commutative ring in which every positive element is $1$ or greater; the following does not hold in $\Q$ or $\R$.\footnote{\label{n:Z[X]}It does hold in other ordered commutative rings, such as $\Z[X]$, the ring of polynomials in a single variable $X$ with integer coefficients, ordered so that $X$ is greater than every constant polynomial.}

\begin{theorem}\label{thm:div-ord}
In $\Z$,
\begin{equation*}
a\divides b\And b\neq{0}\implies \size a\leq\size b.
\end{equation*}
In particular,
\begin{equation*}
a\divides b\And b\divides a\implies a=\pm b.
\end{equation*}
\end{theorem}

\begin{proof}
If $a\divides b$, and $b\neq0$, then $n\cdot\size a=\size b$ for some positive $n$, so $1\leq n$ and hence $\size a\leq n\cdot\size a=\size b$.
\end{proof}

We have now shown, in effect:

\begin{theorem}
The relation $\divides$ of divisibility is an \textbf{ordering}\index{ordering} of $\N$ that is refined by the linear ordering $\leq$, that is, if $k$, $m$, and $n$ are in $\N$, then
\begin{gather*}
	n\divides n,\\
	m\divides n\And n\divides m\implies m=n,\\
	k\divides m\And m\divides n\implies k\divides n,\\
	m\divides n\implies m\leq n.
\end{gather*}
\end{theorem}

Ordered sets can be depicted in so-called \textbf{Hasse diagrams.}%
\index{Hasse diagram}
Consider for example the positive divisors of $60$, namely $1$, $2$, $3$, $4$, $5$, $6$, $10$,
$12$, $15$, $20$, $30$, and $60$: these twelve numbers can be arranged as in Figure~\ref{fig:60}.
\begin{figure}[ht]
\centering
\psset{unit=2mm}
  \begin{pspicture}(-12,-12)(12,12)
    \pspolygon(0,-12)(-12,0)(-2,6)(10,-6)
    \psline(-6,-6)(4,0)
\psdots[linecolor=white,dotsize=4pt 4](-1,-3)(7,-3)(1,3)(-7,3)
    \pspolygon(0,12)(12,0)(2,-6)(-10,6)
    \psline(-12,0)(-10,6)
    \psline(0,-12)(2,-6)
    \psline(12,0)(10,-6)
    \psline(6,6)(-4,0)
    \psline(0,12)(-2,6)
    \psline(-6,-6)(-4,0)
    \psline(6,6)(4,0)
\rput(0,12){\psframebox*[fillstyle=solid]{$60$}}
\rput(0,-12){\psframebox*[fillstyle=solid]{$1$}}
\rput(6,6){\psframebox*[fillstyle=solid]{$30$}}
\rput(-6,-6){\psframebox*[fillstyle=solid]{$2$}}
\rput(-2,6){\psframebox*[fillstyle=solid]{$20$}}
\rput(2,-6){\psframebox*[fillstyle=solid]{$3$}}
\rput(-10,6){\psframebox*[fillstyle=solid]{$12$}}
\rput(10,-6){\psframebox*[fillstyle=solid]{$5$}}
\rput(12,0){\psframebox*[fillstyle=solid]{$15$}}
\rput(-12,0){\psframebox*[fillstyle=solid]{$4$}}
\rput(4,0){\psframebox*[fillstyle=solid]{$10$}}
\rput(-4,0){\psframebox*[fillstyle=solid]{$6$}}
  \end{pspicture}
\caption{Divisors of $60$}\label{fig:60}
\end{figure}
Here a line is drawn from a number $a$ up to a number $b$ if
$a\divides b$, but there is no $c$ distinct from $a$ and $b$ such that
$a\divides c$ and $c\divides b$.  In general, $a\divides b$ if and only if there
is a path upwards from $a$ to $b$.

\section{Congruence}\label{sect:cong}

If $a-b\in(n)$, then we may also write
\begin{equation}\label{eqn:mod}
  a\equiv b\pmod n
\end{equation}
or $a\equiv b\pod n$,
saying $a$ and $b$ are 
\textbf{congruent}%
\index{congruent numbers}%
\index{number!congruent ---s}
 with respect to the
\textbf{modulus}%
\index{modulus, \emph{modulo}}
$n$, or $a$ and $b$ are
congruent 
\textbf{\emph{modulo}} $a$; also $b$ is a
\textbf{residue}%
\index{residue}
of $a$, and $a$ is a residue of $b$, \emph{modulo} $n$.\footnote{The notation of~\eqref{eqn:mod} is introduced by Johann Carl Friedrich Gauss%
\index{Gauss}
(1777--1855) in \P2 of his \emph{Disquisitiones Arithmeticae}~\cite{Gauss}, first published in 1801.  Gauss notes that Legendre uses the same sign for both equality and congruence, because they are analogous concepts.  Gauss writes in Latin, and Latin nouns, like Turkish nouns, have \emph{cases.}  In particular, the Latin noun \emph{modulus,} meaning literally `small measure', has the cases \emph{modulum, moduli, modulo, modulo,} corresponding respectively (albeit roughly) to the Turkish \emph{mod\"ul\"u, mod\"ul\"un, mod\"ule, mod\"ulden.}  However, Gauss does not use a form like `\emph{modulo} $5$', at least not in the first two paragraphs of the \emph{Disquisitiones}; he says instead `\emph{secundum modulum} 5', that is, with respect to the modulus 5, or in Turkish \emph{$5$ mod\"ul\"une g\"ore.}  (I took Gauss's Latin text from \url{http://resolver.sub.uni-goettingen.de/purl?PPN235993352}, December 7, 2010; the link was in the Wikipedia article on the \emph{Disquisitiones.})}
If the modulus $n$ is
understood, we might write simply
\begin{equation*}
  a\equiv b.
\end{equation*}
Congruence with respect to a given modulus is an equivalence-relation.
The congru\-ence-class of $a$ \emph{modulo} $n$ is 
  \begin{equation*}
    \{x\in\Z\colon a-x\in(n)\}.
  \end{equation*}
If $n={0}$, then congruence \emph{modulo} $n$ is equality.  In any case, congruence \emph{modulo} $n$ is the same as congruence \emph{modulo} $-n$.  So we usually need only be concerned with positive moduli.\footnote{Gauss writes in a footnote to his \P1, `The modulus must obviously be taken \emph{absolutely,} i.e. without sign.'  This suggests to me the picture in which $-5$ is `really' $5$, from a special point of view.}

\begin{lemma}
For every positive modulus $n$, for every integer $a$, distinct elements of the $n$-elemment set $\{a,a+1,\dots,a+n-1\}$ are incongruent.
\end{lemma}

\begin{proof}
If $i$ and $j$ are distinct elements of the set, then $0<\size{i-j}<n$, so $n\ndivides i-j$ by Theorem \ref{thm:div-ord}.
\end{proof}

We want now to show that every integer is congruent to \emph{some} element of $\{a,a+1,\dots,a+n-1\}$.  To do so, we shall use the \textsl{greatest integer in} a rational number.  This notion applies to arbitrary real numbers as well, through the following:

\begin{theorem}
For every real number $x$, there is a unique integer $k$ such that
\begin{equation*}
k\leq x<k+1.
\end{equation*}
\end{theorem}

\begin{proof}
Assume first $x\geq0$.  By the construction in \S\ref{sect:other}, there is a rational number $a/b$ such that $x<a/b$; and then $x<a$.  By the Well Ordering Principle (Theorem~\ref{thm:wo}), there is a \emph{least} integer $m$ such that $x<m$.  Then $m-1$ is the desired integer $k$.  If $x<0$, we let $m$ be the least integer such that $-x\leq m$, and then $-m$ is the desired integer $k$.

In either case, the integer $k$ is unique by Theorem~\ref{thm:<1} (though again, cases must be considered).
\end{proof}

In the theorem, the integer $k$ is the \textbf{greatest integer in}%
\index{greatest integer}
$x$ and can be denoted by
\begin{equation*}
[x].
\end{equation*}
Its existence for all $x$ in $\R$ is expressed by saying $\R$ is
\textbf{archimedean}%
\index{archimedean property of $\R$} 
(as an ordered commutative ring).\footnote{Another way to say $\R$ is archimedean is that if $a$ and $b$ are positive real numbers, then for some positive integer $n$, $na>b$.  This principle is used by Archimedes (c.~287--212 \textsc{bce}) to show, for example, that the surface of a sphere is equal to a circle of twice the radius \cite{MR2093668}.
An example of a nonarchimedean ordered commutative ring is $\Z[X]$, defined in note~\ref{n:Z[X]} on page~\pageref{n:Z[X]} above.  We can characterize $\Z$ as the unique archimedean ordered commutative ring with no positive elements less than $1$.}

\begin{lemma}
For every positive modulus $n$, every integer has a unique residue in $\{0,1,\dots,n-1\}$.
\end{lemma}

\begin{proof}
For any integer $a$, we just compute
\begin{gather*}
	\Bigl[\frac an\Bigr]\leq\frac an<\Bigl[\frac an\Bigr]+1,\\
	\frac an-1<\Bigl[\frac an\Bigr]\leq\frac an,\\
	1>\frac an-\Bigl[\frac an\Bigr]\geq0,\\
	n>a-n\Bigl[\frac an\Bigr]\geq0.
\end{gather*}
So $a-n[a/n]$ belongs to the desired set; and it is an integer congruent to $a$.
\end{proof}

The following theorem is basically a restatement of the last lemma.  It is called the Division Algorithm, though it is not really an algorithm; it is the observation that finding a quotient (with remainder) of one integer after division by a nonzero integer is always \emph{possible.}  So-called \emph{long division} is an algorithm for doing this that is learned in school.

\begin{theorem}[Division Algorithm]\label{thm:div-alg}
For every positive integer $q$, for every integer $a$, there are unique integers $k$ and $r$ such that
\begin{align*}
a&=kq+r,&0\leq r<q.
\end{align*}
\end{theorem}

As a consequence of the last two lemmas, we have:

\begin{theorem}\label{thm:res}
For every positive modulus $n$, for every integer $a$, every integer has a unique residue in the set $\{a,a+1,\dots,a+n-1\}$.
\end{theorem}

\begin{proof}
Every integer $x$ has a unique residue $f(x)$ in $\{0,1,\dots,n-1\}$.  Let $g$ be the restriction of $f$ to the set $\{a,a+1,\dots,a+n-1\}$.  Then $g$ is injective, and its domain and codomain are finite sets of the same size; therefore $g$ is surjective onto $\{0,1,\dots,n-1\}$.  Then $g^{-1}(f(x))$ belongs to $\{a,a+1,\dots,a+n-1\}$ and is a residue of $x$; moreover, it is unique.
\end{proof}

In the theorem, $\{a,\dots,a+n-1\}$ is called a 
\textbf{complete set of residues}%
\index{complete set of residues}%
\index{residue!complete set of ---s}
\emph{modulo}~$n$.  
We shall be interested mainly in the 
cases
\begin{align*}
&\{0,\dots,n-1\},&
&\biggl\{-\Bigl[\frac{n-1}2\Bigr],\dots,\Bigl[\frac n2\Bigr]\biggr\},
\end{align*}
the latter set being
$\{-m+1,\dots,m\}$, if $n=2m$, and $\{-m,\dots,m\}$, if $n=2m+1$.

\begin{theorem}\label{thm:+.mod-n}
  If $a\equiv b$ and $c\equiv d$, then
  \begin{align*}
    a+c&\equiv b+d,& ac&\equiv bd.
  \end{align*}
\end{theorem}

\begin{proof}
If $n\divides b-a$ and $n\divides d-c$, then, by Theorem~\ref{thm:div}, we have $n\divides
b-a+d-c$, that 
is, 
\begin{equation*}
n\divides b+d-(a+c), 
\end{equation*}
and also $n\divides(b-a)c+(d-c)b$, that is,
\begin{equation*}
n\divides bd-ac.\qedhere
\end{equation*}
\end{proof}

A first application of this is an ancient theorem, found in the work of Theon\index{Theon of Smyrna} of Smyrna~\cite[pp.~102--5]{MR13:419a}.

\begin{theorem}
Every square is congruent to $0$ or $1$ \emph{modulo} $3$ and $4$.
\end{theorem}

\begin{proof}
By the last theorem, if two integers are congruent, then their squares are congruent.  So it is enough to observe the following:
The set $\{-1,0,1\}$ is a complete set of residues \emph{modulo} $3$, and the square of each element is congruent to $0$ or $1$.  The set $\{-1,0,1,2\}$ is a complete set of residues \emph{modulo} $3$, and the square of each element is congruent to $0$ or $1$.
\end{proof}

The set of congruence-classes of integers \emph{modulo} $n$ is denoted by $\Z/n\Z$ or $\Z/(n)$ or simply
\begin{equation*}
\Zmod.
\end{equation*}
Then Theorem~\ref{thm:+.mod-n} is that addition and multiplication are well-defined on $\Zmod$; so this becomes a commutative ring.

\section{Greatest common divisors}\label{sect:gcd}

A \textbf{common divisor} of $a$ and $b$ is any $j$ such that $j\divides a$ and $j\divides b$.  If one of $a$ and $b$ is not $0$, then $\size j\leq\min(\size a,\size b)$ by Theorem~\ref{thm:div-ord}.  In this case, $a$ and $b$ have a common divisor that is greatest with respect to the linear ordering $\leq$.  This common divisor is called simply the
\textbf{greatest common divisor}%
\index{greatest common divisor}
of $a$ and $b$ and is denoted by
\begin{equation*}
\gcd(a,b).
\end{equation*}
If $c$ is a common divisor of $a$ and $b$, then $c\leq\gcd(a,b)$.

We immediately have an algorithm for finding $\gcd(a,b)$.  If one of $a$ and $b$ is $0$, then the absolute value of the other is the greatest common divisor.  Otherwise:
\begin{compactenum}
\item
List the elements of $\{1,\dots,\size a\}$ that divide $a$.
\item
List the elements of $\{1,\dots,\size b\}$ that divide $b$.
\item
Find the greatest number that is common to both lists.
\end{compactenum}
For example, we can read $\gcd(12,30)=6$ off the Hasse diagram in Figure~\ref{fig:60}.  See Figure~\ref{fig:12,30}.
\begin{figure}[ht]
\centering
\psset{unit=2mm}
\mbox{}\hfill
  \begin{pspicture}(-12,-12)(2,6)
    \pspolygon(0,-12)(-12,0)(-10,6)(2,-6)
    \psline(-6,-6)(-4,0)
\rput(0,-12){\psframebox*[fillstyle=solid]{$1$}}
\rput(-6,-6){\psframebox*[fillstyle=solid]{$2$}}
\rput(2,-6){\psframebox*[fillstyle=solid]{$3$}}
\rput(-10,6){\psframebox*[fillstyle=solid]{$12$}}
\rput(-12,0){\psframebox*[fillstyle=solid]{$4$}}
\rput(-4,0){\psframebox*[fillstyle=solid]{$6$}}
  \end{pspicture}
\hfill
  \begin{pspicture}(-6,-12)(2,6)
    \pspolygon(0,-12)(-6,-6)(-4,0)(2,-6)
\rput(0,-12){\psframebox*[fillstyle=solid]{$1$}}
\rput(-6,-6){\psframebox*[fillstyle=solid]{$2$}}
\rput(2,-6){\psframebox*[fillstyle=solid]{$3$}}
\rput(-4,0){\psframebox*[fillstyle=solid]{$6$}}
  \end{pspicture}
\hfill
  \begin{pspicture}(-6,-12)(12,6)
    \pspolygon(0,-12)(-6,-6)(4,0)(10,-6)
\psdots[linecolor=white,dotsize=4pt 4](-1,-3)(7,-3)
    \pspolygon(2,-6)(-4,0)(6,6)(12,0)
    \psline(0,-12)(2,-6)
    \psline(-6,-6)(-4,0)
    \psline(4,0)(6,6)
    \psline(10,-6)(12,0)
\rput(0,-12){\psframebox*[fillstyle=solid]{$1$}}
\rput(6,6){\psframebox*[fillstyle=solid]{$30$}}
\rput(-6,-6){\psframebox*[fillstyle=solid]{$2$}}
\rput(2,-6){\psframebox*[fillstyle=solid]{$3$}}
\rput(10,-6){\psframebox*[fillstyle=solid]{$5$}}
\rput(12,0){\psframebox*[fillstyle=solid]{$15$}}
\rput(4,0){\psframebox*[fillstyle=solid]{$10$}}
\rput(-4,0){\psframebox*[fillstyle=solid]{$6$}}
  \end{pspicture}
\hfill\mbox{}
\caption{Common divisors of $12$ and $30$}\label{fig:12,30}
\end{figure}
For large numbers, this algorithm is impractical; we shall develop the Euclidean Algorithm, which is far superior, in \S\ref{sect:Euc-alg} below.  Meanwhile,
note that every common divisor of $12$ and $30$ divides $6$.  We shall show that this is always true: $\gcd(a,b)$ is a common divisor of $a$ and $b$ that is greatest with respect to the ordering $\divides$ of divisibility; that is, if $c$ is a common divisor of $a$ and $b$, then $c\divides\gcd(a,b)$.

To prove this result, we may note that, by~\eqref{eqn:bx} and~\eqref{eqn:b+c} in Theorem~\ref{thm:div}, if
$a\divides b$ and $a\divides c$, then
$a$ divides every \textbf{linear combination,}
\begin{equation*}
ax+by,
\end{equation*}
of $a$ and $b$.
Let the set $\{ax+by\colon x,y\in\Z\}$ of these linear combinations be
denoted by
\begin{equation*}
  (a,b);
\end{equation*}
this is the \textbf{ideal}\index{ideal} of $\Z$ generated by $a$ and $b$.
Then
\begin{equation*}
(a)\included(j)\And(b)\included(j)\iff(a,b)\included(j).
\end{equation*}
That is, the common divisors of $a$ and $b$ are those $j$ such that $(a,b)\included(j)$.  In fact we have not introduced any new ideals, by the following:

\begin{lemma}
For all integers $a$ and $b$, for some unique non-negative integer $k$,
\begin{equation*}
(a,b)=(k).
\end{equation*}
\end{lemma}

\begin{proof}
Immediately $({0},{0})=({0})$.  Now suppose one of $a$ and $b$ is not $0$.  Then $(a,b)$ has positive elements, and we may let $k$ be the least of these.  Then $(k)\included(a,b)$.  We establish the reverse inclusion by showing $k$ divides $a$
and $b$.  By Theorem~\ref{thm:div-alg} (the Division Algorithm), we have $a=kq+r$ 
and ${0}\leq r<k$ for some $q$ and $r$.  Then
\begin{equation*}
r=a-kq=a-(ax+by)q=a(1-qx)+b(-qy)
\end{equation*}
for some $x$ and $y$, so
$r\in(a,b),$ and hence $r=0$ by
minimality of $k$.  So $k\divides a$.  By symmetry, $k\divides b$.
\end{proof}

\begin{theorem}\label{thm:gcd}
If $a$ and $b$ are integers, not both $0$, then
\begin{equation*}
(a,b)=\bigl(\gcd(a,b)\bigr),
\end{equation*}
that is, $\gcd(a,b)$ is the unique positive integer $k$ such that $(a,b)=(k)$.  Hence every common divisor of $a$ and $b$ divides $\gcd(a,b)$.
\end{theorem}

\begin{proof}
We know $(a,b)\included(j)$ if and only if $j$ is a common divisor of $a$ and $b$.
In particular, if $(a,b)=(k)$, then $k$ is a common divisor of $a$ and $b$, and if $j$ is also a common divisor, then $(k)\included(j)$, so $j\divides k$, and therefore $\size j\leq\size k$.
\end{proof}

The theorem is the reason why the notation $(a,b)$ is sometimes used in place of $\gcd(a,b)$.  The following is immediate.

\begin{corollary}[B\'ezout's Lemma\footnote{\url{http://en.wikipedia.org/wiki/Bezout's_identity} (accessed December 13, 2010).}]%
\index{B\'ezout's Lemma}
If $a$ and $b$ are not both $0$, the diophantine equation
\begin{equation*}
ax+by=\gcd(a,b)
\end{equation*}
is soluble.
\end{corollary}

The following is sometimes useful:

\begin{theorem}\label{thm:gcd-div}
For all integers $a$, $b$, and $c$, if one of $a$ and $b$ is not $0$, then
\begin{equation*}
\gcd(ac,bc)=\gcd(a,b)\cdot c.
\end{equation*}
In particular, if $\gcd(a,b)=\ell$, and $k\divides\ell$, then
\begin{equation*}
\gcd\Bigl(\frac ak,\frac bk\Bigr)=\frac{\ell}k.
\end{equation*}
\end{theorem}

If $\gcd(a,b)=1$, then
$a$ and $b$ together are called either
\textbf{relatively prime}%
\index{relatively prime}%
\index{prime!relatively ---, co-{}---}
 or
\textbf{co-prime;}%
\index{co-prime}
also, each of $a$ and $b$ is \textbf{prime to} the other.
This
is the case if the equation
\begin{equation}\label{eqn:B}
  ax+by=1
\end{equation}
is soluble.  Conversely, if $a$ and $b$ are co-prime, then~\eqref{eqn:B} \emph{must} have a solution, by B\'ezout's Lemma.
If $\gcd(a,b)=k$, then $a/k$ and $b/k$ are co-prime, by the last theorem.

Gauss proves the following in \P19 of the \emph{Disquisitiones Arithmeticae}~\cite{Gauss}, but he uses the Fundamental Theorem of Arithmetic (Theorem~\ref{thm:FTA} below) in his proof.

\begin{theorem}
If $a$ and $b$ are co-prime, and each divides $c$, then $ab\divides c$.  
\end{theorem}

\begin{proof}
Under the hypothesis, $c=bs=ar$ for some $s$ and $r$, and then
the following equations are soluble:
\begin{gather*}
  ax+by=1,\\
acx+bcy=c,\\
absx+bary=c,\\
ab(sx+ry)=c.\qedhere
\end{gather*}
\end{proof}

Euclid%
\index{Euclid}
proves the following in Proposition VII.30 of the
\emph{Elements} \cite{MR17:814b,MR1932864}, though his
\emph{statement} of the theorem assumes $a$ is 
\textsl{prime}%
\index{prime}%
\index{number|seealso{prime}} 
(see p.~\pageref{prime}). 


\begin{theorem}\label{thm:a|bc}
  If $a\divides bc$ and $\gcd(a,b)=1$, then $a\divides c$.
\end{theorem}

\begin{proof}
  Again, as in the proof of the last theorem, the following have solutions:
  \begin{gather*}
    ax+by=1,\\
acx+bcy=c.
  \end{gather*}
Since $a\divides ac$ and $a\divides bc$, we are done by Theorem~\ref{thm:div}.
\end{proof}




\section{Least common multiples}

The Hasse diagram of divisors of $60$ in Figure~\ref{fig:60} is symmetrical: if we interchange $n$ and $60/n$, the result is the same diagram, reflected, as on the right of Figure~\ref{fig:60'}.  
\begin{figure}[ht]
\centering
\psset{unit=2mm}
  \begin{pspicture}(-12,-12)(12,12)
    \pspolygon(0,-12)(-12,0)(-2,6)(10,-6)
    \psline(-6,-6)(4,0)
\psdots[linecolor=white,dotsize=4pt 4](-1,-3)(7,-3)(1,3)(-7,3)
    \pspolygon(0,12)(12,0)(2,-6)(-10,6)
    \psline(-12,0)(-10,6)
    \psline(0,-12)(2,-6)
    \psline(12,0)(10,-6)
    \psline(6,6)(-4,0)
    \psline(0,12)(-2,6)
    \psline(-6,-6)(-4,0)
    \psline(6,6)(4,0)
\rput(0,12){\psframebox*[fillstyle=solid]{$1$}}
\rput(0,-12){\psframebox*[fillstyle=solid]{$60$}}
\rput(6,6){\psframebox*[fillstyle=solid]{$2$}}
\rput(-6,-6){\psframebox*[fillstyle=solid]{$30$}}
\rput(-2,6){\psframebox*[fillstyle=solid]{$3$}}
\rput(2,-6){\psframebox*[fillstyle=solid]{$20$}}
\rput(-10,6){\psframebox*[fillstyle=solid]{$5$}}
\rput(10,-6){\psframebox*[fillstyle=solid]{$12$}}
\rput(12,0){\psframebox*[fillstyle=solid]{$4$}}
\rput(-12,0){\psframebox*[fillstyle=solid]{$15$}}
\rput(4,0){\psframebox*[fillstyle=solid]{$6$}}
\rput(-4,0){\psframebox*[fillstyle=solid]{$10$}}
  \end{pspicture}
\caption{Divisors of $60$, again}\label{fig:60'}
\end{figure}
The general result is the following.

\begin{theorem}\label{thm:den}
If $d$ and $e$ are divisors of some nonzero integer $n$, then
\begin{equation*}
d\divides e\iff\frac ne\divides\frac nd.
\end{equation*}
\end{theorem}

\begin{proof}
We have $d\divides e$ if and only if $dx=e$ for some $x$; but
\begin{equation*}
dx=e\iff ndx=ne\iff\frac{nx}e=\frac nd.\qedhere
\end{equation*}
\end{proof}

The theorem leads to a notion that is `dual' to the greatest common divisor.
A \textbf{common multiple} of $a$ and $b$ is any $j$ such that $a\divides j$ and $b\divides j$, that is, $(j)\included(a)\cap(b)$.  If $ab\neq0$, then $(a)\cap(b)$ has a positive element (either $ab$ or $-ab$), so it has a \emph{least} positive element; this is the \textbf{least common multiple}%
\index{least common multiple}
of $a$ and $b$, denoted by
\begin{equation*}
\lcm(a,b).
\end{equation*}
The greatest common divisor of $a$ and $b$ is the common divisor of $a$ and $b$ that is greatest among all common divisors---greatest with respect to the linear ordering $\leq$, but also with respect to divisibility.  The least common multiple of $a$ and $b$ has the corresponding property:

\begin{theorem}\label{thm:lcm}
If $ab\neq0$, then
\begin{equation}\label{eqn:lcmab}
\bigl(\lcm(a,b)\bigr)=(a)\cap(b).
\end{equation}
In particular, $\lcm(a,b)$ divides all common multiples of $a$ and $b$.
Moreover,
\begin{equation}\label{eqn:lcmgcd}
\lcm(a,b)=\frac{\size{ab}}{\gcd(a,b)}.
\end{equation}
\end{theorem}

\begin{proof}
Let $c$ and $d$ be common multiples of $a$ and $b$.  Then $\gcd(c,d)$ must also be a common multiple of $a$ and $b$.  That is, under the assumption $(c)\included(a)\cap(b)$ and $(d)\included(a)\cap(b)$, we have $(c,d)\included(a)\cap(b)$, and therefore $\bigl(\gcd(c,d)\bigr)\included(a)\cap(b)$.  In particular, if $d\notin(c)$, then
\begin{equation*}
(c)\pincluded(c,d)=\bigl(\gcd(c,d)\bigr)\included(a)\cap(b),
\end{equation*}
so $\size c\neq\lcm(a,b)$.  This establishes \eqref{eqn:lcmab} and the conclusion that $\lcm(a,b)$ divides all common multiples of $a$ and $b$.  

As a special case, $\lcm(a,b)$ divides $ab$.
By Theorem \ref{thm:den}, if $x$ is an arbitrary divisor of $ab$, then $x$ is a common multiple of $a$ and $b$ if and only if $ab/x$ is a common divisor of $ab/a$ and $ab/b$, which are just $b$ and $a$.  Hence $\size{ab}/\gcd(a,b)$ must be the least common multiple of $a$ and $b$ \emph{among the divisors of} $ab$.  But we already know that the least of all common multiples of $a$ and $b$ is among the divisors of $ab$.  Therefore we have \eqref{eqn:lcmgcd}.
\end{proof}

\begin{corollary}
If $ab\neq0$, and $c$ is a common multiple of $a$ and $b$, then
\begin{equation*}
\lcm(a,b)=\frac{\size c}{\gcd(c/a,c/b)}.
\end{equation*}
\end{corollary}

\begin{proof}
Theorem~\ref{thm:gcd-div}.
\end{proof}

For example, since $\gcd(12,30)=6$, we have that the least common multiple of
$60/12$ and $60/30$ is $60/6$, that is,
\begin{equation*}
  \lcm(5,2)=10.
\end{equation*}
In general, we have a Hasse diagram as in Figure~\ref{fig:lcm}.
\begin{figure}
  \begin{equation*}
  \xymatrix{&ab&\\
& \lcm(a,b) \ar@{.}[u] &\\
a \ar@{.}[ur] & & b \ar@{.}[ul]\\
& \gcd(a,b) \ar@{.}[ul] \ar@{.}[ur]\\
&1 \ar@{.}[u] &}
  \end{equation*}
  \caption{$\gcd$ and $\lcm$}\label{fig:lcm}
\end{figure}

Another corollary of the theorem is the following:

\begin{corollary}
If $ab\neq0$, and $x\equiv y$ \emph{modulo} both $a$ and $b$, then
\begin{equation*}
x\equiv y\pmod{\lcm(a,b)}.
\end{equation*}
\end{corollary}

\section{The Euclidean algorithm}\label{sect:Euc-alg}

%\section{Linear equations---preliminary}%\asterism{}

We have observed that every common divisor of $a$ and $b$ divides every linear combination of $a$ and $b$.  In particular, it divides the remainder of dividing $a$ by $b$.  For example, let $d=\gcd(63,23)$.  Then $d$ divides $63-23\cdot2$, which is $17$.  But then $23-17$ or $6$ is another linear combination of $63$ and $23$, so $d$ divides this.  Similarly $d$ divides $17-6\cdot 2$ or $5$.  Finally, $d$ divides $6-5$ or $1$.  Then $d$ must \emph{be} $1$; that is, $\gcd(63,23)=1$, and so $63$ and $23$ are relatively prime.  The computations are shown in Figure~\ref{fig:alg}.
\begin{figure}[ht]
\begin{equation*}
\xymatrix@C=0pt{
63&=&23\cdot2\ar[dll]&+&17,\ar[dll]\\
23&=&17\cdot1\ar[dll]&+&6,\ar[dll]\\
17&=&6\cdot2\ar[dll]&+&5,\ar[dll]\\
6&=&5\cdot1&+&1,
}
\end{equation*}
\caption{The Euclidean algorithm}\label{fig:alg}
\end{figure}
The general method for finding greatest common divisors is given by Euclid in Propositions VII.1 and 2\label{VII.2} of the \emph{Elements}.  In modern notation, we have the following.

\begin{theorem}[Euclidean Algorithm]\index{Euclidean algorithm}\label{thm:EA}
Suppose $a_1>a_2\geq0$.  There are unique sequences $(a_n\colon n\in\N)$ and $(q_n\colon n\in\N)$ such that, if $a_{n+1}\neq{0}$, then
\begin{align}
  a_n&=a_{n+1}\cdot q_n+a_{n+2},&{0}\leq a_{n+2}&<a_{n+1},
\end{align}
but if $a_{n+1}=0$, then $a_{n+2}=0=q_n$.  
Then the sequence $(a_n\colon n\in\N)$ is eventually $0$, and if $a_m$ is the last nonzero entry, then
\begin{equation*}
\gcd(a_{0},a_{1})=a_m.
\end{equation*}
\end{theorem}

\begin{proof}
The given conditions amount to a definition by recursion of the function $n\mapsto(a_n,a_{n+1})$.  In the notation of Theorem~\ref{thm:rec}, the set $A$ is $\Z\times\Z$, and $b=(a_1,a_2)$, while $f$ is given by $f(x,y)=(y,z)$, where $z$ is the least nonnegative residue of $x$ \emph{modulo} $y$, if $y\neq0$, but $z=0$ if $y=0$.  (The function $f$ is well defined by Theorem~\ref{thm:res}.)  

We now have that, if $a_{n+1}\neq0$, then $a_{n+2}<a_{n+1}$; also, the common divisors of $a_n$ and $a_{n+1}$ are just the common divisors of $a_{n+1}$ and $a_{n+2}$, so that
\begin{equation*}
\gcd(a_n,a_{n+1})=\gcd(a_{n+1},a_{n+2}).
\end{equation*}
In particular, if $a_m$ is the least of the positive numbers $a_n$, then $a_{m+1}=0$, so
\begin{equation*}
  \gcd(a_{0},a_{1})=\gcd(a_m,{0})=a_m.\qedhere
\end{equation*}
\end{proof}

In \S\ref{sect:incomm}, to establish the incommensurability of the diagonal and side of a square, we used the variant of the Euclidean Algorithm used by Euclid himself to prove his Proposition X.2.  

In the notation of Theorem~\ref{thm:EA}, two consecutive lines of computations as in Figure~\ref{fig:alg} can be written as
\begin{gather*}
	a_n=a_{n+1}\cdot q_n+a_{n+2},\\
	a_{n+1}=a_{n+2}\cdot q_{n+1}+a_{n+3};
\end{gather*}
but we can rewrite these as
\begin{gather*}
	\frac{a_n}{a_{n+1}}=q_n+\frac{a_{n+2}}{a_{n+1}},\\
	\frac{a_{n+1}}{a_{n+2}}=q_{n+1}+\frac{a_{n+3}}{a_{n+2}}.
\end{gather*}
With the notation $\xi_n$ for $a_{n+1}/a_n$, we now have
\begin{align*}
0&\leq\xi_n<1,&\frac1{\xi_n}&=q_n+\xi_{n+1}
\end{align*}
(assuming $\xi_{n+1}\neq0$), so
\begin{align}\label{eqn:xi}
q_n&=\Bigl[\frac1{\xi_n}\Bigr],&
\xi_{n+1}&=\frac1{\xi_n}-q_n.
\end{align}
Then we have
\begin{equation*}
\frac1{\xi_1}=q_1+\xi_2=q_1+\cfrac1{q_2+\xi_3}=q_1+\cfrac1{q_2+\cfrac1{q_3+\xi_4}}=\dots
\end{equation*}
For example, if we rewrite the computations of Figure~\ref{fig:alg} as above, we get
\begin{align*}
	\frac{63}{23}&=2+\frac{17}{23},&
	\frac{23}{17}&=1+\frac6{17},&
	\frac{17}6&=2+\frac56,&
	\frac65&=1+\frac15,
\end{align*}
and therefore
\begin{equation*}
\frac{63}{23}=2+\cfrac1{1+\cfrac1{2+\cfrac1{1+\cfrac15}}}.
\end{equation*}
But the definition \eqref{eqn:xi} can be applied to any real number chosen as $\xi_1$.  If $\xi_n$ is never $0$ for any $n$, or equivalently if $(q_1,q_2,\dots)$ never ends, then by Euclid's Proposition X.2, the number $\xi_1$ must be irrational.

In \S\ref{sect:incomm}, we worked out the example where $\xi_1=1/\sqrt2$.  Indeed, let $d$ and $s$ be the diagonal and side of a square, respectively, as in
Figure~\ref{fig:ds}.
\begin{figure}[ht]
\begin{center}
\psset{unit=6mm}
  \begin{pspicture}(-0.5,-0.5)(4.5,4.5)
    \psline(0,0)(4,0)(4,4)(0,4)(0,0)(4,4)
    \psline(1.172,1.172)(0,2.343)
    \uput[r](4,2){$s$}
    \uput[d](2,0){$s$}
    \uput[u](2,4){$s$}
    \uput[dr](2,2){$d$}
    \uput[ul](2.586,2.586){$s$}
%    \uput[l](0,3.172){$d-s$}
%    \uput[ur](0.586,1.756){$d-s$}
%    \uput[ul](0.586,0.586){{$d-s$}}
  \end{pspicture}
\end{center}
\caption{Diagonal and side}\label{fig:ds}
\end{figure}
Since $d^2-s^2=s^2$, we have
\begin{equation*}
  \frac{d-s}s=\frac s{d+s}.
\end{equation*}
From this equation, since $s<d+s$, we have $d-s<s$.  Letting $\xi_1=s/d$, we have
\begin{align*}
\frac1{\xi_1}&=\frac ds,& q_1&=1,& \xi_2=\frac{d-s}s,\\
\frac1{\xi_2}&=\frac s{d-s}=\frac{d+s}s,& q_2&=2,& \xi_3=\frac{d-s}s,
\end{align*}
so the sequence of $q_n$ is $(1,2,2,\dots)$.


\section{The Hundred Fowls Problem}

Problem 3.38 in the \emph{Mathematical Classic of Zhang Qiujian}\footnote{Burton~\cite[pp.~36--7]{Burton} discusses the problem, but my source for the text is the anthology edited by Katz~\cite[pp.~302--8]{Katz}, where it is said that the \emph{Classic} was probably compiled between the years 466 and 485.} reads thus:
\begin{quote}
Now one cock is worth $5$ \emph{qian,} one hen $3$ \emph{qian,} and $3$ chicks $1$ \emph{qian.}  It is required to buy $100$ fowls with $100$ \emph{qian.} In each case, find the number of cocks, hens, and chicks bought.  
Answer says: 
$4$ cocks worth $20$ \emph{qian,} $18$ hens worth $54$ \emph{qian,} $78$ chicks worth $26$ \emph{qian.}  
Another answer:
$8$ cocks worth $40$ \emph{qian,} $11$ hens worth $33$ \emph{qian,} $81$ chicks worth $27$ \emph{qian.}  
Another answer:
$12$ cocks worth $60$ \emph{qian,} $4$ hens worth $12$ \emph{qian,} $84$ chicks worth $28$ \emph{qian.}  

Method says:  Add $4$ to the number of cocks, subtract $7$ from the number of hens and add $3$ to the number of chicks to obtain the answer.
\end{quote}
The given `answers' are correct; and according to the `method', the given answers are the only ones possible (assuming at least one cock, one hen, and one chick must be bought).  But why is the method correct?
Let
\begin{align*}
  x&=\#\text{ cocks,}&
  y&=\#\text{ hens,}&
  z&=\#\text{ chicks.}
\end{align*}
The problem is to solve
\begin{gather*}%\label{eqn:xyz}
  x+y+z=100,\\
5x+{3}y+\frac13z=100.
\end{gather*}
Multiplying the second equation by $3$ and subtracting the first equation yields
$14x+8y=200$ and then
\begin{equation*}%\label{eqn:7x+4y=100}
7x+4y=100.
\end{equation*}
Since $4\divides 100$, one solution is $({0},25)$, that is, $x={0}$ and
$y=25$, and then $z=75$.  
Moreover, since $7$ and $4$ are co-prime, any increase in $x$ must be a multiple of $4$, and then $y$ must decrease by the same multiple of $7$, so $z$ must increase by the same multiple of $3$ (according to the first equation).
So we get the three solutions given, and no others (assuming at least one cock must be bought):
\begin{equation*}
  \begin{array}{c|c|c}
x&y&z\\\hline
4&18&78\\
8&11&81\\
12&4&84
  \end{array}
\end{equation*}
Joseph W. Dauben~\cite[p.308]{Katz} writes of the Hundred Fowls Problem:
\begin{quote}
Outside China, versions of the problem appear in the works of, among others, Alcuin of York in the eighth century, Mahavira in the ninth century, Abu Kamil in the tenth century, Bhaskara in the twelfth century, Leonardo of Pisa in the thirteenth century, and al-Kashi in the fifteenth century.
\end{quote}

\chapter{Prime numbers}\label{ch:primes}

\section{The Fundamental Theorem of Arithmetic}\label{sect:FTA}

In the 11th definition in Book VII of the \emph{Elements,} Euclid defines a \textbf{prime number}\label{prime}%
\index{prime number} (\Gk{pr~wtos >arijm'os}) as a number `that is measured by a unit alone.'  But a \emph{number} (\Gk{>arijm'os}) here is `a multitude composed of units.'  A multitude is more than one.  Thus a unit is \emph{not} a number for Euclid; it is just a unit, out of which numbers can be created.

If, according to Euclid, a prime number is measured---or we might say \emph{divided}---only by a unit, then it seems that no number measures \emph{itself.}
However, in Proposition 2 (mentioned above on page~\pageref{VII.2} in \S\ref{sect:gcd}), Euclid mentions that a number \emph{does} measure itself.  So there seems to be some confusion in Euclid's text as we have it today.

Our formulation of Euclid's definition is that a positive integer is prime if it has exactly one \emph{proper} positive divisor, which must then be $1$.
Having \emph{no} proper divisors, $1$ is not prime; but $2$ is prime.  More generally, $b$ is prime if and
only if $b>1$ and
\begin{equation*}
a>0\And a\divides b\implies a\in\{1,b\}.
\end{equation*}
By Theorem~\ref{thm:div-ord}, an alternative formulation of this last condition is
\begin{equation*}
1<a<b\implies a\ndivides b.
\end{equation*}
\emph{Throughout this book,
$p$ and $q$ will always stand for primes.}  Then 
\begin{equation*}
  \gcd(a,p)\in\{1,p\},
\end{equation*}
so either $a$ and $p$ are co-prime, or else $p\divides a$.

\begin{theorem}\label{thm:prime-div}
Every integer greater than $1$ has a prime divisor.
\end{theorem}

\begin{proof}
If $n>1$, then the least of the divisors of $n$ that are greater than $1$ must be prime by Theorem~\ref{thm:div-ord}.
\end{proof}

A positive integer with a proper divisor that is greater than $1$ is \textbf{composite.}%
\index{composite number}%
\index{number!composite ---}  
So $1$ is neither prime nor composite, but every integer that is greater than $1$ is prime or composite, but not both.

\begin{theorem}[Euclid, VII.30]\label{thm:Euclid}
\index{theorem!Euclid's Th---}%
\index{Euclid!---'s Theorem}
If $p\divides ab$, then either $p\divides a$ or $p\divides b$.
\end{theorem}

\begin{proof}
If $p\ndivides a$, then $\gcd(a,p)=1$,
so $p\divides b$ by  Theorem~\ref{thm:a|bc}.
\end{proof}

\begin{corollary}  
If
$p\divides a_1\dotsb a_n$, where $n\geq1$, then $p\divides a_k$ for some $k$.  
\end{corollary}

\begin{proof}
Use induction.
The claim is trivially true when $n=1$.  Suppose it is true when
$n=m$.  Say $p\divides a_1\dotsb a_{m+1}$.  By the theorem, we have
that $p\divides a_1\dotsb a_m$ or $p\divides a_{m+1}$.  In the former
situation, by the inductive hypothesis, $p\divides a_k$ for some $k$.
So the claim holds when $n=m+1$, assuming it holds when $n=m$.  Therefore the claim does indeed hold for all $n$.
\end{proof}

The following appears in Gauss's \emph{Disquisitiones Arithmeticae} as \P16; Hardy and Wright~\cite[p.~10]{MR568909} judge that to be the first explicit statement of the theorem.

\begin{theorem}[Fundamental Theorem of Arithmetic]\label{thm:FTA}%
\index{Fundamental Theorem of Arithmetic}%
\index{theorem!Fundamental Th--- of Arithmetic}
  Every positive integer is uniquely a product
  \begin{equation*}
    p_{1}\dotsm p_n
  \end{equation*}
of primes, where
\begin{equation*}
  p_{1}\leq\dotsb\leq p_n.
\end{equation*}
\end{theorem}

\begin{proof}
Trivially, $1=p_1\dotsm p_n$, where $n=0$.  Suppose $m>1$, and let $p_1$ be its least prime divisor (which exists by Theorem~\ref{thm:prime-div}).  If $m=p_1$, we are done; otherwise, the least divisor of $m/p_1$ that is greater than $1$ is a prime, $p_2$.  If $m=p_1p_2$, we are done; otherwise, the least divisor of $m/p_1p_2$ that is greater than $1$ is a prime $p_3$.
Continuing thus, we get an increasing sequence $p_1,p_2,p_3,\dots$ of primes, where $p_1\dotsm p_k\divides m$.  Since
  \begin{equation*}
    m>\frac m{p_{1}}>\frac m{p_{1}p_{2}}>\dotsb,
  \end{equation*}
the sequence of primes must terminate
by the Well Ordering Principle,
and for some $n$ we have $m=p_{1}\dotsb p_n$.

For uniqueness, suppose also $m=q_{1}\dotsb q_{\ell}$.  Then
$q_{1}\divides m$, so $q_{1}\divides p_i$ for some $i$ by the corollary to Theorem~\ref{thm:Euclid}, and therefore
$q_{1}=p_i$.  Hence 
\begin{equation*}
  p_{1}\leq p_i=q_{1}.
\end{equation*}
By the symmetry of the argument, $q_{1}\leq p_{1}$, so $p_{1}=q_{1}$.
Similarly, $p_{2}=q_{2}$, \&c.,
and $n=\ell$.
\end{proof}

Alternatively, every positive integer is uniquely a product
\begin{equation*}
p_1{}^{a_1}\dotsm p_n{}^{a_n}, 
\end{equation*}
that is,
\begin{equation*}
\prod_{k=1}^np_k{}^{a_k},
\end{equation*}
where $p_1<\dotsb<p_n$ and the exponents $a_k$ are all positive
integers.  Here of course the $p_k$ (as well as the $a_k$) depend on
the integer.  To incorporate this dependence into the notation, we may
say that, for every positive integer $a$, there is a unique function
$p\mapsto a(p)$ on the set of primes such that $a(p)\geq0$ for all
$p$, and $a(p)=0$ for all but finitely many $p$, and 
\begin{equation}\label{eqn:FTA}
a=\prod_pp^{a(p)}.
\end{equation}
Now the Fundamental Theorem of Arithmetic allows alternative proofs of
theorems like~\ref{thm:gcd} and~\ref{thm:lcm}, since we have 
\begin{align*}
\gcd(a,b)&=\prod_pp^{c(p)},&
\lcm(a,b)&=\prod_pp^{d(p)},
\end{align*}
or simply $\gcd(a,b)=c$ and $\lcm(a,b)=d$, where
\begin{align*}
c(p)&=\min(a(p),b(p)),&
d(p)&=\max(a(p),b(p)).
\end{align*}

\section{Irreducibility}

What is there about $\N$ that makes the Fundamental Theorem of Arithmetic possible?

In an arbitrary commutative ring, the elements analogous to the prime numbers are called \textsl{irreducible,}%
\index{irreducible}
and the elements that respect the analogue of Theorem~\ref{thm:Euclid} are called \textsl{prime.}%
\index{prime}
To be precise,
a nonzero element of an arbitrary commutative ring is a 
\textbf{unit}%
\index{unit of a ring}
if it has a multiplicative inverse.  A nonzero element $a$ of the ring
is 
\textbf{irreducible}
 if $a$ is not a unit, but whenever $a=bc$, one
of $b$ and $c$ must be a unit.  In this sense, the prime integers are just the
\emph{positive} irreducibles in $\Z$.  In an arbitrary commutative ring, a nonzero nonunit $\pi$ is called \textbf{prime} if
\begin{equation*}
\pi\divides ab\And\pi\ndivides a\implies \pi\divides b.
\end{equation*}

In an arbitrary commutative ring, irreducibles need not be prime.
For example, let 
\begin{equation*}
\Z[\rten]=\{x+y\rten\colon x,y\in\Z\},  
\end{equation*}
which is a sub-ring of $\R$.
In this sub-ring, we have
\begin{equation*}
  (4+\rten)(4-\rten)=6={2}\cdot {3}.  
\end{equation*}
In particular,
\begin{equation*}
4+\rten\divides 2\cdot 3.
\end{equation*}
Also, $4+\rten$ is irreducible, but it divides neither $2$ nor $3$.
To show this, we use the operation $\sigma$ on $\Z[\rten]$ given by
\begin{equation*}
  \sigma(a+b\rten)=a-b\rten.
\end{equation*}
(Compare this with complex conjugation.)  Since
\begin{equation*}
(a\pm b\rten)(c\pm d\rten)=ac+10bd\pm(ad+bc)\rten,
\end{equation*}
we have $\sigma(xy)=\sigma(x)\cdot\sigma(y)$.
Now define
\begin{equation*}
N(x)=x\cdot\sigma(x),
\end{equation*}
so that
$N(a+b\rten)=a^2-10b^2$,
which is always an integer.
Then
\begin{equation*}
N(xy)=N(x)\cdot N(y).
\end{equation*}
The units of $\Z[\rten]$ are just those elements $x$ such that
$N(x)=\pm1$.  Indeed, if $x$ is a unit, then $xy=1$ for some $y$, and
then $N(x)\cdot N(y)=N(xy)=1$, so $N(x)=\pm1$; conversely, if
$N(x)=\pm1$, this means $x\cdot(\pm\sigma(x))=1$, so $x$ is a unit.
For example, $3+\rten$ is a unit; but $4+\rten$ is not a unit, since
$N(4+\rten)=6$. 

We always have that $N(x)$ is congruent to a square \emph{modulo}
$10$; so it is conjugate to one of $0$, $\pm1$, $\pm4$, and $5$.  If
$xy=4+\rten$, then $N(x)\cdot N(y)=6$, but $N(x)$ cannot be $\pm2$ or
$\pm3$, so one of $N(x)$ and $N(y)$ must be $\pm1$.  Thus $4+\rten$ is
irreducible. 

Finally, since $6$ divides neither $4$ nor $9$, that is, $N(4+\rten)$
divides neither $N(2)$ nor $N(3)$, we have that $4+\rten$ divides
neither $2$ nor $3$. 


\section{The Sieve of Eratosthenes}\label{sect:sieve}


According to Nicomachus~\cite[pp.~100--3]{MR13:419a}, who appears to
be our earliest source on the matter, the following method of finding
prime numbers was referred to by Eratosthenes as a
\textbf{sieve} (\Gk{k'oskinon}).\footnote{Eratosthenes of Cyrene
  (276--194 \textsc{bce}) also measured the circumference 
  of the earth, by measuring the shadows cast by posts a certain
  distance apart in Egypt.  Measuring \emph{this} distance must have needed
  teams of surveyors and a government to 
  fund them.  Christopher Columbus was not in a position to make the
  measurement again, so he had to rely on ancient measurements
  \cite{MR2038833}.}  

Perhaps everybody knows this method.
We know $2$ is prime, but the other positive even numbers are
  composite.  We list the positive odd integers, starting with $3$,
  continuing as far as we like.  We note $3$ as prime, but strike out
  its proper multiples from the list.  The next unstricken number is
  $5$.  We note this as prime, but  strike out its proper multiples,
  and so on, as in Table~\ref{table:sieve}. 
  \begin{sidewaystable}
\setlength{\fboxsep}{0.6mm}
      \begin{multline*}
    \pb 3 \ 5 \ 7 \ \os
    9 \ 11 \ 13 \ \os{15} \ 17 \ 19 \ \os{21} \ 23 \ 25 \ \os{27} \ 29
    \ 31 \ \os{33} \ 35 \ 37 \ \os{39} \ 41 \ 43 \ \os{45} \ 47 \ 49
    \ \os{51} \ 53 \ 55 \ \os{57} \ 59\ 61\ \os{63}\\ 65 \ 67
    \ \os{69} \ 71 \ 73\  \os{75} \ 77\ 79 \ \os{81} \ 83 \ 85
    \ \os{87} \ 89 \ 91 \ \os{93} \ 95 \ 97 \ \os{99} \ 101 \ 103
    \ \os{105} \ 107 \ 109 \ \os{111} \ 113 \ 115 \ \os{117} \ 119     
      \end{multline*}
      \begin{multline*}
    \pb 3 \pb 5 \ 7 \ \os
    9 \ 11 \ 13 \ \os{15} \ 17 \ 19 \ \os{21} \ 23 \ \os{25} \ \os{27} \ 29
    \ 31 \ \os{33} \ \os{35} \ 37 \ \os{39} \ 41 \ 43 \ \os{45} \ 47 \ 49
    \ \os{51} \ 53 \ \os{55} \ \os{57} \ 59\ 61\ \os{63}\\ \os{65} \ 67
    \ \os{69} \ 71 \ 73\  \os{75} \ 77\ 79 \ \os{81} \ 83 \ \os{85}
    \ \os{87} \ 89 \ 91 \ \os{93} \ \os{95} \ 97 \ \os{99} \ 101 \ 103
    \ \os{105} \ 107 \ 109 \ \os{111} \ 113 \ \os{115} \ \os{117} \ 119     
      \end{multline*}
      \begin{multline*}
    \pb 3 \pb5 \pb7 \ \os
    9 \ 11 \ 13 \ \os{15} \ 17 \ 19 \ \os{21} \ 23 \ \os{25} \ \os{27} \ 29
    \ 31 \ \os{33} \ \os{35} \ 37 \ \os{39} \ 41 \ 43 \ \os{45} \ 47 \ \os{49}
    \ \os{51} \ 53 \ \os{55} \ \os{57} \ 59\ 61\ \os{63}\\ \os{65} \ 67
    \ \os{69} \ 71 \ 73\  \os{75} \ \os{77}\ 79 \ \os{81} \ 83 \ \os{85}
    \ \os{87} \ 89 \ \os{91} \ \os{93} \ \os{95} \ 97 \ \os{99} \ 101 \ 103
    \ \os{105} \ 107 \ 109 \ \os{111} \ 113 \ \os{115} \ \os{117} \ 119     
      \end{multline*}
      \begin{multline*}
    \pb 3 \pb5 \pb7 \os 9 \pb{11} \pb{13} \os{15} \pb{17} \pb{19}
    \os{21} \pb{23} \os{25} \os{27} \pb{29} \pb{31} \os{33} \os{35}
    \pb{37} \os{39} \pb{41} \pb{43} \os{45} \pb{47} \os{49} \os{51}
    \pb{53} \os{55} \os{57} \pb{59} \pb{61} \os{63}\\ \os{65} \pb{67}
    \os{69} \pb{71} \pb{73}  \os{75} \os{77} \pb{79} \os{81} \pb{83}
    \os{85} \os{87} \pb{89} \os{91} \os{93} \os{95} \pb{97} \os{99}
    \pb{101} \pb{103} \os{105} \pb{107} \pb{109} \os{111} \pb{113}
    \os{115} \os{117} \pb{119}      
      \end{multline*}
\caption{The Sieve of Eratosthenes}\label{table:sieve}
  \end{sidewaystable}
Those numbers not stricken are prime.

At each step, once a number $k$ is noted as prime, then only $k^2$ and
greater multiples of $k$ need be stricken; lesser multiples of $k$
have already been stricken.

Hence, if it is the odd numbers less than $n^2$ that are listed, and
the proper 
multiples of the primes that are less than $n$ are stricken, then
the remaining numbers are prime.  In Table~\ref{table:sieve}, as it is
the odd numbers less than $11^2$ that are listed, so, once the proper
multiples of $3$, $5$, and $7$ are stricken, the remaining numbers are
all prime.

Formulating this as a test for individual primes, we have the following.

\begin{theorem}
If $1<m<n^2$, and $p\ndivides m$ whenever $p<n$, then $m$ must be prime.
\end{theorem}

\begin{proof}
Suppose $1<m<n^2$, but $m$ is not prime.  Then $m=ab$ for some $a$ and
$b$, where $1<a\leq b<m$, so $a^2\leq ab=m<n^2$ and hence $a<n$.  But
then $a$ has a prime factor $p$ by Theorem~\ref{thm:prime-div}, so
$p<n$ and $p\divides m$. 
\end{proof}

We normally write numbers in decimal notation, which means for example
that $365$ is a code for the sum 
$5+6t+3t^2$, where $t$ is the fourth triangular number, 
\begin{center}
\psset{xunit=1cm,yunit=1.73cm}
  \begin{pspicture}(4.2,-0.6)(5.4,0)
%\psgrid    
\psdots
%(0,0)
%(1,-0.2)(1.4,-0.2)(1.2,0)
%(2.4,-0.4)(2.8,-0.4)(3.2,-0.4)(2.6,-0.2)(3,-0.2)(2.8,0)
(4.2,-0.6)(4.6,-0.6)(5,-0.6)(5.4,-0.6)(4.4,-0.4)(4.8,-0.4)(5.2,-0.4)(4.6,-0.2)(5,-0.2)(4.8,0)
  \end{pspicture}
\end{center}
---called \emph{decem} in Latin, but in English \emph{ten.}  There is
no obvious reason, other than our having ten fingers, why $t$ should be ten and
not be some other number.  Nonetheless, given the decimal system, we
have some standard tests for divisibility by small primes: 

\begin{theorem}
Let $t=2\cdot5$.
Every positive integer $a_0+a_1t+\cdots+a_nt^n$ is congruent, \emph{modulo}
\begin{enumerate}
\item
$2$ and $5$, to $a_0$,
\item
$3$ (and $9$), to $a_0+a_1+\cdots+a_n$,
\item
$7$, to $a_0+3a_1+\cdots+3^na_n$,
\item
$11$, to $a_0-a_1+\cdots+(-1)^na_n$,
\item
$13$, to $a_0-3a_1+\cdots+(-3)^na_n$.
\end{enumerate}
Every positive integer $b_0+b_1t^3+\cdots+b_nt^{3n}$ is congruent, \emph{modulo} $1001$ (that is, $1+t^3$, or $7\cdot11\cdot13$), to $b_0-b_1+\cdots+(-1)^nb_n$.
\end{theorem}

Suppose $n$ is a composite number less than $37^2$ (that is, $1369$).  Then $n$ is divisible by one of the eleven primes
\begin{equation*}
2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31.
\end{equation*}
We can easily check for divisibility by $2$, $3$, and $5$.  If
$n=a+10b+100c+1000d$, we can consider $n-1001d$, that is, $a+10b+100c-d$: this is divisible by $7$, $11$, or $13$ if and only if $n$ is.  If a prime factor of $n$ has
not been detected so far, then $n\geq17^2$, and $n$ is divisible by
one of $17$, $19$, $23$, $29$, and $31$.  In particular, $n$ is one of
the numbers listed in Table~\ref{table:primes}.\footnote{To create
  this table, I used a table of Burton~\cite[Table 2,
    pp.~394--403]{Burton}, which lists all odd positive integers that
  are less than $5000$ and are indivisible by $5$, along with their
  least prime factors.  As a check, I noted that my table should
  contain $48$ numbers, namely 
\begin{compactitem}
\item
$17$ times one of $17$, $19$, $23$, $29$, $31$, $37$, $41$, $43$,
  $47$, $53$, $59$, $61$, $67$, $71$, $73$, $79$; 
\item
$19$ times one of \phantom{$17$, }$19$, $23$, $29$, $31$, $37$, $41$,
  $43$, $47$, $53$, $59$, $61$, $67$, $71$; 
\item
$23$ times one of \phantom{$17$, $19$, }$23$, $29$, $31$, $37$, $41$,
  $43$, $47$, $53$, $59$; 
\item 
$29$ times one of \phantom{$17$, $19$, $23$, }$29$, $31$, $37$, $41$,
  $43$, $47$; 
\item 
$31$ times one of \phantom{$17$, $19$, $23$, $29$, }$31$, $37$, $41$,
  $43$. 
\end{compactitem}
Having copied what should be these products from Burton's table, along
with their smaller prime factors, I used a pocket calculator to find
the other factors and thus verify the numbers.} 
\begin{table}
\begin{align*}
&\begin{array}{r@{{}={}}r}
289&17\cdot17\\
323&17\cdot19\\
361&19\cdot19\\
391&17\cdot23\\
437&19\cdot23\\
493&17\cdot29\\
527&17\cdot31\\
529&23\cdot23\\
551&19\cdot29\\
589&19\cdot31\\
629&17\cdot37\\
667&23\cdot29\\
697&17\cdot41\\
703&19\cdot37\\
713&23\cdot31\\
731&17\cdot43
\end{array}
&
&\begin{array}{r@{{}={}}r}
779&19\cdot41\\
799&17\cdot47\\
817&19\cdot43\\
841&29\cdot29\\
851&23\cdot37\\
893&19\cdot47\\
899&29\cdot31\\
901&17\cdot53\\
943&23\cdot41\\
961&31\cdot31\\
989&23\cdot43\\
1003&17\cdot59\\
1007&19\cdot53\\
1037&17\cdot61\\
1073&29\cdot37\\
1081&23\cdot47
\end{array}
&
&\begin{array}{r@{{}={}}r}
1121&19\cdot59\\
1139&17\cdot67\\
1147&31\cdot37\\
1159&19\cdot61\\
1189&29\cdot41\\
1207&17\cdot71\\
1219&23\cdot53\\
1241&17\cdot73\\
1247&29\cdot43\\
1271&31\cdot41\\
1273&19\cdot67\\
1333&31\cdot43\\
1343&17\cdot79\\
1349&19\cdot71\\
1357&23\cdot59\\
1363&29\cdot47
\end{array}
\end{align*}
\caption{Composite numbers less than $1369$ with least prime factor
  $17$ or more}\label{table:primes} 
\end{table}

\section{The infinity of primes}%\asterism{}

The following has been known for well over two thousand years.

\begin{theorem}[Euclid, IX.20]
\index{theorem!Euclid's Th---}%
\index{Euclid!---'s Theorem}
  There are more than any number of primes.
\end{theorem}

\begin{proof}
  Suppose we have $n$ primes, say $p_1$, \dots, $p_n$.  Then $p_1\dotsm p_n+1$
  has a prime factor by Theorem~\ref{thm:prime-div}, and this factor is not one of the $p_k$.
\end{proof}

There are many proofs of this ancient theorem.  A recent proof by 
Filip Saidak~\cite{Saidak} is as follows.\footnote{I learned of the proof from \emph{Matematik D\"unyas\i} (2007-II [no.~73], p.~69).  I write this book for myself and my students; but it is on the web.  A colleague of Dr Saidak's found it and informed Dr Saidak, who kindly sent me a copy of his original paper.}  Define $a_{0}={2}$ and
$a_{n+1}=a_n(1+a_n)$.  Suppose $k<n$.  Then $a_k\divides a_{k+1}$, and
$a_{k+1}\divides a_{k+{2}}$, and so on, up to $a_{n-1}\divides a_n$, so
$a_k\divides a_n$.  Similarly, since $1+a_k\divides a_{k+1}$, we have
$1+a_k\divides a_n$.  Therefore $\gcd(1+a_k,1+a_n)=1$.  Thus any two
elements of the infinite set $\{1+a_n\colon n\in\N\}$ are co-prime.

For yet another proof,
using the full Fundamental Theorem of Arithmetic (Theorem~\ref{thm:FTA}),
we consider the product
\begin{equation*}
  \prod_{p}\frac1{1-1/p},
\end{equation*}
which is certainly well defined if there are only finitely many primes.  Each factor in the product is the sum of a \textbf{geometric series:}%
\index{geometric series}
\begin{equation*}
\frac1{1-1/p}=1+\frac1p+\frac1{p^2}+\dotsb
=\sum_{k=0}^{\infty}\frac1{p^k}. 
\end{equation*}
We have now
\begin{equation*}
  \prod_{p}\frac1{1-1/p}=\prod_p\sum_{k=0}^{\infty}\frac1{p^k},
\end{equation*}
a product of sums (of infinitely many addends).  By distributivity of multiplication over addition, this product of sums is also a sum of (infinitely many) products, and each of these products has, as a factor, an addend from each of the original sums.  Such a product then is of the form
\begin{equation}\label{eqn:1/prod}
\prod_p\frac1{p^{k(p)}},
\end{equation}
where $k(p)\geq0$.  This product is $1/k$ for some positive integer $k$.  Moreover,
by the Fundamental Theorem of Arithmetic as expressed in~\eqref{eqn:FTA}, for each positive integer $k$, the reciprocal $1/k$ arises as a product as in~\eqref{eqn:1/prod} in exactly one way.  Therefore, under the assumption that there are finitely many primes, we have
\begin{equation}\label{eqn:harm}
  \prod_{p}\frac1{1-1/p}=\sum_{n=1}^{\infty}\frac1n.
\end{equation}
But this is the 
\textbf{harmonic series,}%
\index{harmonic series} 
which
diverges:
\begin{align*}
\sum_{n=1}^{\infty}\frac1n
&=  1+\frac12 +\Bigl(\frac13+\frac14\Bigr)
 +\Bigl(\frac15+\frac16+\frac17+\frac18\Bigr) +\dotsb\\
&\geq1+\frac12+\Bigl(\frac14+\frac14\Bigr)
 +\Bigl(\frac18+\frac18+\frac18+\frac18\Bigr) +\dotsb\\
& =1+\frac12\quad+\quad\frac12\quad+\qquad\frac12\qquad+\qquad\dotsb 
\end{align*}
Therefore there are infinitely many primes.  

The same computations that give~\eqref{eqn:harm} yield also
\begin{equation}\label{eqn:rzeta}
  \prod_{p}\frac1{1-1/p^s}=\sum_{n=1}^{\infty}\frac1{n^s}.
\end{equation}
The sum converges, when $s>1$, to the value denoted by $\rzeta(s)$; this is the \textbf{Riemann zeta function}%
\index{Riemann zeta function} 
of $s$.  Then the product also converges, in the sense that
\begin{equation*}
\lim_{n\to\infty}\prod_{p\leq n}\frac1{1-1/p^s}=\rzeta(s).
\end{equation*}
Hardy and Wright~\cite[p.~246]{MR568909} describe~\eqref{eqn:rzeta} as
`an analytical expression of the fundamental theorem of arithmetic.' 

\section{Bertrand's Postulate}\label{sect:B}

We shall prove one result on the distribution of primes, namely the
so-called Bertrand's Conjecture, Theorem~\ref{thm:B} below.  The proof
does use a bit of analysis, though this could be
eliminated.\footnote{The proof here is based on that of Hardy and
  Wright~\cite[\S22.3]{MR568909}, who attribute it to Paul Erd\H
  os~\cite{Erdos}.  Note that Erd\H os's paper appeared in 1932, and
  Erd\H os was born in 1913.  An earlier proof, from 1919, is due to
  Srinivasa Ramanujan~\cite{Ramanujan}; this proof is very short (2
  pages), but makes use of the Gamma function\index{Gamma function}
  (defined in \S\ref{sect:other}) and the so-called \textsl{Stirling's
    approximation}% 
\index{Stirling's approximation} 
to it.  Hardy and Wright attribute the earliest proof of Bertrand's
Postulate to Tchebyshef in 1850.} 
given an arbitrary positive real number $x$, we define
\begin{equation*}
\mtheta(x)=\sum_{p\leq x}\log p.
\end{equation*}
Here of course $\log x$ is the 
\textbf{natural logarithm}%
\index{natural logarithm}%
\index{logarithm}
 of $x$, that is,
\begin{equation*}
\log x=\int_1^x\frac{\mathrm dt}t.
\end{equation*}
So $\mtheta(x)=\log\prod_{p\leq x}p$.  
For example, $\mtheta(\mpi)=\mtheta(3)=\log 2+\log 3=\log 6$.
If $x<2$, then $\mtheta(x)=0$.  We could work with $\me^{\mtheta(x)}$
instead, which is an integer if $x$ is; this is the only case we need
consider; but there is no harm in giving a more general treatment. 

\begin{lemma}
For all positive real numbers $x$,
\begin{equation*}
\mtheta(x)<2x\log 2.
\end{equation*}
\end{lemma}

\begin{proof}
It is enough to prove the claim when $x$ is a positive integer $n$.
We shall use strong induction.   
We have
\begin{equation*}
\mtheta(2m)=\mtheta(2m-1),
\end{equation*}
so the claim holds when $n$ is an \emph{even} positive integer,
provided it holds for lesser positive integers $n$.  

We now show that the claim holds when $n$ is an \emph{odd} positive integer, provided it holds for lesser positive integers $n$.
We have 
\begin{align*}
\mtheta(2m+1)
&=\mtheta(2m+1)-\mtheta(m+1)+\mtheta(m+1)\\
&=\sum_{m+1<p\leq 2m+1}\log p+\mtheta(m+1).
\end{align*}
Now, each $p$ such that $m+1<p\leq2m+1$ is a factor of $(2m+1)!$ that
is not also a factor of $(m+1)!$.  We also have 
\begin{equation*}
\frac{(2m+1)!}{(m+1)!\cdot m!}=\binom{2m+1}{m+1},
\end{equation*}
which is an integer, and
each $p$ such that $m+1<p\leq2m+1$ must be a factor of \emph{this} too.
Therefore
\begin{equation*}
\mtheta(2m+1)\leq\log\binom{2m+1}{m+1}+\mtheta(m+1).
\end{equation*}
Now, we have also
\begin{equation*}
\binom{2m+1}{m+1}=\binom{2m+1}{m}, 
\end{equation*}
and these are terms in the expansion of $(1+1)^{2m+1}$; so
\begin{equation*}
2\binom{2m+1}{m+1}\leq2^{2m+1}.  
\end{equation*}
Therefore
\begin{align*}
\mtheta(2m+1)
&\leq\log(2^{2m})+\mtheta(m+1)\\
&=2m\log2+\mtheta(m+1).
\end{align*}
In particular, if $\mtheta(m+1)<2(m+1)\log2$, then $\mtheta(2m+1)<2(2m+1)\log2$.
Thus the claim holds when $n$ is odd if it holds for lesser $n$.
\end{proof}

We should also observe:\footnote{Erd\H os attributes the result to Legendre.  For another proof, see Exercise~\ref{xca:Mangoldt}.}

\begin{theorem}\label{thm:Legendre}
For all positive integers $n$,
\begin{equation*}
\log n!=\sum_{p\leq n}\log p\sum_{j=1}^{\infty}\Bigl[\frac n{p^j}\Bigr],
\end{equation*}
that is, the number of times that $p$ divides $n!$ (that is, the greatest $k$ such that $p^k\divides n!$) is $\sum_{j=1}^{\infty}[n/p^j]$.
\end{theorem}

\begin{proof}
The number of times that $p$ divides $n!$ is the sum of:
\begin{compactitem}
\item
the number of multiples $\ell p$ such that $\ell p\leq n$,
\item
the number of multiples $\ell p^2$ such that $\ell p^2\leq n$,
\item
and so on.
\end{compactitem}
That is, it is the sum over all $j$ of those $\ell p^j$ such that $\ell p^j\leq n$; but the number of such multiples $\ell p^j$ is $[n/p^j]$.  In other words,
$p$ divides $n!$ once for each entry in each of the lists
\begin{align*}
&p,2p,\dots,\Bigl[\frac np\Bigr]p;&
&p^2,2p^2,\dots,\Bigl[\frac n{p^2}\Bigr]p^2;&
&\dots\qedhere
\end{align*}
\end{proof}

\begin{theorem}[Bertrand's Postulate]\label{thm:B}%
\index{Bertrand's Postulate}
For every positive integer $n$ there is a prime $p$ such that
\begin{equation*}
n<p\leq 2n.
\end{equation*}
\end{theorem}

\begin{proof}
Note that the claim is equivalent to the claim that the sequence $2$,
$3$, $5$, $7$, $13$, $23$, $43$, $83$, $163$, $317$, $631$ of primes,
where each successive term is less than twice the previous term, can
be continued indefinitely.  Suppose the claim fails for some $n$.
Then we must have $n\geq631$: in particular, $n\geq2^9$.  There are exponents $k(p)$ such that
\begin{equation*}
\binom{2n}n=\prod_{p\leq n}p^{k(p)}.
\end{equation*}
By the last theorem, since $\log\binom{2n}n=\log\bigl((2n)!\bigr)-2\log(n!)$, we have
\begin{equation}\label{eqn:k(p)}
k(p)=\sum_{j=1}^{\infty}\Bigl(\Bigl[\frac{2n}{p^j}\Bigr]-2\Bigl[\frac n{p^j}\Bigr]\Bigr).
\end{equation}
Suppose $2n/3<p\leq n$.  Then $2p\leq 2n<3p$, so that $[2n/p]=2$.  Also
\begin{equation*}
p^2>\frac{4n^2}9=\frac{2n}9\cdot2n>2n
\end{equation*}
and hence $[2n/p^2]=0$.  Therefore $k(p)=0$.  We have now
\begin{equation*}
\binom{2n}n=\prod_{p\leq2n/3}p^{k(p)}.
\end{equation*}
Also, by the earlier lemma,
\begin{equation*}
\sum_{p\divides\binom{2n}n}\log p\leq\sum_{p\leq2n/3}\log p=\mtheta(2n/3)\leq\frac{4n}3\log 2.
\end{equation*}
In the series expansion \eqref{eqn:k(p)} for $k(p)$, each term $[2n/p^j]-2[n/p^j]$ is $0$ if $[2n/p^j]$ is even, and $1$ if $[2n/p^j]$ is odd.  Also the term is $0$ if $p^j>2n$, that is, $j>\log(2n)/\log p$.  This then is a bound for $k(p)$, that is,
\begin{equation}\label{eqn:k(p)<}
k(p)\leq\frac{\log(2n)}{\log p}.
\end{equation}
Therefore, if $k(p)\geq2$, then
\begin{equation*}
2\log p\leq k(p)\log p\leq\log(2n),
\end{equation*}
so in particular $p\leq\sqrt{(2n)}$.  That is, $\sqrt{(2n)}$ is a bound on the number of $p$ such that $k(p)\geq2$.  By the bound \eqref{eqn:k(p)<} on $k(p)$ itself, we have now
\begin{equation*}
\sum_{k(p)\geq2}k(p)\log p
\leq\sum_{k(p)\geq2}\log(2n)
\leq\sqrt{(2n)}\log(2n).
\end{equation*}
Therefore
\begin{align*}
\log\binom{2n}n
&=\sum_{k(p)=1}\log p+\sum_{k(p)\geq2}k(p)\log p\\
&\leq\sum_{p\divides\binom{2n}n}\log p+\sqrt{(2n)}\log(2n)\\
&\leq\frac{4n}3\log 2+\sqrt{(2n)}\log(2n).
\end{align*}
Also,
\begin{equation*}
2^{2n}=\sum_{j=0}^{2n}\binom{2n}j=2+\sum_{j=1}^{2n-1}\binom{2n}j\leq2n\binom{2n}n.
\end{equation*}
Taking logarithms yields
\begin{align*}
2n\log 2
&\leq\log(2n)+\log\binom{2n}n\\
&\leq\log(2n)+\frac{4n}3\log 2+\sqrt{(2n)}\log(2n),
\end{align*}
which gives
\begin{equation}\label{eqn:2n3}
\frac{2n}3\log2\leq\bigl(1+\sqrt{(2n)}\bigr)\log(2n).
\end{equation}
Now, $\log x$ grows more slowly than any power of $x$; so the last inequality should fail if $n$ is large enough.  We complete the proof by showing that the inequality fails when, as we have assumed, $n\geq2^9$.  To this end, we define
\begin{equation*}
\zeta=\frac{\log n-\log2^9}{\log 2^{10}}=\frac{\log n-9\log 2}{10\log2},
\end{equation*}
so that $1+\zeta=\log(2n)/10\log 2$ and $2n=2^{10(1+\zeta)}$.  From the inequality \eqref{eqn:2n3}, we have now
\begin{gather*}
2n\log 2\leq3\bigl(1+\sqrt{(2n)}\bigr)\log(2n),\\
2^{10(1+\zeta)}\log2\leq3(1+2^{5(1+\zeta)})\cdot10(1+\zeta)\log2,\\
2^{10(1+\zeta)}\leq30(1+2^{5(1+\zeta)})(1+\zeta),\\
2^{5(1+\zeta)}\leq30(2^{-5(1+\zeta)}+1)(1+\zeta).
\end{gather*}
Since $\zeta>0$, we have
\begin{align*}
2^{5\zeta}
&\leq\frac{2^5-2}{2^5}(2^{-5(1+\zeta)}+1)(1+\zeta)\\
&\leq(1-2^{-4})(1+2^{-5})(1+\zeta)\\
&\leq1+\zeta.
\end{align*}
But this cannot be, since
\begin{equation*}
2^{5\zeta}=\me^{5\zeta\log2}\geq1+5\zeta\log2>1+\zeta
\end{equation*}
because of the series expansion $\me^x=\sum_{j=0}^{\infty}x^j/j!$.
\end{proof}

Some further theorems about the distribution of primes are stated without their proofs in Appendix~\ref{ch:unproved}.

\chapter{Computations with congruences}

\section{Exponentiation}\label{sect:exp}

Computing powers with respect to a modulus can be achieved by successively squaring and taking residues.  This is justified by Theorem~\ref{thm:+.mod-n} on page~\pageref{thm:+.mod-n}.  For example, with respect to the modulus $43$, to
compute $35^{14}$, we can first note
$35\equiv-8$, so
\begin{equation*}
  35^{14}\equiv(-8)^{14}\equiv(-1)^{14}\cdot 8^{14}\equiv 8^{14}.
\end{equation*}
Also, $14=8+4+2=2^3+2^2+2^1$, so $8^{14}=8^8\cdot8^4\cdot8^2$; and
\begin{align*}
  8^2&=64\equiv21,&
21^2&=441\equiv11,&
11^2&=121\equiv-8,
\end{align*}
so that
\begin{equation*}
  35^{14}\equiv-8\cdot11\cdot21
\equiv-88\cdot21
\equiv-2\cdot21
\equiv-44\equiv1.
\end{equation*}

\section{Inversion}\label{sect:inversion}

A special case of Theorem~\ref{thm:+.mod-n} is the implication
\begin{equation}\label{eqn:abn}
a\equiv b\pmod n\implies ac\equiv bc\pmod n.  
\end{equation}
The converse fails, because, for example, possibly $c\equiv 0\pod n$.
Even if this case is excluded, the converse still fails: 
\begin{align}\label{eqn:1410}
1\cdot4&\equiv10\cdot 4\pmod 6,&
1&\not\equiv10\pmod 6.
\end{align}
The reason why we cannot cancel $4$ here is that $4$ and $6$ have a
nontrivial common divisor, in this case $2$.   
%We have $1\cdot4\equiv10\cdot 4\pmod 2$ (since both sides are
%congruent to $0$), but $1\not\equiv10\pmod2$. 
The converse of~\eqref{eqn:abn} does hold if $c$ and $n$ are co-prime:

\begin{theorem}\label{thm:-->inv}
If $\gcd(c,n)=1$, then
\begin{equation*}
ac\equiv bc\bmod n\implies a\equiv b\bmod n.
\end{equation*}
\end{theorem}

\begin{proof}
The claim is a restatement of Theorem~\ref{thm:a|bc} on page~\pageref{thm:a|bc}.
\end{proof}

Hence, considering~\eqref{eqn:1410} again, since $1\cdot4\equiv10\cdot4\pod 3$,
we have
\begin{equation*}
1\equiv10\pmod 3.
\end{equation*}

The general result is the following:

\begin{theorem}
For all positive moduli $n$, for all integers $a$, $b$, and $c$,
\begin{equation*}
  ac\equiv bc\bmod n\iff a\equiv b\bmod \frac n{\gcd(c,n)}.
\end{equation*}
\end{theorem}

\begin{proof}
Let $d=\gcd(c,n)$.  Then $\gcd(c/d,n/d)=1$ by Theorem~\ref{thm:gcd-div}.  Hence
\begin{align*}
  ac\equiv bc\bmod n
  &\implies\frac{ac}d\equiv\frac{bc}d\bmod{\frac nd}\\
&\implies a\equiv b\bmod{\frac nd}
\end{align*}
by the last theorem.
Conversely,
\begin{align*}
  a\equiv b\bmod{\frac nd}&\implies\frac nd\divides b-a\\
&\implies\frac{cn}d\divides bc-ac\\
&\implies n\divides bc-ac\\
&\implies ac\equiv bc\bmod n.\qedhere
\end{align*}
\end{proof}

For example, $6x\equiv 6\pod 9\iff x\equiv 1\pod 3$.

A longer problem is to solve
\begin{equation*}
  70x\equiv18\pmod{134}.
\end{equation*}
This reduces to
\begin{equation}\label{eqn:70}
  35x\equiv9\pmod{67},
\end{equation}
and solutions of this correspond to solutions to the Diophantine equation
\begin{equation}\label{eqn:35,67}
35x+67y=9.
\end{equation}
By B\'ezout's Lemma (the corollary to Theorem~\ref{thm:gcd} on page~\pageref{thm:gcd}), this is soluble if and only if
$\gcd(35,67)\divides9$.  We find $\gcd(35,67)$ by the Euclidean algorithm:
\begin{align*}
  67&=35\cdot1+32,\\
35&=32\cdot1+3,\\
32&=3\cdot10+2,\\
3&=2\cdot1+1,
\end{align*}
so $\gcd(35,67)=1$.  To find the solutions to~\eqref{eqn:35,67}, or rather to $35x+67y=1$, we rearrange the computations, getting
\begin{align*}
  32&=67-35,\\
3&=35-32=35-(67-35)=35\cdot2-67,\\
2&=32-3\cdot10=67-35-(35\cdot2-67)\cdot10=67\cdot11-35\cdot21,\\
1&=3-2=35\cdot2-67-67\cdot11+35\cdot21=35\cdot23-67\cdot12.
\end{align*}
In particular, 
\begin{equation}\label{eqn:35.23}
35\cdot23\equiv1\pmod{67}, 
\end{equation}
so $\gcd(23,67)=1$, and~\eqref{eqn:70} is
equivalent to
\begin{gather*}
  x\equiv23\cdot9\equiv207\equiv6\pmod{67},\\
  x\equiv6,73\pmod{134}.
\end{gather*}

A way to read~\eqref{eqn:35.23} is that $23$ is an \textbf{inverse}%
\index{inverse} of $35$ with respect to the modulus $67$.  We can express this by
\begin{equation*}
23\equiv\frac1{35}\pmod{67}.
\end{equation*}
In particular, $35$ is invertible as an element of $\Zmod[67]$.  We have in general

\begin{theorem}\label{thm:inv}
With respect to a modulus, a number is invertible if and only if it is prime to the modulus.
\end{theorem}

\begin{proof}
The following are equivalent by B\'ezout's Lemma (the corollary to Theorem~\ref{thm:gcd}):
\begin{compactenum}
\item
$a$ is invertible \emph{modulo} $n$,
\item
the congruence $ax\equiv1\pmod n$ is soluble,
\item
the diophantine equation $ax+ny=1$ is soluble,
\item
$\gcd(a,n)=1$.\qedhere
\end{compactenum}
\end{proof}

\section{Chinese remainder problems}

The first known example of a so-called \textbf{Chinese remainder problem}%
\index{Chinese remainder problem}
is 3.26 in the \emph{Sunzi suan jing}\label{Sunzi} (\emph{Mathematical Classic of Master Sun}), which is `most probably a work of the fourth or early fifth century \textsc{ce}'~\cite[p.~295]{Katz}.  The problem and its supplied `solution' read thus:
\begin{quote}
Now there are an unknown number of things.  If we count by threes,
there is a remainder $2$; if we count by fives, there is a remainder
$3$; if we count by sevens, there is a remainder $2$.  Find the number
of things.  Answer: $23$. 

Method: If we count by threes and there is a remainder $2$, put down
$140$.  If we count by fives and there is a remainder $3$, put down
$63$.  If we count by sevens and there is a remainder $2$, put down
$30$.  Add them to obtain $233$ and subtract $210$ to get the answer.
If we count by threes and there is a remainder $1$, put down $70$.  If
we count by fives and there is a remainder $1$, put down $21$.  If we
count by sevens and there is a remainder $1$, put down $15$.  When [a
  number] exceeds $106$, the result is obtained by subtracting
$105$.\hfill\cite[p.~299]{Katz} 
\end{quote}
In our terms, the problem is to solve three congruences simultaneously:
\begin{align*}
x&\equiv2\pmod3,&
x&\equiv3\pmod5,&
x&\equiv2\pmod7.
\end{align*}
Note that $3\cdot5\cdot7=105$.
The given solution is
\begin{equation*}
x\equiv2\cdot70+3\cdot21+2\cdot15\pmod{105}.
\end{equation*}
This \emph{is} a solution, because
\begin{align*}
70&\equiv1\pmod3,&21&\equiv0\pmod3,&15&\equiv0\pmod3,\\
70&\equiv0\pmod5,&21&\equiv1\pmod5,&15&\equiv0\pmod5,\\
70&\equiv0\pmod7,&21&\equiv0\pmod7,&15&\equiv1\pmod7.
\end{align*}
This is the \emph{only} solution, by the corollary to Theorem~\ref{thm:lcm} on page~\pageref{thm:lcm}.
The key to the solution is finding the numbers $70$, $21$, and $15$.  Note that
\begin{align*}
70&=(5\cdot7)\cdot2,&21&=(3\cdot7)\cdot1,&15=(3\cdot5)\cdot1.
\end{align*}
So the real problem is to find the coefficients $2$, $1$, and $1$, which are, respectively, inverses of $5\cdot7$, $3\cdot7$, and $3\cdot5$, with respect to $3$, $5$, and $7$.  When they exist, such inverses can be found by means of the Euclidean algorithm, as in the previous section.

The general problem is now solved as follows:

\begin{theorem}\label{thm:crp}
If moduli $n_1$, \dots, $n_k$ are given, each being prime to the rest, then every system of congruences
\begin{align}\label{eqn:crt}
  x&\equiv a_1\bmod{n_1},&
  x&\equiv a_2\bmod{n_2},&
  &\dots,&
  x&\equiv a_k\bmod{n_k},
\end{align}
has a solution, which is unique \emph{modulo} the product $N$ of the moduli.  This solution is given by
\begin{equation*}
x\equiv a_1\cdot\frac N{n_1}\cdot m_1+\dotsb+a_k\cdot\frac N{n_k}\cdot m_k\pmod N,
\end{equation*}
where $m_i$ is an inverse of $N/n_i$ with respect to $n_i$.
\end{theorem}

This theorem will be discussed more theoretically in
\S\ref{sect:CRT-again}.  Meanwhile, we have given the theorem in a
`self-proving' formulation: the proposed solution is easily seen to be
a solution, and as noted above, there can be no others.\footnote{The
  notion of a \emph{self-proving theorem} is introduced and discussed
  by Barry Mazur \cite{Mazur-Th-pub}.} 

It may be useful to consider the case of two congruences,
\begin{align}\label{eqn:crt-2}
  x&\equiv a\pmod n,&
  x&\equiv b\pmod m,
\end{align}
where $\gcd(n,m)=1$.
For some $r$ and $s$, we have
\begin{align}\label{eqn:crt-3}
nr&\equiv1\pmod m,&ms&\equiv1\pmod n,
\end{align}
so that the solution to~\eqref{eqn:crt-2} is
\begin{equation*}
  x\equiv ams+bnr\pmod{nm}.
\end{equation*}
In finding this solution, we \emph{could} choose $r$ and $s$ by means of the Euclidean algorithm, so that
\begin{equation*}
nr+ms=1;
\end{equation*}
but all we really need is~\eqref{eqn:crt-3}.
Moreover, we need not actually calculate both $r$ and $s$.  Indeed, the solutions of~\eqref{eqn:crt-2} are just those sums $a+nt$ in which $t$ is such that
$m\divides a-b+nt$,
that is,
\begin{equation}\label{eqn:a-b}
b-a\equiv nt\pmod m;
\end{equation}
so $t\equiv r(b-a)\pmod m$.  We need not even calculate $r$; we can just hunt through a complete set of residues with respect to $m$ for a value of $t$ as in~\eqref{eqn:a-b}.

For example, the following problem is attributed to Brahmagupta:\footnote{My source for the problem is \url{http://www.chinapage.com/math/crt.html} (accessed December 14, 2010), where the problem is prefaced with the remark, `Oystein Ore mentions another puzzle with a dramatic element from Brahma-Sphuta-Siddhanta 
(Brahma's Correct System) by Brahmagupta (born 598 AD)'.  The page also gives the problem of Sunzi [Master Sun] quoted on page~\pageref{Sunzi} above.  The Brahmagupta problem is the basis of an exercise in Burton~\cite[Prob.~4.4.8--9, p.~83]{Burton}.  But the problem is not among the works of Brahmagupta given in the Katz volume~\cite{Katz}.}
\begin{quote}
An old woman goes to market and a horse steps on her basket and crushes the eggs.
 The rider offers to pay for the damages and asks her how many eggs she had brought.
 She does not remember the exact number, but when she had taken them out two at a time, 
there was one egg left. The same happened when she picked them out three, four, five,
 and six at a time, but when she took them seven at a time they came out even. 
What is the smallest number of eggs she could have had?  
\end{quote}
If $x$ is that number, then
\begin{align*}
  x&\equiv1\pmod{2,3,4,5,6},&
x&\equiv0\pmod7.
\end{align*}
Since $\lcm(2,3,4,5,6)=60$, the problem is to find the least positive solution to
\begin{align*}
  x&\equiv1\pmod{60},&
x&\equiv0\pmod7.
\end{align*}
so $x=1+60t$, where $t$ is least such that $7\divides 1+60t$, that is,
\begin{equation*}
-1\equiv60t\equiv4t\pmod7.
\end{equation*}
By trial, $t=5$, and therefore $x=301$.



\chapter{Powers of two}

\section{Perfect numbers}

Of the 13 books of Euclid's \emph{Elements,} Books VII, VIII and IX concern
numbers.  The last proposition in these books is about \textbf{perfect}%
\index{perfect number}%
\index{number!perfect ---} 
numbers, namely those numbers that are the sums of their (positive) proper divisors.  For example, $6$ and $28$ are perfect since
\begin{align*}
  6&=1+2+3,&
28&=1+2+4+7+14.
\end{align*}
Euclid gives a sufficient condition for being perfect.  The proof uses that
\begin{equation*}
1+2+4+\dots+2^{k-1}=2^k-1.  
\end{equation*}

\begin{theorem}[Euclid, IX.36]
\index{theorem!Euclid's Th---}%
\index{Euclid!---'s Theorem}
  If $2^k-1$ is prime, then $2^{k-1}\cdot(2^k-1)$
is perfect.
\end{theorem}

\begin{proof}
If
  $2^k-1$ is prime, then the positive divisors of $2^{k-1}\cdot(2^k-1)$
  are the divisors of $2^{k-1}$, perhaps multiplied by $2^k-1$; namely, they are:
  \begin{align*}
    &1,& &2,& &4,& &\dots,& &2^{k-1},\\
    &2^k-1,& &2\cdot(2^k-1),& &4\cdot(2^k-1),& &\dots,& &2^{k-1}\cdot(2^k-1).
  \end{align*}
The sum of these is $(1+2+4+\dotsb+2^{k-1})\cdot2^k$, which is
$(2^k-1)\cdot 2^k$.  Subtracting the improper divisor $2^{k-1}\cdot(2^k-1)$ leaves the same.
\end{proof}

Theorem~\ref{thm:a|bc} has a partial converse:\footnote{According to
  Dickson~\cite[p.~19]{Dickson}, Euler's proof of this was published
  posthumously in 1849.} 

\begin{theorem}\label{thm:even-perf}
Every \emph{even} perfect number is $2^{k-1}\cdot(2^k-1)$ for some $k$
such that $2^k-1$ is prime. 
\end{theorem}

\begin{proof}
Let us write $\msig(n)$ for the sum of the positive divisors of $n$.
Suppose $n$ is an even perfect number.  Then $n=2^{k-1}m$ for some $k$
and $m$, where $k>1$ and $m$ is odd.  Every factor of $n$ is uniquely
the product of a factor of $2^{k-1}$ and a factor of $m$, so 
\begin{equation*}
\msig(n)
=\msig(2^{k-1})\cdot\msig(m)=(1+2+\cdots+2^{k-1})\cdot\msig(m) 
=(2^k-1)\cdot\msig(m).  
\end{equation*}
Since we assume $\msig(n)=2n$, we have now
\begin{equation*}
2^km=(2^k-1)\cdot\msig(m).
\end{equation*}
In particular, $2^k\divides\msig(m)$, so $\msig(m)=2^k\cdot\ell$ for
some $\ell$.  Then 
\begin{align*}
m&=(2^k-1)\cdot\ell=\msig(m)-\ell,&
\msig(m)&=m+\ell.
\end{align*}
Since $m$ and $\ell$ are two distinct factors of $m$, they must be the
\emph{only} positive factors.  In particular, $\ell=1$, and $m$ is prime, so $n$ is as
desired.\footnote{Exercise~\ref{xca:even-perf-why} asks how we have
  used that $n$ is even.} 
\end{proof}

In his excellent textbook \emph{Elementary Number
  Theory}~\cite{MR0092794} (first published in German in 1927), Edmund
Landau (1877--1938) writes, before proving the foregoing theorems: 
\begin{quote}
This old-fashioned concept of perfect number, and the questions
associated with it, are  not especially important; we consider them
only because, in so doing, we will encounter two questions that remain
unanswered to this day:  Are there infinitely many perfect numbers?
Is there an odd perfect number?  Modern mathematics has solved many
(apparently) difficult problems, even in number theory; but we stand
powerless in the face of such (apparently) simple problems as these.
Of course, the fact that they have never been solved is irrelevant to
the rest of this work.  We will leave no gaps; when we come to a
bypath which leads to an insurmountable barrier, we will turn around,
rather than---as is so often done---continue on beyond the barrier. 
\end{quote}
The questions that Landau cites are still unanswered.  It is also the
aim of the present book to leave no gaps (except for the unproved
theorems in Appendix~\ref{ch:unproved}, which however we shall never
use). 

\section{Mersenne primes}

%\begin{sloppypar}
The number $2^n-1$ is called
a 
\textbf{Mersenne number,}%
\index{Mersenne}%
\index{Mersenne!--- number}%
\index{number!Mersenne ---}
after Marin Mersenne,
1588--1648;
if the number is prime, it is a 
\textbf{Mersenne prime.}%
\index{Mersenne!--- prime}%
\index{prime!Mersenne ---}
Since we do not know whether there are infinitely many even perfect
numbers, we do not know whether there are infinitely many Mersenne
primes.  However, we do have the following necessary condition for
being a Mersenne prime:\footnote{Stated by Fermat in a letter of 1640
  to Mersenne, according to Dickson~\cite[p.~12]{Dickson}.} 
%\end{sloppypar}

  \begin{theorem}\label{thm:Mp}
   if $2^n-1$ is prime, then so must $n$ be.
\end{theorem}

\begin{proof}   
We have $2^k-1\divides 2^{k\ell}-1$ from the identity
  \begin{equation*}
  x^m-1=(x-1)(x^{m-1}+x^{m-2}+\dotsb+x+1).\qedhere
  \end{equation*}
\end{proof}
  
So every Mersenne prime is $2^p-1$ for some $p$; but the converse
fails,\footnote{The counterexample
  $2^{11}=2047=23\cdot89$ was apparently known to Ulrich Regius in
  1536~\cite[pp.~III \&\ 7]{Dickson}.  However, see
  Theorem~\ref{thm:psp} on page~\pageref{thm:psp}.} as shown in
Table~\ref{tab:Mersenne}.\footnote{I have not personally verified that
  $2^p-1$ is prime when $p$ is $13$, $17$, or $19$; nor have I
  verified that $178481$ is prime.} 
  \begin{table}[ht]
  \begin{equation*}
\begin{array}{rrrr}
p&2^p-1&\text{factorization}&2^{p-1}(2^p-1)\\\hline
2&3&-&6\\
3&7&-&28\\
5&31&-&496\\
7&127&-&8128\\
11&2047&23\cdot89&\\
13&8191&-&33550336\\
17&131071&-&8589869056\\
19&524287&-&137438691328\\
23&8388607&47\cdot178481&
\end{array}
\end{equation*}
\caption{Mersenne primes and perfect numbers}\label{tab:Mersenne}
\end{table}
For every $p$ in the table such that $2^p-1$ is not prime, we have $2p+1$ is prime, and $2p+1\cong\pm1\pod 8$.  A odd prime $p$ such that $2p+1$ is also prime is called a \textbf{Germain prime.}\label{Germain}%
\index{Germain, --- prime}%
\index{prime! Germain ---}%
\footnote{Named for Sophie Germain, 1776--1831.} 
Later, with Theorem~\ref{thm:Germain} on page~\pageref{thm:Germain},
we shall have that if $2p+1$ is a prime $q$, and $q\cong\pm1\pod8$,
then $2^p-1$ is not prime, because $q$ is a factor, that is, 
\begin{equation*}
2^p\equiv1\pmod q.
\end{equation*}

\chapter{Prime moduli}

\section{Fermat's Theorem}\label{sect:FT}

On October 10, 1640, Pierre de Fermat (1601--65) wrote the following
in a letter to Bernard Fr\'enicle de Bessy (1605--1675):\footnote{The
  letter was in French; I take this selection, in translation, from
  Struik's anthology~\cite[p.~28]{MR858706}.  The translator of Gauss
  assigns to what must be the same letter the date of October 18,
  1640~\cite[p.~32, n.~1]{Gauss}.} 
\begin{quote}
Every prime number is always a factor of one of the powers of any
[geometric] progression minus $1$, and the exponent of this power is a
divisor of the prime number minus $1$.  After one has found the first
power that satisfies the proposition, all those powers of which the
exponents are multiples of the exponent of the first power also
satisfy the proposition. 

\emph{Example:}  Let the given progression be
\begin{equation*}
\begin{array}{*7{r}}
1&2& 3& 4&  5&  6&\\
3&9&27&81&243&729&\text{etc.}
\end{array}
\end{equation*}
with its exponents written on top.

Now take, for instance, the prime number $13$.  It is a factor of the
third power minus $1$, of which $3$ is the exponent and a divisor of
$12$, which is one less than the number $13$, and because the exponent
of $729$, which is $6$, is a multiple of the first exponent, which is
$3$, it follows that $13$ is also a factor of this power $729$ minus
$1$. 

And this proposition is generally true for all progressions and for
all prime numbers, of which I would send you the proof if I were not
afraid to be too long. 
\end{quote}
More symbolically, the claim is:
\begin{compactenum}[1.]
\item
For all $p$,
for all $a$ [such that $p\ndivides a$---Fermat does not appear to make this condition explicit], there is some positive $n$ such that $p\divides a^n-1$.
\item
If $k$ is the least such $n$, then $k\divides p-1$.
\item
In this case, if $k\divides m$, then $p\divides a^m-1$.
\end{compactenum}
A consequence of the claim is that, if $p\ndivides a$, then $p\divides a^{p-1}-1$.
This is called \textsl{Fermat's Theorem.}\footnote{The theorem is sometimes
  called Fermat's \emph{Little}
  Theorem, as opposed to the so-called Fermat's \emph{Last} Theorem (see page~\pageref{note:FLT}, note~\ref{note:FLT}).}%
\index{Fermat!---'s Theorem}%
\index{theorem!Fermat's Th---}

A proof of this theorem was found among the writings of Leibniz (1646--1716)~\cite[p.~59]{Dickson}.  The first
\emph{published} proof was by Euler, in 1736.\footnote{This is stated
  by Gauss in the
  \emph{Disquisitiones Arithmeticae}~\cite[\P50]{Gauss} and confirmed
  by Dickson~\cite[p.~60]{Dickson} and Struik~\cite[p.~35, n.~2]{MR858706}.}  
  This proof uses the following:

\begin{lemma}
  If $0<k<p$, then
  \begin{equation*}
  p\divides\binom pk.
  \end{equation*}
\end{lemma}

\begin{proof}
If $0<k<p$, then $p$ divides $p!$, but not $k!$ or $(p-k)!$.
Since
\begin{equation*}
p!=\binom pk\cdot k!(p-k)!, 
\end{equation*}
the claim follows from Theorem~\ref{thm:Euclid} on page~\pageref{thm:Euclid}.
\end{proof}

\begin{theorem}[Fermat]\label{thm:Fermat}
For all $a$,
\begin{equation}\label{eqn:F2}
a^p\equiv a\pmod p.
\end{equation}
Consequently, for all positive $m$ and $n$,
\begin{equation*}
m\equiv n\bmod{(p-1)}\implies a^m\equiv a^n\bmod p.
\end{equation*}
If $p\ndivides a$, that is, $\gcd(p,a)=1$, then
\begin{equation}\label{eqn:F}
a^{p-1}\equiv1\pmod p.
\end{equation}
\end{theorem}

\begin{proof}[Proof (Euler).]
We use induction.  The claim~\eqref{eqn:F2} holds trivially when
$a=1$.  If it holds when $a=b$, then by the lemma,
\begin{equation*}
  (b+1)^p\equiv b^p+1^p\equiv b+1\pmod p,
\end{equation*}
so the claim holds when $a=b+1$.  Therefore~\eqref{eqn:F2} holds for all $a$.  We now have~\eqref{eqn:F} by
Theorem~\ref{thm:-->inv} on page~\pageref{thm:-->inv}. 
\end{proof}

Induction normally proves something true for all \emph{positive}
integers.  But~\eqref{eqn:F2} holds for \emph{all} integers $a$, and
Euler's proof establishes this, since every integer is congruent
\emph{modulo} $p$ to a positive integer, and if $a\equiv b\pod p$,
then $a^p\equiv b^p\pod p$ by Theorem~\ref{thm:+.mod-n}.
Alternatively, we can understand the proof as establishing $a^p=a$ for
all $a$ in $\Zmod[p]$.  Induction still works here; it just takes us
around in a circle, from $1$, to $2$, to $3$, and so on up to $p$, and
then back to $1$.  (See Figure~\ref{fig:13}.)  In particular,
$\Zmod[p]$ is one of the sets mentioned after the Axiom in
\S\ref{sect:N}, in which only part of the Axiom is satisfied.  Indeed,
$\Zmod[p]$ allows induction, but here $1$ is the successor of $p$. 
\begin{figure}[ht]
\centering
\psset{unit=2cm}
\begin{pspicture}(-1,-1)(1,1)
\rput(0,1){$13$}
\rput(0.465,0.885){$1$}
\rput(-0.465,0.885){$12$}
\rput(0.823,0.568){$2$}
\rput(-0.823,0.568){$11$}
\rput(0.993,0.121){$3$}
\rput(-0.993,0.121){$10$}
\rput(0.935,-0.355){$4$}
\rput(-0.935,-0.355){$9$}
\rput(0.663,-0.749){$5$}
\rput(-0.663,-0.749){$8$}
\rput(0.239,-0.971){$6$}
\rput(-0.239,-0.971){$7$}
\psarc{<-}(0,0){0.8}{90}{62.3}
\end{pspicture}
\caption{The integers \emph{modulo} $13$, or $\Zmod[13]$}\label{fig:13}
\end{figure}

Euler later proved the more general claims of Fermat in the quotation
above.\footnote{Euler's treatment can be read in
  Struik~\cite[pp.~31--5]{MR858706}.}  In particular, he showed that,
if $p\ndivides a$, then there is some $\lambda$ such that $\lambda>1$
and $p\divides a^{\lambda}-1$.  The \emph{least} such $\lambda$ is
what we shall call the  
\textsl{order}%
\index{order} 
of $a$ \emph{modulo} $p$ in \S\ref{sect:order}.  If $\lambda$ is this
order, then Euler showed $\lambda\divides p-1$, and then $p\divides
a^{p-1}-1$.  He later generalized this result, establishing what is
called Euler's Theorem (Theorem~\ref{thm:Euler} on page~\pageref{thm:Euler}).\footnote{An
  account of this is in Dickson~\cite[p.~61]{Dickson}.}   

There is yet another proof of Fermat's Theorem, published by James
Ivory in 1806 \cite{Ivory}.\footnote{According to
  Dickson~\cite[p.~65]{Dickson}, this proof was later rediscovered and
  published by Dirichlet in 1828.  Landau~\cite[p.~50]{MR0092794} uses
  the proof.  Hardy and Wright~\cite[p.~63]{MR568909} also use it, but the
  historical information that they supply about Fermat's and Euler's
  theorems does not address this proof.}  
  Perhaps it is the
best.
If $\gcd(a,p)=1$, then  
the products $a$, $2a$, \dots,
$(p-1)a$ are all incongruent \emph{modulo} $p$, since
\begin{equation*}
  ia\equiv ja\bmod p\implies i\equiv j\bmod p
\end{equation*}
by Theorem~\ref{thm:-->inv}.
But $1$, $2$, \dots, $p-1$ are also incongruent.  By Theorem~\ref{thm:res}, there are only $p-1$
numbers that are incongruent with each other and $0$ \emph{modulo} $p$; so the
numbers  $a$, $2a$, \dots,
$(p-1)a$ are congruent respectively to
 $1$, $2$, \dots, $p-1$ in some order.  Now multiply the numbers on each side together: 
\begin{equation*}
(p-1)!\cdot a^{p-1}\equiv(p-1)!\pmod p.
\end{equation*}
Since $(p-1)!$ and $p$ are co-prime, we can conclude~\eqref{eqn:F}.
This implies~\eqref{eqn:F2} in case $p\ndivides a$; but if $p\divides
a$, then~\eqref{eqn:F2} is obvious. 

With Fermat's Theorem, we can compute residues of large powers easily.  For example,
\begin{equation*}
  6^{58}\equiv 6^{48+10}\equiv(6^{16})^3\cdot 6^{10}\equiv
  6^{10}\pmod{17}. 
\end{equation*}
We can continue the computation as in \S\ref{sect:exp}, by analyzing the exponent $10$ as a sum of powers of $2$.
Since $10=8+2$, we have $6^{10}=6^8\cdot 6^2$; but
$6^2\equiv36\equiv2\pod{17}$, so
$6^8\equiv(6^2)^4\equiv2^4\equiv16\equiv-1\pod{17}$, and hence
\begin{equation*}
  6^{58}\equiv -2\pmod{17}.
\end{equation*}

A contrapositive formulation of Fermat's Theorem is that, if
$a^n\not\equiv a\pmod n$, then $n$ must not be prime.  For example, to
see whether $133$ is prime, we may note that  
  $133=128+4+1=2^7+2^2+1$, so $2^{133}=2^{2^7}\cdot 2^{2^2}\cdot 2$.
  Also,
  \begin{align}\notag
2^2&=4;\\\notag
    2^{2^2}&=4^2=16;\\\notag
2^{2^3}&=16^2=256\equiv123\equiv-10\pmod{133};\\\notag
2^{2^4}&\equiv(-10)^2=100\equiv-33;\\\notag
2^{2^5}&\equiv(-33)^2=1089\equiv25;\\\notag
2^{2^6}&\equiv25^2=625\equiv-40;\\\label{eqn:1600}
2^{2^7}&\equiv(-40)^2=1600\equiv4.
  \end{align}  
Therefore
$2^{133}\equiv4\cdot16\cdot2\equiv-5\pmod{133}$,
so $133$ must not be prime.
Note an alternative computation after~\eqref{eqn:1600}:  We have
$2^{128}=2^{2^7}\equiv4\equiv 2^2$, so $2^{126}\equiv1$, hence
$2^{133}=2^{126+7}\equiv2^7=128\equiv-5$.   

Now, if we just want to know whether $133$ is prime, it is probably
easier to use the theorems in \S\ref{sect:sieve}.  Indeed,
$[\sqrt{133}]=11$, so it is enough to test for divisibility by $2$,
$3$, $5$, $7$, and $11$.  We find then $133=7\cdot19$. 

Still, we may raise the theoretical question:  Does Fermat's Theorem
give us an \emph{infallible} method for testing for primes?  Can \emph{every}
composite number be detected by means of the theorem?  
The answer turns out to be no.

\section{Carmichael numbers}\label{sect:Car}

The converse of Fermat's Theorem fails.  It may be that $a^n\equiv
a\pmod n$ for all $a$, although $n$ is not prime.  To see this, we
first define $n$ to be a 
\textbf{pseudo-prime}%
\index{pseudo-prime}%
\index{prime!pseudo-{}---}
if $n$ is composite,
but 
\begin{equation*}
  2^n\equiv 2\pmod n.
\end{equation*}
To establish an example, we shall use:

\begin{theorem}
  If $p\neq q$, and $a^p\equiv a\pod q$ and $a^q\equiv a\pod p$, then $a^{pq}\equiv
  a\pod{pq}$. 
\end{theorem}

\begin{proof}
  Under the hypothesis, we have
  \begin{gather*}
    a^{pq}=(a^p)^q\equiv a^q\equiv a\pmod q,\\
    a^{pq}=(a^q)^p\equiv a^p\equiv a\pmod p,
  \end{gather*}
and hence $a^{pq}\equiv a\pmod{\lcm(p,q)}$ by Theorem~\ref{thm:lcm} and corollary.
\end{proof}

Then $341$ is a pseudo-prime, since $341=11\cdot31$, and
\begin{align*}
2^{11}&=2048=31\cdot 66+2\equiv 2\pmod{31},\\
  2^{31}&=(2^{10})^3\cdot 2\equiv2\pmod{11}.
\end{align*}

We can now state and prove what resembles a converse to Theorem~\ref{thm:Mp}:

\begin{theorem}\label{thm:psp}
  If $n$ is a pseudo-prime, then so is $2^n-1$.
\end{theorem}

\begin{proof}
If $n$ is a pseudo-prime, then it is not prime, so by
Theorem~\ref{thm:Mp}, neither is $2^n-1$.  We also have
$2^n\equiv2\pmod n$ by Fermat's Theorem; say 
  $2^n-2=kn$.  Then
  \begin{equation*}
    2^{2^n-1}-2=2\cdot(2^{2^n-2}-1)=2\cdot(2^{kn}-1),
  \end{equation*}
which has the factor $2^n-1$; so $2^{2^n-1}\equiv2\pmod{2^n-1}$. 
\end{proof}

%\begin{sloppypar}
Pseudo-primes as we defined them can be called more precisely
\emph{pseudo-primes of base} $2$.  Then a pseudo-prime of base $a$ is
a composite number $n$ such that $a^n\equiv a\pmod n$.
A composite number that is a pseudo-prime of \emph{every} base can be
 called an 
\textbf{absolute pseudo-prime.}%
\index{prime!absolute pseudo-{}---}% 
\index{absolute pseudo-prime}%
\index{pseudo-prime!absolute ---}
It is also called a
\textbf{Carmichael number}\label{Carmichael}%
\index{Carmichael, --- number}%
\index{number!Carmichael ---}
after Robert Daniel Carmichael (1879--1967), who published the first
examples of such numbers in 1910~\cite{MR1558896}.
If $n$ is a Carmichael number, then
\begin{equation*}
a^{n-1}\equiv1\pmod n
\end{equation*}
whenever $\gcd(a,n)=1$.
We shall establish the converse of this in Theorem~\ref{thm:Car-char} on page~\pageref{thm:Car-char}.
%\end{sloppypar}

Meanwhile, $561$ is a Carmichael number.  To see this, we first factorize
$561$ as $3\cdot11\cdot17$
and note
\begin{align*}
  3-1&\divides 561-1,&
11-1&\divides 561-1,&
17-1&\divides 561-1,
\end{align*}
that is,
$2\divides 560$, $10\divides 560$, and $16\divides 560$.
We now make the following observations.
\begin{enumerate}
\item
If $3\ndivides a$, then $a^2\equiv1\pmod 3$, so $a^{560}\equiv1\pmod 3$.
\item
If $11\ndivides a$, then $a^{10}\equiv1\pmod 3$, so $a^{560}\equiv1\pmod{11}$.
\item
If $17\ndivides a$, then $a^{16}\equiv1\pmod 3$, so $a^{560}\equiv1\pmod{17}$.
\end{enumerate}
Hence if one of $3$, $11$, and $17$ fails to divide $a$, then we have $a^{560}\equiv1\pod{561}$ and therefore
\begin{equation}\label{eqn:561}
  a^{561}\equiv a\pmod{561}.
\end{equation}
But if each of $3$, $11$, and $17$ divides $a$, then $561\divides a$, so again we have~\eqref{eqn:561}.  

A positive integer is
\textbf{squarefree}%
\index{squarefree number}%
\index{number!squarefree ---}
if it has no divisor $p^2$.
The proof that $561$ is an absolute pseudo-prime generalizes to
establish the following:\footnote{The proof is Exercise~\ref{xca:Carmichael}.} 

\begin{theorem}\label{thm:Carmichael}
A number $n$ greater than $1$ is a prime or absolute pseudo-prime if
it is squarefree and $p-1\divides n-1$ whenever $p\divides n$. 
\end{theorem}

The sufficient condition given by the theorem for being an absolute
pseudo-prime is 
\textbf{Korselt's Criterion,}\label{Korselt}% 
\index{Korselt's Criterion}
so called after Alwin Reinhold Korselt (1864--1947), who proved its
sufficiency and necessity in 1899, apparently without actually finding
any absolute pseudo-primes.  The term \emph{Korselt's Criterion} is
  used by Alford \emph{et al.}\ in their 1994 paper~\cite{MR1283874},
  where they prove that there are infinitely many absolute
  pseudo-primes.  

We can prove the necessity of \emph{part} of Korselt's Criterion now; the
rest will have to wait until Theorem~\ref{thm:Car-p-1} (p.~\pageref{thm:Car-p-1}), when we have \textsl{primitive roots}%  
\index{primitive root}
of primes.

\begin{theorem}\label{thm:Car-sqf}
Every absolute pseudo-prime is squarefree.  
\end{theorem}

\begin{proof}
Suppose $n$ is an absolute pseudo-prime.
If $p^2\divides n$, then
\begin{equation*}
  p^n\equiv p\pmod{p^2}.
\end{equation*}
But $n>1$ (since it is composite), so $p^n\equiv0\pmod{p^2}$, and therefore
$p\equiv0\pmod{p^2}$, which is absurd.
\end{proof}

\section{Wilson's Theorem}\label{sect:Wilson}

Evidently $(p-1)!\not\equiv 0\pmod p$.  By the next theorem, the congruence
\begin{equation}\label{eqn:W}
(p-1)!\equiv x\pmod p
\end{equation}
has the same solution for all $p$, namely $-1$.  This was known to Abu Ali al-Hasan
ibn al-Haytham (965--1040)\footnote{According to
  \url{http://www-history.mcs.st-andrews.ac.uk/Biographies/Al-Haytham.html}
  (accessed December 19, 2010).} 
and probably also to Leibniz.\index{Leibniz}  
The theorem was published by Edward
Waring (c.~1736--98) in 1770 and attributed to his student John Wilson
(1741--93), so it is called Wilson's Theorem.  However, the first
published \emph{proof} was by Joseph-Louis Lagrange (1736--1813) in
1773.\footnote{The bare facts are in Dickson~\cite[p.~62]{Dickson}.}

Lagrange's proof makes use of a result that arises from considering
successive differences of powers as in Table~\ref{table:dif} below. %(page~\pageref{table:dif}).
\begin{table}[ht]
\begin{align*}
&\xymatrix@!@=0pt@M=0pt{
1& &1\\
 &0& 
}
&&\xymatrix@!@=0pt@M=0pt{
0& &1& &2&\\
 &1& &1& \\
 & &0& &
 }
 &&
\xymatrix@!@=0pt@M=0pt{
0& &1& &4& &9\\
 &1& &3& &5& \\
 & &2& &2& & \\
 & & &0& & &
 }
&&
\xymatrix@!@=0pt@M=0pt{
0& &1& & 8&  &27&  &64\\
 &1& &7&  &19&  &37&  \\
 & &6& &12&  &18&  &  \\
 & & &6&  & 6&  &  &  \\
 & & & & 0&  &  &  &  
}
\end{align*}
  \begin{equation*}
\xymatrix@!@=0pt@M=0pt{
0& & 1&  &16&  & 81&   &256&   &625\\
 &1&  &15&  &65&   &175&   &369&   \\
 & &14&  &50&  &110&   &194&   &   \\
 & &  &36&  &60&   & 84&   &   &   \\
 & &  &  &24&  & 24&   &   &   &   \\
 & &  &  &  & 0&   &   &   &   &
 }
\end{equation*}
\begin{equation*}
\xymatrix@!@=0pt@M=0pt{
0& & 1&   & 32&   &243&   &1024&    &3125&    &7776\\
 &1&  & 31&   &211&   &781&    &2101&    &4651&    \\
 & &30&   &180&   &570&   &1320&    &2550&    &    \\
 & &  &150&   &390&   &750&    &1230&    &    &    \\
 & &  &   &240&   &360&   & 480&    &    &    &    \\
 & &  &   &   &120&   &120&    &    &    &    &    \\
 & &  &   &   &   &  0&   &    &    &    &    &
}
\end{equation*}
  \caption{Successive differences of powers}\label{table:dif}
\end{table}
(However, Lagrange's proof is not the simplest; so the reader may wish to skip ahead.)
In each triangular array in the table, the top row is the sequence $0^n$, $1^n$, $2^n$, \dots; then each successive row consists of the differences of consecutive entries in the previous row.  Let us number the rows from the top, starting with $0$.  If row $0$ consists of $n$th powers, it appears that the entries in  row $n$ are $n!$, so that the entries of all further rows are $0$.  The appearance is the reality, by induction:  First of all it is true when $n=0$.  Suppose it is true when $n\leq m$.  We consider the array whose top row consists of powers $x^{m+1}$.  We compute
\begin{equation*}
(x+1)^{m+1}-x^{m+1}=(m+1)x^m+\binom{m+1}2x^{m-1}+\binom{m+1}3x^{m-2}+\cdots.
\end{equation*}
By inductive hypothesis, the only term that will have any effect, $m$ rows later, is $(m+1)x^m$.  That is, as far as row $m+1$ is concerned, row $1$ might as well consist of the entries $(m+1)x^m$.  So each entry of row $m+1$ is $m+1$ times the corresponding entry of row $m$ of the array whose top row consists of powers of $m$.  By inductive hypothesis, every entry of this row $m$ is $m!$.  This completes the induction.

This result gives us the $(p-1)!$ in Wilson's Theorem; the $-1$ that solves~\eqref{eqn:W} comes from a more general expression for successive differences:\footnote{The lemma appears to be due to Euler~\cite[p.~63]{Dickson}.}

\begin{lemma}
For all non-negative integers $n$, for all $x$ in $\R$,
\begin{equation*}
n!=
\sum_{k=0}^n(-1)^{n-k}\binom nk(x+k)^n.
\end{equation*}
\end{lemma}

\begin{proof}
Given a function $f$ on $\R$, we define the function $\Delta f$ by
\begin{equation*}
\Delta f(x)=f(x+1)-f(x).
\end{equation*}
Then by recursion we define
\begin{align*}
\Delta^0f&=f,&
\Delta^{n+1}f&=\Delta^n\Delta f.
\end{align*}
By induction,
\begin{equation*}
\Delta^nf(x)=\sum_{k=0}^n(-1)^{n-k}\binom nkf(x+k).
\end{equation*}
Indeed, the claim holds easily when $n=0$, and if it holds when $n=m$, then by the computations in Table~\ref{table:Delta} (page~\pageref{table:Delta})\label{Delta},
\begin{table}[ht]
\hrulefill
\begin{align*}
&\phantom{{}={}}\Delta^{m+1}f(x)\\
&=\Delta^m\Delta f(x)\\
&=\sum_{k=0}^m(-1)^{m-k}\binom mk\Delta f(x+k)\\
&=\sum_{k=0}^m(-1)^{m-k}\binom mk\bigl(f(x+k+1)-f(x+k)\bigr)\\
&=\sum_{k=0}^m(-1)^{m-k}\binom mkf(x+k+1)
-\sum_{k=0}^m(-1)^{m-k}\binom mkf(x+k)\\
&\begin{aligned}
=f(x+m+1)
&+\sum_{k=0}^{m-1}(-1)^{m-k}\binom mkf(x+k+1)\\
&-\sum_{k=1}^m(-1)^{m-k}\binom mkf(x+k)-(-1)^mf(x)
\end{aligned}\\
&\begin{aligned}
=f(x+m+1)
&+\sum_{k=1}^m(-1)^{m+1-k}\binom m{k-1}f(x+k)\\
&+\sum_{k=1}^m(-1)^{m+1-k}\binom mkf(x+k)+(-1)^{m+1}f(x)
\end{aligned}\\
&=f(x+m+1)+\sum_{k=1}^m(-1)^{m+1-k}\binom{m+1}kf(x+k)+(-1)^{m+1}f(x)\\
&=\sum_{k=0}^{m+1}(-1)^{m+1-k}\binom{m+1}kf(x+k),
\end{align*}
\hrulefill
\caption[The inductive step for $\Delta^nf(x)$]{The inductive step for $\Delta^nf(x)$ (see page~\pageref{Delta})}\label{table:Delta}
\end{table}
it holds when $n=m+1$.

Now we consider the special case when $f(x)=x^m$.  We shall be done if we show
that, if $0\leq m\leq n$, then
\begin{equation*}
\Delta^n(x^m)=\begin{cases}
	0,&\text{ if }m<n,\\
	n!,&\text{ if }m=n.
\end{cases}
\end{equation*}
(Here of course $\Delta^n(x^m)$ stands for $\Delta^nf(x)$, where $f$ is $x\mapsto x^m$.)
The claim is easily true when $n=0$.  Suppose it is true when $n=s$.  If $m\leq s$, then $\Delta^s(x^m)$ is a constant function of $x$, so $\Delta^{s+1}(x^m)=0$.  Considering the case $m=s+1$, we have
\begin{align*}
\Delta^{s+1}(x^{s+1})
&=\Delta^s\bigl((x+1)^{s+1}-x^{s+1})\bigr)\\
&=\Delta^s\sum_{k=0}^s\binom{s+1}kx^k\\
&=\sum_{k=0}^s\binom{s+1}k\Delta^sx^k\\
&=(s+1)\cdot s!\\
&=(s+1)!.
\end{align*}
So the claim is true when $n=s+1$.
\end{proof}

\begin{theorem}[Wilson]\label{thm:Wilson}%
\index{Wilson, ---'s Theorem}
\index{theorem!Wilson's Th---}
Suppose $n>1$.  Then
  $(n-1)!\equiv-1\pmod n$ if and only if\footnote{The \emph{necessity} that $n$ be prime was apparently not part of the original statement of Wilson's Theorem.  Lagrange proved it~\cite[p.~63]{Dickson}.} $n$ is prime.
\end{theorem}

\begin{proof}[Proof (Lagrange).]
  Suppose $n$
  is not prime, so that $n=ab$, where $1<a<n$.  Then $a\leq n-1$, so
  $a\divides(n-1)!$, so $a\ndivides(n-1)!+1$, so $n\ndivides(n-1)!+1$.

For the converse, from the lemma in case $n=p-1$ and $x=0$ we have
\begin{equation*}
(p-1)!=\sum_{k=0}^{p-1}(-1)^{p-1-k}\binom{p-1}kk^{p-1}.
\end{equation*}
By Fermat's Theorem then,
\begin{align*}
(p-1)!
&\equiv\sum_{k=1}^{p-1}(-1)^{p-1-k}\binom{p-1}k\\
&\equiv\sum_{k=0}^{p-1}(-1)^{p-1-k}\binom{p-1}k-1\\
&\equiv(1-1)^{p-1}-1\\
&\equiv-1\pmod p.\qedhere
\end{align*}
\end{proof}

Wilson's Theorem gives a theoretical test for primality, though not a practical one.

For an alternative proof of the hard direction of Wilson's Theorem, we may note that, by Theorem~\ref{thm:inv}, each number on the list
$1,2,3,\dots,p-1$ has an inverse \emph{modulo} $p$.  Also,
$x^2\equiv1\pmod p$ has only the solutions $\pm1$, that is, $1$ and
$p-1$, since if $p\divides x^2-1$, then $p\divides x\pm1$.  So each number on the
list $2,3,\dots,p-2$ has an inverse that is also on the list and is distinct from itself.  Also the inverse of the inverse is the original number.  Therefore the product of the numbers on the list is $1$ \emph{modulo} $p$.
Consequently
\begin{equation*}
(p-1)!\equiv p-1\equiv-1\pmod p.
\end{equation*}
For example, \emph{modulo} $11$, we have
\begin{equation*}
1\equiv2\cdot6\equiv3\cdot4\equiv5\cdot9\equiv7\cdot8,
\end{equation*}
and therefore
\begin{equation*}
10!\equiv(2\cdot6)(3\cdot4)(5\cdot9)(7\cdot8)\cdot10\equiv10\equiv-1.
\end{equation*}
Since the modulus was small, the inverses here could be found by trial.  With a larger modulus, the Euclidean Algorithm can be used as in \S\ref{sect:inversion}.

We may also note that $2$ has the following powers with respect to the modulus~$11$:
\begin{equation*}
\begin{array}{|r||*{10}{r|}l|}\hline
k&1&2&3&4&5&6&7&8&9&10&\\\hline
2^k&2&4&8&5&10&9&7&3&6&1&{}\bmod11\\\hline
\end{array}
\end{equation*}
So every number that is prime to $11$ is congruent to a power of $2$.  
In particular, the invertible integers \emph{modulo} $11$ compose a multiplicative
group generated by $2$; we express this by saying $2$ is a 
\textsl{primitive root}%
\index{primitive root}
of $11$.  We shall investigate primitive roots in Chapter~\ref{ch:pr}.
Meanwhile, if in the last table, we write the residues that are least in absolute value, we get
\begin{equation*}
\begin{array}{|r||*{10}{r|}l|}\hline
k&1&2&3&4&5&6&7&8&9&10&\\\hline
2^k&2&4&-3&5&-1&-2&-4&3&-5&1&{}\bmod{11}\\\hline
\end{array}
\end{equation*}
In particular,
\begin{equation*}
-1\equiv2^5\pmod{11}.
\end{equation*}
Then the congruence $-1\equiv x^2\pod{11}$ is insoluble.  Indeed, any
solution would be congruent to a power $2^k$, and then
$2^5\equiv2^{2k}$, so $2^{2k-5}\equiv1$; but this is impossible, since
all residues of $2k-5$ with respect to $10$ are odd, and powers of $2$
with odd exponents $1$, $3$, $5$, $7$, or $9$ are never $1$.  We say
therefore that $-1$ is a \textsl{quadratic nonresidue}% 
\index{quadratic residue, nonresidue} 
of $11$.

By contrast, from the table
\begin{center}
\makebox[0pt][c]{
\begin{math}
\begin{array}{|r||*{12}{r|}l|}\hline
  k&1&2& 3&4&5& 6& 7& 8&9&10&11&12&\\\hline
2^k&2&4&-5&3&6&-1&-2&-4&5&-3&-6& 1&{}\pmod{13}\\\hline
\end{array}
\end{math}
}
\end{center}
we have
\begin{equation*}
-1\equiv2^6\equiv(\pm5)^2\pmod{13},
\end{equation*}
so $-1$ is a \textsl{quadratic residue} of $13$.

In general, if $p$ is an odd prime not dividing $a$, then $a$ is a 
\textbf{quadratic residue} of $p$ if the congruence $a\equiv x^2\pod p$ is soluble; otherwise, $a$ is a \textbf{quadratic nonresidue} of $p$.
We shall develop the theory of quadratic residues and nonresidues in
Chapter~\ref{ch:qr}.  Meanwhile, a preliminary result follows from
Wilson's Theorem.  For convenience in stating and proving it, we use
the notation\footnote{The symbol $\upvarpi$ is a variant of $\uppi$;
  in using it here I follow Hardy and Wright~\cite[p.~87]{MR568909}.} 
  \begin{equation}\label{eqn:varpi}
\upvarpi=\upvarpi(p)=\frac{p-1}2,
\end{equation}
where $p$ is an odd prime.

\begin{theorem}\label{thm:Wilson-app}
  Suppose $p$ is an odd prime.
Then 
\begin{equation}\label{eqn:varpi2}
(\upvarpi!)^2\equiv(-1)^{\upvarpi-1}\pmod p,
\end{equation}
and the following are equivalent.
  \begin{enumerate}[1.]
  \item
  $p\equiv 1\pmod 4$.
  \item
  $(\upvarpi!)^2\equiv-1\pmod p$.
  \item
  $-1$ is a quadratic residue of $p$.
  \end{enumerate}
\end{theorem}

\begin{proof}
By Wilson's Theorem, \emph{modulo} $p$,
\begin{align*}
  -1\equiv(p-1)!
&\equiv 1\cdot 2\dotsm\upvarpi\cdot(\upvarpi+1)\dotsm(p-1)\\
&\equiv 1\cdot(p-1)\cdot 2\cdot(p-2)\dotsm\upvarpi\cdot(\upvarpi+1)\\
&\equiv 1\cdot(-1)\cdot 2\cdot(-2)\dotsm\upvarpi\cdot(-\upvarpi)\\
&\equiv(-1)^{\upvarpi}(\upvarpi!)^2,
\end{align*}
that is,
\begin{equation*}
-1
%\equiv\prod_{k=1}^{p-1}k
\equiv\prod_{k=1}^{\upvarpi}k\cdot\prod_{k=\upvarpi+1}^{p-1}k
\equiv\prod_{k=1}^{\upvarpi}\bigl(k\cdot(p-k)\bigr)
\equiv(-1)^{\upvarpi}\cdot\prod_{k=1}^{\upvarpi}(k^2)
\equiv(-1)^{\upvarpi}\cdot(\upvarpi!)^2,
\end{equation*}
which yields~\eqref{eqn:varpi2}.
If $p\equiv1\pmod 4$, then $\upvarpi$ is even, so $(\upvarpi!)^2\equiv-1$, and therefore $-1$ is a quadratic residue of $p$.

Conversely, if $a^2\equiv-1\pmod p$, then by Fermat's Theorem,
  \begin{equation*}
    1\equiv a^{p-1}\equiv(a^2)^{\upvarpi}\equiv(-1)^{\upvarpi}\pmod p,
  \end{equation*}
so $\upvarpi$ must be even, and therefore $p\equiv1\pmod 4$.
\end{proof}

A related argument using quadratic residues in \S\ref{sect:qr} will provide yet another proof of Wilson's Theorem.\label{Wilson}


\chapter{Arithmetic functions}

\section{Multiplicative functions}
%\section{October 25, 2007 (Thursday)}

We work now with positive integers---natural numbers---only.  A
function on $\N$ is an 
\textbf{arithmetic function.}% 
\index{arithmetic function}%
\index{function!arithmetic ---}
One such function is $\msig$ as defined in the proof of Theorem~\ref{thm:even-perf}, so that $\msig(n)$
is the sum of the (positive) divisors of $n$.  For the \emph{number}
of positive divisors of $n$, we write
$\mtau(n)$.
For example,
\begin{equation*}
\begin{array}{r@{{}={}}c@{{}+{}}c@{{}+{}}c@{{}+{}}c@{{}+{}}c@{{}+{}}c@{{}={}}c}
\mtau(12)& 1& 2& 3& 4& 6& 12& 28,\\
\msig(12)& 1& 1& 1& 1& 1& 1& 6.
  \end{array}
\end{equation*}
Indeed, $12=2^2\cdot3$, so the divisors of $12$ are
\begin{align*}
&2^0\cdot 3^0,&
&2^1\cdot 3^0,&
&2^2\cdot 3^0,\\
&2^0\cdot 3^1,&
&2^1\cdot 3^1,&
&2^2\cdot 3^1.
\end{align*}
Then the factors of $12$ are determined by a choice from $\{0,1,2\}$ for
the exponent of $2$, and from $\{0,1\}$ for the exponent of $3$.
Hence
\begin{equation*}
  \mtau(12)=(2+1)\cdot(1+1).
\end{equation*}
Similarly, each factor of $12$ itself has two factors: one from
$\{1,2,4\}$, and the other from $\{1,3\}$; so
\begin{align*}
  \msig(12)
&=(1+2+4)\cdot(1+3)\\
&=(1+2+2^2)\cdot(1+3)\\
&=\frac{2^3-1}{2-1}\cdot\frac{3^2-1}{3-1}.
\end{align*}
These ideas work in general.  Here we use the notation introduced in \S\ref{sect:FTA}:

\begin{theorem}\label{thm:st}
If $n=\prod_pp^{n(p)}$, then
\begin{align*}
  \mtau(n)
&=\prod_p(n(p)+1),&
\msig(n)
&=\prod_p\frac{p^{n(p)+1}-1}{p-1}.
\end{align*}
\end{theorem}

We can abbreviate the definitions of $\msig$ and $\mtau$ as follows:
\begin{align}\label{eqn:st}
  \msig(n)&=\sum_{d\divides n}d,&
\mtau(n)&=\sum_{d\divides n}1.
\end{align}
Implicitly here, $d$ ranges over the \emph{positive} divisors of $n$.
In the theorem, the indices $p$ range over all primes; but they need only range over the primes dividing $n$ (since $n(p)=0$ when $p\ndivides n$).  That is, we can write $n$ as $\prod_{p\divides n}p^{n(p)}$, and then
\begin{align*}
  \mtau(n)
&=\prod_{p\divides n}(n(p)+1),&
\msig(n)
&=\prod_{p\divides n}\frac{p^{n(p)+1}-1}{p-1}.
\end{align*}
In short, each of $\msig(n)$ and $\mtau(n)$ is of the form
$\prod_{p\divides n}f(p)$
for some function $f$ on the set of primes.

\begin{theorem}\label{thm:on-primes}
If $\gcd(m,n)=1$, then for any function $f$ on the set of primes,
\begin{equation*}
\prod_{p\divides mn}f(p)=\prod_{p\divides m}f(p)\cdot\prod_{q\divides n}f(q).
\end{equation*}
\end{theorem}

\begin{proof}
If $\gcd(m,n)=1$ and $p\divides mn$, then by Theorem~\ref{thm:Euclid}, $p\divides m\iff p\ndivides n$.
\end{proof}

Consequently, if $\gcd(m,n)=1$, then
\begin{align*}
\msig(mn)&=\msig(m)\cdot\msig(n),&
\mtau(mn)&=\mtau(m)\cdot\mtau(n).
\end{align*}
We say therefore that $\msig$
and $\mtau$ are 
\textsl{multiplicative.} 
in general, an arithmetic function $f$ is 
\textbf{multiplicative}%
\index{multiplicative function}%
\index{function!multiplicative ---}
if
\begin{equation*}
  f(nm)=f(n)\cdot f(m)
\end{equation*}
whenever $n$ and $m$ are co-prime.  We do not require the identity to
hold for arbitrary $m$ and $n$.  For example,
\begin{align*}
  \msig(2\cdot 2)=\msig(4)=1+2+4&=7,&
  \msig(2)\cdot\msig(2)=(1+2)\cdot(1+2)&=9.
\end{align*}
The identify function $n\mapsto n$ and the constant function $n\mapsto
1$ are multiplicative.  We can denote these functions by
\begin{align*}
&\id,&&1,
\end{align*}
respectively.
Since $\msig(n)=\sum_{d\divides n}d=\sum_{d\divides n}\id(d)$ and
$\mtau(n)=\sum_{d\divides n}1=\sum_{d\divides n}1(d)$, the multiplicativity of $\msig$ and
$\mtau$ is also a special case of the following.

\begin{theorem}\label{thm:f*1}
  If $f$ is multiplicative, and $F$ is given by
  \begin{equation}\label{eqn:Ff}
    F(n)=\sum_{d\divides n}f(d),
  \end{equation}
then $F$ is multiplicative.
\end{theorem}

Before working out a formal proof, we can see why the theorem ought to
be true from an example.  Note first that, if $f$ is multiplicative
and \emph{non-trivial,} so that $f(n)\neq0$ for some $n$, then
\begin{equation*}
  0\neq f(n)=f(n\cdot1)=f(n)\cdot f(1),
\end{equation*}
so $f(1)=1$.
If also $f$ and $F$ are related
by~\eqref{eqn:Ff}, then
\begin{align*}
&\phantom{{}={}}  F(36)\\
&=F(2^2\cdot 3^2)\\
&=f(1)+f(2)+f(4)+f(3)+f(6)+f(12)+f(9)+f(18)+f(36)\\
&=\begin{aligned}[t]
f(1)\cdot f(1)&+f(2)\cdot f(1)+f(4)\cdot f(1)+{}\\
{}+f(1)\cdot f(3)&+f(2)\cdot f(3)+f(4)\cdot f(3)+{}\\
{}+f(1)\cdot f(9)&+f(2)\cdot f(9)+f(4)\cdot f(9)
  \end{aligned}\\
&=(f(1)+f(2)+f(4))\cdot(f(1)+f(3)+f(9))\\
&=F(4)\cdot F(9).
\end{align*}

\begin{proof}[Proof of theorem]
  Assuming $\gcd(m,n)=1$, we show first
  \begin{equation}\label{eqn:Fmn}
    F(mn)
=\sum_{c\divides mn}f(c)
=\sum_{d\divides m}\sum_{e\divides n}f(de).
\end{equation}
Suppose $c\divides mn$.  Then every prime power that divides $c$
divides exactly one of $m$ and $n$.  Hence $c$ and
$\gcd(c,m)\gcd(c,n)$ have the same prime power divisors, so they are
equal.  Moreover, if $c=de$, where $d\divides m$ and $e\divides n$,
then $c\divides mn$, $d=\gcd(c,m)$, and $e=\gcd(c,n)$. So we
have~\eqref{eqn:Fmn}. 
Continuing, we have
  \begin{align}\notag
    F(mn)&=\sum_{d\divides m}\sum_{e\divides n}f(de)\\\notag
&=\sum_{d\divides m}\sum_{e\divides n}f(d)\cdot f(e)\\\label{eqn:dist}
&=\sum_{d\divides m}f(d)\cdot\sum_{e\divides n}f(e)\\\notag
&=F(m)\cdot F(n).\qedhere
\end{align}
\end{proof}

In the proof, note that the expression in~\eqref{eqn:dist} should be understood first as
$\sum_{d\divides m}\bigl(f(d)\cdot\sum_{e\divides n}f(e)\bigr)$, and second as its equal, $\bigl(\sum_{d\divides m}f(d)\bigr)\cdot\sum_{e\divides n}f(e)$.

\section{The M\"obius function}

Suppose again $F$ is defined from $f$ as in~\eqref{eqn:Ff}, so that
\begin{equation*} \begin{array}{r@{{}={}}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c}
F( 1)&f(1)&     &    &     &    &     &    &     &    &     &    & &    &&     &&     &&\\
F( 2)&f(1)&{}+{}&f(2)&     &    &     &    &     &    &     &    & &    &&     &&     &&\\
F( 3)&f(1)&     & +  &     &f(3)&     &    &     &    &     &    & &    &&     &&     &&\\
F( 4)&f(1)&  +  &f(2)&     & +  &     &f(4)&     &    &     &    & &    &&     &&     &&\\
F( 6)&f(1)&  +  &f(2)&{}+{}&f(3)&     & +  &     &f(6)&     &    & &    &&     &&     &&\\
F( 8)&f(1)&  +  &f(2)&     & +  &     &f(4)&     & +  &     &f(8)& &    &&     &&     &&\\
F( 9)&f(1)&     & +  &     &f(3)&     &    &     & +  &     &    & &f(9)&&     &&     &&\\
F(12)&f(1)&  +  &f(2)&  +  &f(3)&{}+{}&f(4)&{}+{}&f(6)&     &    &+&    &&f(12)&&     &&\\
F(18)&f(1)&  +  &f(2)&  +  &f(3)&     & +  &     &f(6)&     & +  & &f(9)&& +   &&f(18)&&\\
F(24)&f(1)&  +  &f(2)&  +  &f(3)&  +  &f(4)&  +  &f(6)&{}+{}&f(8)& & +  &&f(12)&& +  &&f(24)
\end{array}
\end{equation*}
Then we can solve successively for $f(1)$, $f(2)$, and so on:
\begin{equation*} \begin{array}{r@{{}={}}r@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c}
f( 1)& F(1)&     &    &     &    &     &    &     &    &     &    & &    &&     &&     &&\\
f( 2)&-F(1)&{}+{}&F(2)&     &    &     &    &     &    &     &    & &    &&     &&     &&\\
f( 3)&-F(1)&     & +  &     &F(3)&     &    &     &    &     &    & &    &&     &&     &&\\
f( 4)&     &  -  &F(2)&     & +  &     &F(4)&     &    &     &    & &    &&     &&     &&\\
f( 6)& F(1)&  -  &F(2)&{}-{}&F(3)&     & +  &     &F(6)&     &    & &    &&     &&     &&\\
f( 8)&     &     &    &     &    &{}-{}&F(4)&     & +  &     &F(8)& &    &&     &&     &&\\
f( 9)&     &     &    &  -  &F(3)&     &    &     & +  &     &    & &F(9)&&     &&     &&\\
f(12)&     &     &F(2)&     & -  &     &F(4)&{}-{}&F(6)&     &    &+&    &&F(12)&&     &&\\
f(18)&     &     &    &     &F(3)&     & -  &     &F(6)&     & -  & &F(9)&& +   &&F(18)&&\\
f(24)&     &     &    &     &    &     &F(4)&     & -  &     &F(8)& & -  &&F(12)&& +  &&F(24)
\end{array}
\end{equation*}
There is some function $\xi$, taking integral values, such that
\begin{equation*}
f(n)=\sum_{d\divides n}F(d)\cdot\xi(n,d).
\end{equation*}
A candidate for $\xi$ that works in our examples is $(n,d)\mapsto\mmu(n/d)$, where $\mmu$ is given by
\begin{equation*}
  \mmu(n)=
  \begin{cases}
    0,&\text{ if $p^2\divides n$ for some prime $p$};\\
(-1)^r,&\text{ if $n=p_1\dotsm p_r$, where $p_1<\dotsb< p_r$}.
  \end{cases}
\end{equation*}
In particular, $\mmu(1)=1$.  
The function $\mmu$ is called the 
\textbf{M\"obius function}%
\index{Mobius@M\"obius}%
\index{Mobius@M\"obius!--- function}%
\index{function!M\"obius function}
(after
August Ferdinand M\"obius,
1790--1868).  In an
alternative (but equivalent) definition, $\mmu(n)=0$ unless $n$ is squarefree, but in this case
\begin{equation}\label{eqn:mu}
\mmu(n)=\prod_{p\divides n}-1.
\end{equation}

\begin{theorem}
The M\"obius function $\mmu$ is multiplicative.
\end{theorem}

\begin{proof}
Suppose $\gcd(m,n)=1$.  If
$p^2\divides mn$, then we may assume $p^2\divides m$, so
$\mmu(mn)=0=\mmu(m)=\mmu(m)\cdot\mmu(n)$.  If $mn$ is squarefree, then~\eqref{eqn:mu} and the proof of Theorem~\ref{thm:on-primes} show $\mmu(mn)=\mmu(m)\cdot\mmu(n)$.
\end{proof}

It will be useful to define the \textbf{unit function,}%
\index{unit function}%
\index{function!unit ---}
namely the function $\mep$ given by
\begin{equation*}
\mep(n)=
\begin{cases}
1,&\text{ if }n=1,\\
0,&\text{ if }n>1.
\end{cases}
\end{equation*}
This is easily a multiplicative function.  Both the statement and the proof of the following theorem are important.

\begin{theorem}\label{thm:m*1=e}
For all $n$,
\begin{equation*}
\sum_{d\divides n}\mmu(d)=\mep(n).
\end{equation*}
\end{theorem}

\begin{proof}
Both sides of the desired equation are multiplicative functions of $n$.  \emph{Therefore it is sufficient to prove the equation when $n$ is a prime power.}  This is easy:
\begin{align*}
\sum_{d\divides p^s}\mmu(d)
&=\sum_{k=0}^s\mmu(p^k)\\
&=\mmu(1)+\mmu(p)+\dotsb+\mmu(p^s)\\
&=\begin{cases}
\mmu(1),&\text{ if }s=0,\\
\mmu(1)+\mmu(p),&\text{ if }s>0
\end{cases}\\
&=\begin{cases}
1,&\text{ if }s=0,\\
1-1,&\text{ if }s>0
\end{cases}\\
&=\mep(p^s).\qedhere
\end{align*}
\end{proof}

Another important, albeit easy, observation is:

\begin{theorem}\label{thm:f*e=f}
For all arithmetic functions $f$,
\begin{equation*}
\sum_{d\divides n}f(d)\cdot\mep\Bigl(\frac nd\Bigr)=f(n).
\end{equation*}
\end{theorem}

Now we can prove that the function $\xi$ above is indeed $(n,d)\mapsto\mmu(n/d)$:

\begin{theorem}[M\"obius Inversion]\label{thm:MIF}%
\index{Mobius@M\"obius!--- Inversion}%
\index{theorem!M\"obius Inversion}
  If $f$ determines $F$ by the rule~\eqref{eqn:Ff}, namely
    \begin{equation*}
    F(n)=\sum_{d\divides n}f(d),
  \end{equation*}
   then $F$
  determines $f$ by the rule
  \begin{equation*}
    f(n)=\sum_{d\divides n}\mmu\Bigl(\frac nd\Bigr)\cdot F(d),
  \end{equation*}
and conversely.
\end{theorem}

\begin{proof}
  We just start calculating:
  \begin{align*}
    \sum_{d\divides n}\mmu\Bigl(\frac nd\Bigr)\cdot F(d)
&=\sum_{d\divides n}\mmu\Bigl(\frac nd\Bigr)\cdot\sum_{e\divides d}f(e)\\
&=\sum_{d\divides n}\sum_{e\divides d}\mmu\Bigl(\frac nd\Bigr)\cdot f(e).
  \end{align*}
Now we want to rearrange indices.
For all factors $d$ and $e$ of $n$, we have
\begin{equation*}
  e\divides d\iff\frac nd\divides\frac ne
\end{equation*}
by Theorem~\ref{thm:den}.
So there is a bijection between $\{(d,e)\colon d\divides n\And e\divides d\}$ and $\{(e,c)\colon e\divides n\And c\divides n/e\}$, namely $(d,e)\mapsto(e,n/d)$; the inverse is $(e,c)\mapsto(n/c,e)$.
Therefore
\begin{align*}
  \sum_{d\divides n}\mmu\Bigl(\frac nd\Bigr)\cdot F(d)
&=\sum_{e\divides n}\sum_{c\divides(n/e)}\mmu(c)\cdot f(e)\\
&=\sum_{e\divides n}f(e)\cdot\sum_{c\divides(n/e)}\mmu(c)\\
&=\sum_{e\divides n}f(e)\cdot\mep\Bigl(\frac ne\Bigr)\\
&=f(n)
\end{align*}
by the last two theorems.
The converse is similar.\footnote{This is Exercise \ref{xca:Moebius-inv}.}
\end{proof}

\section{Convolution}\label{sect:conv}

We can streamline some of the foregoing results.
If $f$ and $g$ are arithmetic functions, their
\textbf{convolution}%
\index{convolution}
is the function $f*g$, given by
\begin{equation*}
(f*g)(n)=\sum_{d\divides n}f(d)\cdot g\Bigl(\frac nd\Bigr).
\end{equation*}
Now, we have the following general principle:

\begin{theorem}\label{thm:dnd}
For every arithmetic function $f$,
\begin{equation*}
\sum_{d\divides n}f(d)=\sum_{d\divides n}f\Bigl(\frac nd\Bigr).
\end{equation*}
\end{theorem}

We shall use this below for an alternative proof of Theorem~\ref{thm:Gauss} (p.~\pageref{thm:Gauss}) and for Theorem~\ref{thm:fnn} (p.~\pageref{thm:fnn}).
Meanwhile, we have
\begin{equation*}
(f*g)(n)=\sum_{d\divides n}f\Bigl(\frac nd\Bigr)\cdot g(d),
\end{equation*}
or more simply
\begin{equation}\label{eqn:f*g=g*f}
f*g=g*f.
\end{equation}
The definition~\eqref{eqn:st} of $\msig$ and $\mtau$ can be written as
\begin{align*}
\msig&=\id*1,&
\mtau&=1*1.
\end{align*}
Theorem~\ref{thm:f*1} is that if $f$ is multiplicative and $F=f*1$, then $F$ is multiplicative.  The proof can be adapted to show that, if $f$ and $g$ are multiplicative, then so is $f*g$.
Theorems~\ref{thm:m*1=e} and~\ref{thm:f*e=f} are
\begin{align}\label{eqn:m1e,fef}
\mmu*1&=\mep,&
f*\mep&=f.
\end{align}
Then Theorem~\ref{thm:MIF}, M\"obius Inversion, is
\begin{equation*}
F=f*1\iff f=F*\mmu.
\end{equation*}
We proved this by manipulating indices of summation. 
Using such manipulations, we can show instead
\begin{equation*}
f*(g*h)=(f*g)*h.
\end{equation*}
By this and~\eqref{eqn:f*g=g*f}, Theorem~\ref{thm:MIF} is equivalent to
\begin{equation*}
f*1*\mmu=f;
\end{equation*}
but we can now understand this as an \emph{immediate} consequence of Theorems~\ref{thm:m*1=e} and~\ref{thm:f*e=f}, as expressed in~\eqref{eqn:m1e,fef}.

By repeated convolution, we have the following equations:
\begin{align*}
 \mmu*1&=\mep,&\mep*\mmu&=\mmu,\\
\mep*1&=1,   &   1*\mmu&=\mep,\\
   1*1&=\mtau,&\mtau*\mmu&=1.
\end{align*}
You can read down the first column, and up the second; each row is an instance of M\"obius inversion.  In short, we have a sequence
\begin{equation*}
\dots,\mmu,\mep,1,\mtau,\dots
\end{equation*}
where passage to the right is by convolving with $1$; and to the left, $\mmu$.  Since $\id*1=\msig$, the corresponding sequence with $\msig$ is
\begin{equation*}
\dots,\id,\msig,\dots
\end{equation*}
We now define the entry to the left of $\id$ as $\ephi$.  That is,
\begin{equation}\label{eqn:ephi}
\ephi=\id*\mmu.
\end{equation}
Then $\ephi$ is multiplicative, and
\begin{equation*}
\ephi(p^s)=
\begin{cases}
1,&\text{ if }s=0,\\
p^s-p^{s-1},&\text{ if }s>0.
\end{cases}
\end{equation*}
This is precisely the size of the set $\{x\colon 0\leq x<n\And\gcd(x,n)=1\}$ when $n=p^s$.  In general, this set can be understood as the set of invertible congruence-classes \emph{modulo} $n$.  Recall from \S\ref{sect:cong} that the set of \emph{all} congruence-classes \emph{modulo} $n$ can be denoted by
$\Zmod$.
Then the set of invertible elements is denoted by
\begin{equation*}\label{Zmodu}
\Zmodu.
\end{equation*}
So in case $n=p^s$, we have
\begin{equation*}
\ephi(n)=\size{\Zmodu[n]}.
\end{equation*}
We shall show in the next chapter that this holds generally.

Meanwhile, it may be of interest to note that convolution is called in
particular \textsl{Dirichlet convolution} (after Johann Peter Gustav
Lejeune Dirichlet,\footnote{The pronunciation is
  \emph{dirikle,} not \emph{diri\c sle.}} 1805--1859), because
analogous operations, also called convolutions, arise in other
contexts.  For example, the reader may be in a position to recall that
in analysis one defines 
\begin{equation*}
(f*g)(t)=\int_0^tf(x)g(t-x)\dee x.
\end{equation*}
This is related to the \textsl{Laplace transform,} which converts a suitable function $f$ into the function $\Lap f$, namely
\begin{equation*}
s\mapsto\int_0^{\infty}\me^{-st}f(t)\dee t.
\end{equation*}
Then
\begin{equation*}
\Lap{f*g}=\Lap f\cdot\Lap g.
\end{equation*}
Also, the transform is linear, and
\begin{gather*}
\Lap{f'}=\id\cdot\Lap f-f(0),\\
\Lap{f''}=\id^2\cdot\Lap f-\id\cdot f(0)-f'(0),
\end{gather*}
so that, if
\begin{equation*}
f''+af'+bf=g,
\end{equation*}
then
\begin{align*}
\Lap f&=\frac{f(0)\cdot\id+af(0)+f'(0)}{\id^2+a\cdot\id+b}+
\frac{\Lap g}{\id^2+a\cdot\id+b}\\
&=\Lap{\phi}+\Lap g\cdot\Lap h\\
&=\Lap{\phi}+\Lap{g*h}
\end{align*}
for some $\phi$ and $h$ that are independent of $g$.


\chapter{Arbitrary moduli}

\section{The Chinese Remainder Theorem}\label{sect:CRT-again}

The possibility of solving Chinese remainder problems%
\index{Chinese Remainder Problem}%
\index{remainder!Chinese --- problem}
can be understood through tables.  
Since $\gcd(4,9)=1$, for every choice of $a$ and $b$, Theorem~\ref{thm:crp} (p.~\pageref{thm:crp}) gives us a solution to
\begin{align}\label{eqn:crt-49}
x&\equiv a\pmod 4,&x&\equiv b\pmod 9,
\end{align}
and the solution is unique \emph{modulo} $36$.  We can find this solution by first filling out a table diagonally as follows:
\begin{gather*}
\begin{array}{|r|*{9}{r}|}\hline
&\phantom 00&\phantom 01&\phantom 02&\phantom 03&\phantom 04&\phantom 05&\phantom 06&\phantom 07&\phantom 08\\\hline
0&0& & & &4& & & &8\\
1& &1& & & &5& & & \\
2& & &2& & & &6& & \\
3& & & &3& & & &7& \\\hline
\end{array}\\
\begin{array}{|r|*{9}{r}|}\hline
&\phantom 00&\phantom 01&\phantom 02&\phantom 03&\phantom 04&\phantom 05&\phantom 06&\phantom 07&\phantom 08\\\hline
0& 0&  &  &12& 4&  &  &16& 8\\
1& 9& 1&  &  &13& 5&  &  &17\\
2&  &10& 2&  &  &14& 6&  &  \\
3&  &  &11&3 &  &  &15& 7&  \\\hline
\end{array}\\
\begin{array}{|r|*{9}{r}|}\hline
&\phantom 00&\phantom 01&\phantom 02&\phantom 03&\phantom 04&\phantom 05&\phantom 06&\phantom 07&\phantom 08\\\hline
0& 0&  &20&12& 4&  &24&16& 8\\
1& 9& 1&  &21&13& 5&  &25&17\\
2&18&10& 2&  &22&14& 6&  &26\\
3&  &19&11&3 &  &23&15& 7&  \\\hline
\end{array}\\
\begin{array}{|r|*{9}{r}|}\hline
&\phantom 00&\phantom 01&\phantom 02&\phantom 03&\phantom 04&\phantom 05&\phantom 06&\phantom 07&\phantom 08\\\hline
0& 0&28&20&12& 4&32&24&16& 8\\
1& 9& 1&29&21&13& 5&33&25&17\\
2&18&10& 2&30&22&14& 6&34&26\\
3&27&19&11&3 &31&23&15& 7&35\\\hline
\end{array}
\end{gather*}
The solution to~\eqref{eqn:crt-49} is the entry in row $a$, column $b$.  For example, $14$ solves the congruences $x\equiv2\pod4$ and $x\equiv5\pod9$.
Making such a table is not
always practical.  Still, the general procedure has the following theoretical formulation.

\begin{theorem}[Chinese Remainder Theorem]\label{thm:crt}
If $\gcd(m,n)=1$, then the function $x\mapsto(x,x)$ is a well-defined bijection from $\Zmod[mn]$ to $\Zmod[m]\times\Zmod$.
\end{theorem}

\begin{proof}
The given function is well defined, since if $a\equiv b\pod{mn}$, then $a\equiv b$ \emph{modulo} $m$ and $n$.  The converse of this holds too, by the corollary to Theorem~\ref{thm:lcm}, since $mn=\lcm(m,n)$; so the function is injective.  Since the domain and codomain are finite sets of the same size (namely $mn$), the function is a bijection.
\end{proof}

For all $m$ and $n$, we have
\begin{equation}\label{eqn:gcd}
\gcd(x,mn)=1\iff\gcd(x,m)=1\And\gcd(x,n)=1.
\end{equation}
This means, in the table above, if we delete row $i$ and column $j$ whenever $\gcd(4,i)\neq1$ and $\gcd(9,j)\neq1$, then the remaining numbers are precisely those that are prime to $36$:
\begin{equation*}
\begin{array}{|r|*{9}{r}|}\hline
&\phantom 00&\phantom 01&\phantom 02&\phantom 03&\phantom 04&\phantom 05&\phantom 06&\phantom 07&\phantom 08\\\hline
0&  &  &  &  &  &  &  &  &  \\
1&  & 1&29&  &13& 5&  &25&17\\
2&  &  &  &  &  &  &  &  &  \\
3&  &19&11&  &31&23&  & 7&35\\\hline
\end{array}
\end{equation*}
Recall that on page~\pageref{Zmodu} we defined $\Zmodu$ as the set of invertible elements of $\Zmod$.  Then we have the following general result.

\begin{theorem}
If $\gcd(m,n)=1$, then the function $x\mapsto(x,x)$ is a well-defined bijection from $\Zmodu[mn]$ to $\Zmodu[m]\times\Zmodu$.
\end{theorem}

\begin{proof}
By~\eqref{eqn:gcd}, for all $m$ and $n$,
the function $x\mapsto(x,x)$ maps $\Zmodu[mn]$ into $\Zmodu[m]\times\Zmodu$.  If $\gcd(m,n)=1$, then by the Chinese Remainder Theorem, every element of $\Zmodu[m]\times\Zmodu$ is $(x,x)$ for some $x$, which must be in $\Zmodu[mn]$.
\end{proof}

Recall that $\ephi$ was defined as $\id*\mmu$ in~\eqref{eqn:ephi} in \S\ref{sect:conv} (p.~\pageref{eqn:ephi}).  As promised, we now have:

\begin{theorem}\label{thm:phi}
For all $n$,
\begin{equation*}
\ephi(n)=\size{\Zmodu}.
\end{equation*}
\end{theorem}

\begin{proof}
We follow the principle used in proving Theorem~\ref{thm:m*1=e}.  Being the convolution of multiplicative functions, $\ephi$ is multiplicative.  By the last theorem, the function $n\mapsto\size{\Zmodu}$ is multiplicative.  Finally, the given equation holds when $n$ is a prime power, as shown in \S\ref{sect:conv}.
\end{proof}

This will
enable us to establish a generalization of Fermat's Theorem.

\section{Euler's Theorem}

Since $\ephi(p)=p-1$,
Fermat's Theorem is that, if $n$ is prime, and $\gcd(a,n)=1$, then
\begin{equation*}
  a^{\ephi(n)}\equiv1 \pmod n.
\end{equation*}
We shall show that this holds for all $n$.

The multiplicative function $\ephi$ is called the
\textbf{Euler phi-function}%
\index{Euler!--- phi-function}%
\index{function!Euler phi-{}---}
after Leonhard Euler,
1707--1783.%
\index{Euler}
Euler's original definition apparently corresponds to Theorem~\ref{thm:phi}:
 $\ephi(n)$ is the number of $x$ such that $0\leq
  x< n$
  and $x$ is prime to $n$.  For calculating this, we now
  have\footnote{Gauss proves the theorem in the \emph{Disquisitiones
      Arithmeticae}~\cite[\P38]{Gauss}, attributing it to Euler in
    1760--1.} 
  
  \begin{theorem}\label{thm:phi-p}
For all $n$,
\begin{equation*}
\ephi(n)=n\prod_{p\divides n}\Bigl(1-\frac1p\Bigr).
\end{equation*}
\end{theorem}

\begin{proof}
If $n=\prod_{p\divides n}p^{n(p)}$, then  
\begin{align*}
\ephi(n)
=\prod_{p\divides n}\ephi(p^{n(p)})
&=\prod_{p\divides n}(p^{n(p)}-p^{n(p)-1})\\
&=\prod_{p\divides n}p^{n(p)}\prod_{p\divides n}\Bigl(1-\frac1p\Bigr)
=n\prod_{p\divides n}\Bigl(1-\frac1p\Bigr).\qedhere
\end{align*}
\end{proof}

For example,
\begin{equation*}  \ephi(30)=30\cdot\Bigl(1-\frac12\Bigr)\cdot\Bigl(1-\frac13\Bigr)\cdot\Bigl(1-\frac15\Bigr)=30\cdot\frac12\cdot\frac23\cdot\frac45=8.
\end{equation*}
Since $180$ has the same prime divisors as $30$, we have
\begin{equation*}
  \frac{\ephi(180)}{\ephi(30)}=\frac{180}{30}=6,
\end{equation*}
so $\ephi(180)=6\ephi(30)=48$.  But $15$ and $30$ do not have the same
prime divisors, and we cannot expect $\ephi(15)/\ephi(30)$ to be
$15/30$, or $1/2$; indeed, $\ephi(15)=\ephi(3)\cdot\ephi(5)=2\cdot
4=8=\ephi(30)$.  

\begin{theorem}[Euler]\label{thm:Euler}%
\index{Euler!---'s Theorem}%
\index{theorem!Euler's Th---}
  If $\gcd(a,n)=1$, then
  \begin{equation*}
    a^{\ephi(n)}\equiv1\pmod n.
  \end{equation*}
\end{theorem}

\begin{proof}
Assume $\gcd(a,n)=1$.  Then the function $x\mapsto ax$ is a bijection
from $\Zmodu$ to itself.  Hence 
\begin{equation*}
\prod_{x\in\Zmodu}x
\equiv\prod_{x\in\Zmodu}(ax)
\equiv a^{\ephi(n)}\prod_{x\in\Zmodu}x\pmod n.
\end{equation*}
Since the product $\prod_{x\in\Zmodu}x$ is invertible (since its
factors are), we obtain the result. 
\end{proof}

Again, Fermat's Theorem is the special case when $n=p$.  But we do \emph{not}
generally have $a^{\ephi(n)+1}\equiv a\pmod n$ for arbitrary $a$.  For
example,
$\ephi(12)=4$, but $2^5=32\equiv 8\pmod{12}$.

Euler's Theorem gives us a procedure for solving certain congruences.\label{exp}
For example, to solve
\begin{equation*}
  369^{19587}x\equiv1\pmod{1000},
\end{equation*}
we compute
\begin{equation*}
  \ephi(1000)=\ephi(10^3)=\ephi(2^3\cdot
  5^3)=\ephi(2^3)\cdot\ephi(5^3)=4\cdot100=400. 
\end{equation*}
Now reduce the exponent:
\begin{equation*}
  \frac{19587}{400}=48+\frac{387}{400}.
\end{equation*}
So we want to solve
\begin{align*}
  369^{387}x&\equiv1\pmod{1000},\\
x&\equiv369^{13}\pmod{1000}.
\end{align*}
Now proceed, using that $13=8+4+1=2^3+2^2+1$.  Multiplication
\emph{modulo} $1000$ requires only three columns, so the computations
of Table~\ref{table:1000}%on page~\pageref{table:1000} 
\begin{table}[ht]
\begin{gather*}
\fbox{\begin{array}[b]{@{}r@{\,}r@{\,}r@{}}
    3&6&9\\
    3&6&9\\\hline
    3&2&1\\
    1&4& \\
    7& & \\\hline
    1&6&1
  \end{array}}\text{ so }
369^2\equiv161\pod{1000};\quad
\fbox{\begin{array}[b]{@{}r@{\,}r@{\,}r@{}}
    1&6&1\\
    1&6&1\\\hline
    1&6&1\\
    6&6& \\
    1& & \\\hline
    9&2&1
  \end{array}}\text{ so }
369^4\equiv161^2\equiv921\pod{1000};\\
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  \fbox{\begin{array}[b]{@{}r@{\,}r@{\,}r@{}}
    9&2&1\\
    9&2&1\\\hline
    9&2&1\\
    4&2& \\
    9& & \\\hline
    2&4&1
  \end{array}}\text{ so }
369^8\equiv921^2\equiv241\pod{1000};\\
369^{13}\equiv369^8\cdot369^4\cdot369\equiv241\cdot921\cdot369\pod{1000};\\
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\fbox{\begin{array}[b]{@{}r@{\,}r@{\,}r@{}}
    2&4&1\\
    9&2&1\\\hline
    2&4&1\\
    8&2& \\
    9& & \\\hline
    9&6&1
  \end{array}}\qquad
\fbox{\begin{array}[b]{@{}r@{\,}r@{\,}r@{}}
    9&6&1\\
    3&6&9\\\hline
    6&4&9\\
    6&6& \\
    3& & \\\hline
    6&0&9
  \end{array}}\text{ so }
369^{13}\equiv609\pmod{1000}.
\end{gather*}
\caption[Exponentiation \emph{modulo} $1000$]{Exponentiation
  \emph{modulo} $1000$%(see page~\pageref{exp})
}\label{table:1000} 
\end{table}
give us the solution \fbox{$x\equiv609\pmod{1000}$.}

Euler's Theorem gives a neat theoretical solution to
Chinese remainder problems:  

\begin{theorem}
Suppose the positive integers $n_1$,
\dots, $n_s$ are pairwise co-prime, and the integers $a_1$, \dots, $a_s$ are arbitrary.  Define
\begin{align*}
  n&=n_1\dotsm n_s,&
N_i&=\frac n{n_i}.
\end{align*}
Then we have
\begin{align*}
    x&\equiv a_1\pmod{n_1},&
    &\dots,&
x&\equiv a_s\pmod{n_s}
\end{align*}
if and only if
\begin{equation*}
  x\equiv a_1\cdot N_1{}^{\ephi(n_1)}+\dotsb+ a_s\cdot N_s{}^{\ephi(n_s)} \pmod{n}.
\end{equation*}
\end{theorem}

\begin{proof}
If $i\neq j$, then $n_j\divides N_i$, so
$N_i{}^{\ephi(n_i)}\equiv 0\pmod{n_j}$.
\end{proof}

\section{Gauss's Theorem}%\asterism{}

Given the theoretical developments of the previous chapter, we can immediately prove:\footnote{The three theorems of the present section are versions of the three theorems in Burton's section, `Some properties of the phi-function' \cite[\S7.4, pp.~141--5]{Burton}.  I have tried to suggest a connection between the first two theorems.  In Burton, the last theorem is just what we have expressed as $\ephi=\mmu*\id$; but this is also derivable from Gauss's Theorem.  Hence I have named the section for Gauss.}

\begin{theorem}[Gauss\footnote{Gauss proves this in the \emph{Disquisitiones Arithmeticae}~\cite[\P39]{Gauss}, but he does not have all of our theory at his disposal.}]\label{thm:Gauss}%
\index{Gauss!---'s Theorem}%
\index{theorem!Gauss's Th---}
  For all positive integers $n$,
\begin{equation}\label{eqn:sum-phi}
\sum_{d\divides n}\ephi(d)=n.
\end{equation}
\end{theorem}

\begin{proof}
The claim is $\ephi*1=\id$, which is the result of applying M\"obius Inversion (in reverse) to the original definition of $\ephi$.
\end{proof}

Without relying on M\"obius inversion, we can prove Gauss's theorem by the technique of Theorems~\ref{thm:m*1=e} and~\ref{thm:phi}.  Both sides of the equation are multiplicative functions of $n$, and
\begin{align*}
\sum_{d\divides p^s}\ephi(d)=\sum_{k=0}^s\ephi(p^k)
&=1+\sum_{k=1}^s(p^k-p^{k-1})\\
&=1+(p-1)+(p^2-p)+\dotsb+(p^s-p^{s-1})=p^s.
\end{align*}

Yet another proof\footnote{This is basically Gauss's proof.} of Gauss's theorem makes use of the principle of Theorem~\ref{thm:dnd}.  Partition the set $\{0,1,\dots,n-1\}$
according to greatest common divisor with $n$.  For example, suppose
$n=12$.  We can construct a table as follows, where the rows are
labelled with the divisors of $12$.  Each number $x$ from $0$ to $11$
inclusive is assigned to row $d$, if $\gcd(x,12)=d$.
\begin{equation*}
  \begin{array}{|r|cccccccccccc|}\hline
  &0&1&2&3&4&5&6&7&8&9&10&11\\\hline
12&0& & & & & & & & & &  &  \\
 6& & & & & & &6& & & &  &  \\
 4& & & & &4& & & &8& &  &  \\
 3& & & &3& & & & & &9&  &  \\
 2& & &2& & & & & & & &10&  \\
 1& &1& & & &5& &7& & &  &11\\\hline
  \end{array}
\end{equation*}
But when $d\divides 12$, we have
\begin{equation*}
0\leq x<12\And\gcd(x,12)=d
\end{equation*}
if and only if we have
\begin{equation*}
d\divides x\And\gcd\Bigl(\frac xd,\frac{12}d\Bigr)=1
\And0\leq\frac xd<\frac{12}d. 
\end{equation*}
So the number of entries in row $d$ of the table is just
$\ephi(12/d)$.  The number of entries in all rows together is $12$, so
\begin{equation*}
12=\sum_{d\divides 12}\ephi\Bigl(\frac{12}d\Bigr); 
\end{equation*}
but this is just $\sum_{d\divides 12}\ephi(d)$, by Theorem~\ref{thm:dnd}.
This argument is not specific to $12$; it can be generalized to establish Gauss's theorem.   
Is there anything noticeable about the table for $n=12$?  Try some other values of $n$,
as in Table~\ref{tab:20}.\footnote{Information as in this table will be of use in the next section, \S\ref{sect:order}.}
\begin{sidewaystable}
\begin{gather*}
  \begin{array}{|r|*{15}{p{15pt}@{}}p{15pt}|}\hline
  &$0$&$1$&$2$&$3$&$4$&$5$&$6$&$7$&$8$&$9$&$10$&$11$&$12$&$13$&$14$&$15$\\\hline  
16&$0$&   &   &   &   &   &   &   &   &   &    &    &    &    &    &    \\
 8&   &   &   &   &   &   &   &   &$8$&   &    &    &    &    &    &    \\
 4&   &   &   &   &$4$&   &   &   &   &   &    &    &$12$&    &    &    \\
 2&   &   &$2$&   &   &   &$6$&   &   &   &$10$&    &    &    &$14$&    \\
 1&   &$1$&   &$3$&   &$5$&   &$7$&   &$9$&    &$11$&    &$13$&    &$15$\\\hline  
  \end{array}\\
  \begin{array}{|r|*{17}{p{15pt}@{}}p{15pt}|}\hline
  &$0$&$1$&$2$&$3$&$4$&$5$&$6$&$7$&$8$&$9$&$10$&$11$&$12$&$13$&$14$&$15$&$16$&$17$\\\hline  
18&$0$&   &   &   &   &   &   &   &   &   &    &    &    &    &    &    &    &    \\
 9&   &   &   &   &   &   &   &   &   &$9$&    &    &    &    &    &    &    &    \\
 6&   &   &   &   &   &   &$6$&   &   &   &    &    &$12$&    &    &    &    &    \\
 3&   &   &   &$3$&   &   &   &   &   &   &    &    &    &    &    &$15$&    &    \\
 2&   &   &$2$&   &$4$&   &   &   &$8$&   &$10$&    &    &    &$14$&    &$16$&    \\
 1&   &$1$&   &   &   &$5$&   &$7$&   &   &    &$11$&    &$13$&    &    &    &$17$\\\hline  
  \end{array}\\
  \begin{array}{|r|*{20}{p{15pt}@{}}p{15pt}|}\hline &$0$&$1$&$2$&$3$&$4$&$5$&$6$&$7$&$8$&$9$&$10$&$11$&$12$&$13$&$14$&$15$&$16$&$17$&$18$&$19$&$20$\\\hline  
21&$0$&   &   &   &   &   &   &   &   &   &    &    &    &    &    &    &    &    &    &&\\
 7&   &   &   &   &   &   &   &$7$&   &   &    &    &    &    &$14$&    &    &    &    &&\\
 3&   &   &   &$3$&   &   &$6$&   &   &$9$&    &    &$12$&    &    &$15$&    &    &$18$&&\\
 1&   &   &$2$&   &$4$&$5$&   &   &$8$&   &$10$&$11$&&$13$&&&$16$&$17$&&$19$&$20$\\\hline
  \end{array}  
\end{gather*}
\caption{Numbers according to $\gcd$ with $16$, $18$, and $21$}\label{tab:20}
\end{sidewaystable}
The entries are symmetric about a vertical axis, except for $0$.
More precisely, if $d$ is a \emph{proper} divisor of $n$, then the function
$x\mapsto n-x$ is a permutation of $\{0\leq x<n\colon \gcd(x,n)=d\}$.  In other words, the average value of an element $x$ of $\{1,\dots,n-1\}$ such that $\gcd(x,n)=d$ is $n/2$.
We can write out the case where $d=1$ as follows.

\begin{theorem}\label{thm:ave}
For all $n$, if we understand
\begin{equation*}
\Zmodu=\{k\colon 0<k<n\And\gcd(k,n)=1\}
\end{equation*}
then
\begin{equation*}
\ephi(n)=\frac 2n\sum_{k\in\Zmodu}k.
\end{equation*}
\end{theorem}

\begin{proof}
Since the function $x\mapsto n-x$ permutes the indices of the given summation, and $\size{\Zmodu}=\ephi(n)$, we have
\begin{equation*}
\sum_{k\in\Zmodu}k
=\sum_{k\in\Zmodu}(n-k)
=\ephi(n)\cdot n-\sum_{k\in\Zmodu}k,
\end{equation*}
which yields the claim.
\end{proof}

The following relates a function of \emph{all} of the divisors of $n$ with a function of its prime divisors.

\begin{theorem}\label{thm:fnn}
For all $n$,
\begin{equation*}
\sum_{d\divides n}\frac{\mmu(d)}d
%=\frac{\ephi(n)}n
=\prod_{p\divides n}\Bigl(1-\frac1p\Bigr).
\end{equation*}
\end{theorem}

\begin{proof}
From the original definition~\eqref{eqn:ephi} of $\ephi$ as $\id*\mmu$, or by applying M\"obius Inversion to Gauss's Theorem, and then by Theorem~\ref{thm:dnd}, as well as by Theorem~\ref{thm:phi-p}, we have
\begin{equation*}
\sum_{d\divides n}\frac nd\cdot{\mmu(d)}
=\ephi(n)=n\prod_{p\divides n}\Bigl(1-\frac1p\Bigr).
\end{equation*}
Now divide by $n$.
\end{proof}

For example,
\begin{align*}
  \sum_{d\divides12}\frac{\mmu(d)}d
&=\frac{\mmu(1)}1+
\frac{\mmu(2)}2+
\frac{\mmu(3)}3+
\frac{\mmu(4)}4+
\frac{\mmu(6)}6+
\frac{\mmu(12)}{12}\\
&=1-\frac12-\frac13+\frac16\\
&=1-\frac12-\frac13+\frac1{2\cdot3}\\
&=\Bigl(1-\frac12\Bigr)\Bigl(1-\frac13\Bigr)
=\prod_{p\divides12}\Bigl(1-\frac1p\Bigr).
\end{align*}
This may suggest a proof of the last theorem by direct computation.  Indeed, suppose the distinct prime factors of $n$ are $p_1$, \dots, $p_r$.  Then
\begin{equation*}
\prod_{p\divides n}\Bigl(1-\frac1p\Bigr)
=\sum_{j=0}^r\sum_{1\leq k(1)<\dots<k(j)\leq r}\frac{(-1)^j}{p_{k(1)}\dotsm p_{k(j)}}
=\sum_{d\divides n}\frac{\mmu(d)}d.
\end{equation*}

\chapter{Primitive roots}\label{ch:pr}

\section{Order}\label{sect:order}

Euler's Theorem can be improved in some cases.  For example,
$255=3\cdot5\cdot17$, so
$\ephi(255)=\ephi(3)\cdot\ephi(5)\cdot\ephi(17)=2\cdot4\cdot16=128$, and
hence, by Euler's Theorem,
\begin{equation*}
  \gcd(a,255)=1\implies a^{128}\equiv1\pmod{255}.
\end{equation*}
But by Fermat's Theorem,
\begin{align*}
  3\ndivides a&\implies a^2\equiv1\pmod 3\implies
  a^{16}\equiv1\pmod{3};\\
  5\ndivides a&\implies a^4\equiv1\pmod 5\implies
  a^{16}\equiv1\pmod{5};\\
  17\ndivides a&\implies a^{16}\equiv1\pmod{17}.
\end{align*}
Therefore $\gcd(a,255)=1\implies a^{16}\equiv1\pmod{3,5,17}$, that is,
\begin{equation*}
  \gcd(a,255)=1\implies a^{16}\equiv1\pmod{255}.
\end{equation*}

If it exists, the 
\textbf{order}%
\index{order}
of $a$ \emph{modulo} $n$ is the least
positive $k$ such that
\begin{equation*}
  a^k\equiv1\pmod n.
\end{equation*}

\begin{theorem}
A number $a$ has an order \emph{modulo} $n$ if and only if
\begin{equation*}
\gcd(a,n)=1.
\end{equation*}
\end{theorem}

\begin{proof}
If $a$ has the order $k$ \emph{modulo} $n$, then $a^k-1=n\cdot\ell$
for some $\ell$, so 
\begin{equation*}
  a\cdot a^{k-1}-n\cdot\ell=1,
\end{equation*}
and therefore $\gcd(a,n)=1$.  Conversely, if $\gcd(a,n)=1$, then
$a^{\ephi(n)}\equiv 1\pmod n$, so $a$ has an order \emph{modulo} $n$.
\end{proof}

Assuming $\gcd(a,n)=1$, let us denote the order of $a$ \emph{modulo}
$n$ by
\begin{equation*}
  \ord na.
\end{equation*}
For example, what is $\ord{17}2$?  Just compute powers of $2$
\emph{modulo} $17$:
\begin{equation*}
\begin{array}{|c*{8}{|r}|}\hline
  k         &1&2&3& 4& 5& 6& 7&8\\\hline
2^k\pmod{17}&2&4&8&-1&-2&-4&-8&1\\\hline
\end{array}
\end{equation*}
Then $\ord{17}2=8$.  Likewise,
$\ord{17}3=16$:
\begin{equation*}
  \begin{array}{|c*{8}{|r}|}\hline
    k&1&2&3&4&5&6&7&8\\\hline
3^k\pmod{17}&3&-8&-7&-4&5&-2&-6&-1\\\hline\hline
k&9&10&11&12&13&14&15&16\\\hline
3^k\pmod{17}&-3&8&7&4&-5&2&6&1\\\hline
  \end{array}
\end{equation*}
Note how, in each computation, halfway through, we just change signs.  
From the last table, taking every other entry, we can extract
\begin{equation*}
  \begin{array}{|c*{8}{|r}|}\hline
    k&1&2&3&4&5&6&7&8\\\hline
(-8)^k\pmod{17}&-8&-4&-2&-1&8&4&2&1\\\hline
  \end{array}
\end{equation*}
which means $\ord{17}{-8}=8$.    Likewise, $\ord{17}{-4}=4$, and
$\ord{17}{-1}=2$.  So we have
\begin{equation*}
  \begin{array}{|c*{8}{|r}|}\hline
          a & 1& 2& 3& 4& 5& 6& 7& 8\\\hline
\ord{17}  a & 1&  &16&  &  &  &  &  \\\hline
\ord{17}{-a}& 2&  &  & 4&  &  &  & 8\\\hline
  \end{array}
\end{equation*}
How can we complete the table?  For example, what is
$\ord{17}{-7}$?  Since $-7\equiv3^3\pmod{17}$, and
$\gcd(3,16)=1$, we shall be able to conclude $\ord{17}{-7}=16$.  Likewise, $\ord{17}5=16$.
But $\ord{17}{-2}=16/\gcd(6,16)=8$, since $-2\equiv3^6\pmod{17}$.
This is by a general theorem to be proved presently.  We complete the
last table thus:
\begin{equation*}
  \begin{array}{|c*{8}{|r}|}\hline
          a & 1& 2& 3& 4& 5& 6& 7& 8\\\hline
\ord{17}  a & 1& 8&16& 4&16&16&16& 8\\\hline
\ord{17}{-a}& 2& 8&16& 4&16&16&16& 8\\\hline
  \end{array}
\end{equation*}

\begin{theorem}\label{thm:ord}
  Suppose $\gcd(a,n)=1$.  Then
  \begin{enumerate}
    \item\label{item:ak1}
$a^k\equiv1\pmod n$ if and only if $\ord
      na\divides k$;
\item\label{item:nas}
$\ord n{a^s}=\ord na/\gcd(s,\ord na)$;
\item\label{item:akal}
$a^k\equiv a^{\ell}$ if and only if $k\equiv\ell\pmod{\ord na}$. 
  \end{enumerate}
\end{theorem}

\begin{proof}
  For~\eqref{item:ak1}, the reverse direction is easy.  For the
  forward direction, suppose $a^k\equiv1\pmod n$.  Now use division:
  \begin{equation*}
    k=\ord na\cdot s+r
  \end{equation*}
for some $s$ and $r$, where $0\leq r<\ord na$.  Then
\begin{equation*}
  1\equiv a^k\equiv a^{\ord na\cdot s+r}\equiv(a^{\ord na})^s\cdot
  a^r\equiv a^r\pmod n.
\end{equation*}
By minimality of $\ord na$ as an integer $k$ such that $a^k\equiv
1\pmod n$, we conclude $r=0$.  This means $\ord na\divides
k$.

To prove~\eqref{item:nas}, by~\eqref{item:ak1} we have, \emph{modulo} $n$,
\begin{equation*}
  (a^s)^k\equiv 1\iff a^{sk}\equiv1\iff \ord na\divides
  sk\iff\frac{\ord na}{\gcd(s,\ord na)}\divides k,
\end{equation*}
but also $(a^s)^k\equiv 1\iff \ord n{a^s}\divides k$,
hence
\begin{equation*}
  \frac{\ord na}{\gcd(s,\ord na)}\divides k\iff
\ord n{a^s}\divides k.
\end{equation*}
This is true for all $k$.  Since orders are
  positive, we conclude~\eqref{item:nas}.

Finally,~\eqref{item:akal} follows from~\eqref{item:ak1}, since
\begin{align*}
  a^k\equiv a^{\ell}\pmod n&\iff a^{k-\ell}\equiv 1\pmod n\\
&\iff\ord na\divides k-\ell\\
&\iff k\equiv\ell\pmod{\ord na}.
\end{align*}
(We have used that $\gcd(a,n)=1$, so that $a^{-\ell}$ exists.)
\end{proof}

Hence, from
\begin{equation*}
  \begin{array}{|c*{9}{|r}|}\hline
    k&1&2&3&4&5&6&7&8&9\\\hline
2^k\pmod{19}&2&4&8&-3&-6&7&-5&9&-1\\\hline
2^{k+9}\pmod{19}&-2&-4&-8&3&6&-7&5&-9&1\\\hline
  \end{array}
\end{equation*}
we obtain
\begin{equation*}
  \begin{array}{|c*{9}{|r}|}\hline
a&1&2&3&4&5&6&7&8&9\\\hline
\ord{19}a&1&18&18&9&9&9&3&6&9\\\hline
\ord{19}{-a}&2&9&9&18&18&18&6&3&18\\\hline
  \end{array}
\end{equation*}
by the computations in Table~\ref{table:19} (which make use of information in Table~\ref{tab:20} on page~\pageref{tab:20} above).
\begin{table}[ht]
\begin{align*}
  \ord{19}{2^k}=18
&\iff\gcd(k,18)=1\\
&\iff k\equiv1,5,7,11,13,17\pmod{18}\\
&\iff 2^k\equiv2,-6,-5,-4,3,-9\pmod{19};\\
\ord{19}{2^k}=9
&\iff\gcd(k,18)=2\\
&\iff k\equiv2,4,8,10,14,16\pmod{18}\\
&\iff 2^k\equiv4,-3,9,-2,6,5\pmod{19},\\
\ord{19}{2^k}=6
&\iff\gcd(k,18)=3\\
&\iff k\equiv3,15\pmod{18}\\
&\iff 2^k\equiv8,-7\pmod{19},\\
\ord{19}{2^k}=3
&\iff\gcd(k,18)=6\\
&\iff k\equiv6,12\pmod{18}\\
&\iff 2^k\equiv7,-8\pmod{19},\\
\ord{19}{2^k}=2
&\iff\gcd(k,18)=9\\
&\iff k\equiv9\pmod{18}\\
&\iff 2^k\equiv-1\pmod{19}.
\end{align*}
\caption{Orders \emph{modulo} $19$}\label{table:19}
\end{table}
If $d\divides 18$, let $\mpsi_{19}(d)$ be the number\footnote{In the \emph{Disquisitiones Arithmeticae}~\cite[\P52]{Gauss}, Gauss introduces the notation $\psi d$ for this number.} of incongruent residues
\emph{modulo} $19$ that have order $d$.  Then we have
\begin{equation*}
  \begin{array}{|r|c|}\hline
d&\mpsi_{19}(d)\\\hline
18&6\\\hline
9&6\\\hline
6&2\\\hline
3&2\\\hline
2&1\\\hline
1&1\\\hline
  \end{array}
\end{equation*}
Note that $\mpsi_{19}(d)=\ephi(d)$ here.  This is no accident.
Indeed, if $d\divides18$, so $18=d\ell$ for some $\ell$, we have 
\begin{align*}
\ord{19}{2^k}=d
&\iff\gcd(k,18)=\ell\\
&\iff\ell\divides k\And\gcd\Bigl(\frac k{\ell},d\Bigr)=1.
\end{align*}
Thus, \emph{modulo} $18$, the number of $k$ such that $\ord{19}{2^k}=d$ is just $\ephi(d)$.  But every number that is prime to $19$ is congruent \emph{modulo} $19$ to $2^k$ for some such $k$.  Therefore $\mpsi_{19}(d)=\ephi(d)$.

If $\gcd(a,n)=1$, and $\ord na=\ephi(n)$, then $a$ is called a
\textbf{primitive root}%
\index{primitive root}
of $n$.  So we have shown that $3$, but not
$2$, is a primitive root of $17$.  

Also, $2$ is a primitive root of
$19$, and we have used this to show $\mpsi_{19}(d)=\ephi(d)$ if
$d\divides 18$.  The same argument shows $\mpsi_n(d)=\ephi(d)$, if $n$
has a primitive root.  We shall show that every $p$ has a primitive
root; but this will be a \emph{corollary} to
Theorem~\ref{thm:psi-phi}, that $\mpsi_p(d)=\ephi(d)$. 

There will be no formula for determining primitive roots: we just
have to look for them.  But once we know that $2$ is a primitive root
of $19$, then we know that $2^5$, $2^7$, $2^{11}$, $2^{13}$, and $2^{17}$
are primitive roots---or rather, $-6$, $-5$, $-4$, $3$, and $-9$ are
primitive roots.  In particular, the number of primitive roots of $19$
is $\ephi(18)$.  

\section{Groups}\label{sect:groups}

We can understand what we are doing algebraically as follows.  On the set
$\Zmod$ of congruence-classes \emph{modulo} $n$, addition and
multiplication are well-defined by Theorem~\ref{thm:+.mod-n}, and so
the set, considered with these operations, is a
\textbf{ring.}%
\index{ring}  The multiplicatively
invertible elements of this ring compose the set $\Zmodu$.
This set is closed under multiplication and inversion: it is a
(multiplicative) 
\textbf{group.}%
\index{group}
Suppose $k\in\Zmodu$.
(More precisely one might write the element as $k+(n)$ or $\bar k$.  On the other hand, we are free to treat $\Zmodu$ as being literally a subset of $\Z$: we did this in Theorem~\ref{thm:ave}.  In this case, one must just remember that multiplication and addition are not the usual operations on $\Z$.)
Then we have the function
\begin{equation*}
  x\mapsto k^x
\end{equation*}
from $\Z$ to $\Zmodu$.  Since $k^{x+y}=k^x\cdot k^y$, this
function is a 
\textbf{homomorphism}%
\index{homomorphism}%
\index{function!homomorphism}
from the additive group $\Z$ to the
multiplicative group $\Zmodu$.

We have shown that the function $x\mapsto 2^x$ is
surjective onto $\Zmodu[19]$, and its kernel is $(18)$.  Call this function $f_2$.  Then
(by the First Isomorphism Theorem for Groups) $f_2$ is an
\textbf{isomorphism}%
\index{isomorphism}%
\index{function!isomorphism}
from $\Zmod[18]$ onto $\Zmodu[19]$:
\begin{align*}
  \Zmod[18]&\cong\Zmodu[19],\\
(\{0,1,2,\dots,17\},+)&\cong(\{1,2,3,\dots,18\},{}\cdot{}).
\end{align*}

From analysis, we have the exponential function $x\mapsto\me^x$ or
$\exp$ from $\R$ to $\units{\R}$, 
where $\units{\R}=\R\setminus\{0\}$ (the set of multiplicatively
invertible real numbers).  We have
\begin{equation*}
\exp(x+y)=\exp(x)\cdot\exp(y).  
\end{equation*}
The range of
$\exp$ is the interval $(0,\infty)$, which is closed under
multiplication and inversion.  Also $\exp$ is injective.  So $\exp$ is
an isomorphism from $(\R,+)$ onto $((0,\infty),{}\cdot{})$.

We are looking at a similar isomorphism in discrete mathematics.  If
$a$ is a primitive root of $n$, then $x\mapsto a^x$ is an isomorphism
from $\Zmod[\ephi(n)]$ to $\Zmodu$.  In particular, $\Zmodu$ is
cyclic.  Conversely, if $\Zmodu$ is cyclic, then a generator is a
primitive root of $n$.  For example:
\begin{compactenum}
  \item
$\Zmodu[2]=\{1\}$, so $1$ is a primitive root of $2$.
\item
$\Zmodu[3]=\{1,2\}$, and $2^2\equiv1\pmod3$, so $2$ is a primitive
  root of $3$.
\item
$\Zmodu[4]=\{1,3\}$, and $3^2\equiv1\pmod4$, so $3$ is a primitive
  root of $4$.
\item
$\Zmodu[5]=\{1,2,3,4\}$, and $2^2\equiv4$, $2^3\equiv3$, and
  $2^4\equiv1\pmod 5$, so $2$ is a primitive root of $5$.
\item
$\Zmodu[6]=\{1,5\}$, and $5^2\equiv1\pmod6$, so $5$ is a primitive
  root of $6$.
\item
$\Zmodu[7]=\{1,2,3,4,5,6\}$, and we have
  \begin{equation*}
    \begin{array}{|c*{6}{|r}|}\hline
k  &1&2&3&4&5&6\\\hline
2^k&2&4&1& & & \\\hline
3^k&3&2&6&4&5&1\\\hline      
    \end{array}
  \end{equation*}
so $3$ (but not $2$) is a primitive root of $7$.
\item
$\Zmodu[8]=\{1,3,5,7\}$, but $3^2\equiv1$, $5^2\equiv1$, and
  $7^2\equiv1\pmod 8$, so $8$ has no primitive root.
\end{compactenum}
We shall show in \S\ref{sect:comp-roots} that the
following numbers, and only these, have primitive roots:
\begin{compactenum}
  \item
powers of odd primes;
\item
$2$ and $4$;
\item
doubles of powers of odd primes.
\end{compactenum}

\section{Primitive roots of primes}\label{sect:prp}

To prove generally that the number of primitive roots of $p$ is
$\ephi(p-1)$, we shall need the following (attributed to
Joseph-Louis Lagrange,
1736--1813.)%
\index{Lagrange, ---'s Theorem}%
\index{theorem!Lagrange's Th---}

\begin{theorem}[Lagrange\footnote{In the \emph{Disquisitiones Arithmeticae}~\cite[\P\P43--4]{Gauss}, Gauss proves this theorem and traces its original proof to Lagrange in 1768, while mentioning also later proofs by Legendre and Euler.  He says Euler had proved an (unspecified) special case in 1754--5.}]\label{thm:Lagrange-n}%
  Every congruence of the form
  \begin{equation*}
    x^n+a_1x^{n-1}+\dotsb+a_{n-1}x+a_n\equiv0\pmod p
  \end{equation*}
has $n$ solutions or fewer (\emph{modulo} $p$).
\end{theorem}

\begin{proof}
  Use induction.  The claim is easily true when $n=1$.  Suppose it
  is true when $n=k$.  Say the congruence
  \begin{equation}\label{eqn:x^(k+1)}
    x^{k+1}+a_1x^k+\dotsb+a_kx+a_{k+1}\equiv0\pmod p
  \end{equation}
has a solution $b$.  Then we can factorize the left member, and
rewrite the congruence as
\begin{equation*}
  (x-b)\cdot(x^k+c_1x^{k-1}+\dotsb+c_{k-1}x+c_k)\equiv0\pmod p.
\end{equation*}
Any solution to this that is different from $b$ is a solution of
\begin{equation*}
  x^k+c_1x^{k-1}+\dotsb+c_{k-1}x+c_k\equiv0\pmod p.
\end{equation*}
But by inductive hypothesis, there are at most $k$ such solutions.
Therefore~\eqref{eqn:x^(k+1)} has at most $k+1$ solutions.  This
completes the induction and the proof.
\end{proof}

How did we use that $p$ is prime?  We needed
to know that, if $f(x)$ and $g(x)$ are polynomials, and $f(a)\cdot
g(a)\equiv0\pmod p$, then either $f(a)\equiv0\pmod p$, or else
$g(a)\equiv0\pmod p$.  That is, if $mn\equiv0\pmod p$, then either
$m\equiv0\pmod p$ or $n\equiv0\pmod p$.  That is, if $p\divides mn$,
then $p\divides m$ or $p\divides n$.  This fails if $p$ is replaced by
a composite number.

Indeed, the congruence $x^2-1\equiv0\pod8$ has the solutions $1$, $3$, $5$, and $7$ (as shown in \S\ref{sect:groups}).  
Also $x^2-5x\equiv0\pod6$ has solutions $0$ and $5$, but also $2$ and $3$, since $x^2-5x\equiv x^2-5x+6\equiv(x-2)(x-3)$.

\begin{theorem}\label{thm:psi-phi}
If $d\divides p-1$, let $\mpsi_p(d)$ be the number of incongruent
residues \emph{modulo} $p$ that have order $d$.  Then
\begin{equation*}
\mpsi_p(d)=\ephi(d).
\end{equation*}
\end{theorem}

\begin{proof}
Every number prime to $p$ has an order \emph{modulo} $p$, and this
order divides $\ephi(p)$, which is $p-1$; so
\begin{equation*}
  \sum_{d\divides p-1}\mpsi_p(d)=p-1.
\end{equation*}
By Gauss's Theorem (Theorem \ref{thm:Gauss}, p.~\pageref{thm:Gauss}), we have $\sum_{d\divides p-1}\ephi(d)=p-1$;
therefore
\begin{equation}\label{eqn:sum_d|p-1}
  \sum_{d\divides p-1}\mpsi_p(d)=\sum_{d\divides p-1}\ephi(d).
\end{equation}
Hence, to establish $\mpsi_p(d)=\ephi(d)$, it is enough to show that
$\mpsi_p(d)\leq\ephi(d)$ whenever $d\divides p-1$.  Indeed, if we show
this, but $\mpsi_p(e)<\ephi(e)$ for some divisor $e$ of $p-1$, then
\begin{equation*}
  \sum_{d\divides p-1}\mpsi_p(d)
=\sum_{\substack{d\divides p-1\\d\neq e}}\mpsi_p(d)+\mpsi_p(e)
<\sum_{\substack{d\divides p-1\\d\neq e}}\ephi(d)+\ephi(e)
=  \sum_{d\divides p-1}\ephi(d),
\end{equation*}
contradicting~\eqref{eqn:sum_d|p-1}.

If $\mpsi_p(d)=0$, then certainly $\mpsi_p(d)\leq\ephi(d)$.  So suppose
$\mpsi_p(d)\neq0$.  Then $\ord pa=d$ for some $a$.  In particular, $a$
is a solution of the congruence
\begin{equation}\label{eqn:x^n-1}
  x^d-1\equiv0\pmod p.
\end{equation}
But then every power of $a$ is a solution, since $(a^d)^n=(a^n)^d$.
Moreover, if $0< k<\ell\leq d$, then 
\begin{equation*}
  a^k\not\equiv a^{\ell}\pmod p
\end{equation*}
by Theorem~\ref{thm:ord}.  Hence the numbers $a$, $a^2$, \dots, $a^d$
are incongruent solutions to the congruence~\eqref{eqn:x^n-1}.  Moreover, by
Lagrange's Theorem, \ref{thm:Lagrange-n}, every solution is congruent to one of these solutions.
Among these
solutions, those that have order $d$ \emph{modulo} $p$ are just
those powers $a^k$ such that $\gcd(k,d)=1$, again by Theorem~\ref{thm:ord}.  The number of such powers
is just $\ephi(d)$.  Therefore\footnote{Gauss gives just this proof in the \emph{Disquisitiones Arithmeticae}~\cite[\P\P53--4]{Gauss}.} $\mpsi_p(d)=\ephi(d)$, under the
assumption $\mpsi_p(d)>0$; in any case, $\mpsi_p(d)\leq\ephi(d)$.
\end{proof}

\begin{corollary}
  Every prime number has a primitive root.
\end{corollary}

\begin{proof}
$\mpsi_p(p-1)=\ephi(p-1)\geq1$.
\end{proof}

Now we can prove the necessity of (all of) Korselt's Criterion for being a Carmichael number (p.~\pageref{Korselt}):\index{Korselt's Criterion}

\begin{theorem}\label{thm:Car-p-1}
If $n$ is a Carmichael number, and $p\divides n$, then $p-1\divides n-1$.
\end{theorem}

\begin{proof}
Given that $n$ is a Carmichael number and $p\divides n$, we let $a$ be
a primitive root of $p$.  Since $a^n\equiv a\pod n$, we have
$a^n\equiv a\pod p$, and therefore $a^{n-1}\equiv1\pod p$.  But $\ord
pa=p-1$, so $p-1\divides n-1$. 
\end{proof}

So now we know that the Carmichael numbers are \emph{precisely} those
squarefree composite numbers $n$ such that $p\divides n\implies p-1\divides
n-1$.  We shall be able to give another characterization in
\S\ref{sect:comp-roots}, once we know that squares of primes have
primitive roots. 

\section{Discrete logarithms}

  The inverse of the function $\exp$ from $\R$ onto $(0,\infty)$ is
  the logarithm function\footnote{This function can be denoted by
    $\ln$, for \textbf{logarithmus naturalis,} in case one happens to
    want to use $\log$ to denote the inverse of the function $x\mapsto
    10^x$.} $\log$, where as noted in \S\ref{sect:B}, $\log
  x=\int_1^x(\mathrm dt/t)$.  
  
  We can use similar terminology for the inverse of an isomorphism
  $x\mapsto b^x$ from $\Zmod[p-1]$ to $\Zmodu[p]$.  Here $b$ must be a
  primitive root of $p$, and if $b^x\equiv y\pod p$, we can write 
  \begin{equation*}
x\equiv\log_by\pmod{(p-1)}.
\end{equation*}
For example, \emph{modulo} $17$, we have Table~\ref{tab:17}.
\begin{sidewaystable}
  \begin{equation*}
  \begin{array}{*{17}{|r}||l|}\hline
  k&0&1&2& 3& 4&5& 6& 7& 8& 9&10&11&12&13&14&15&\pmod{16}\\\hline
3^k&1&3&9&10&13&5&15&11&16&14& 8& 7& 4&12& 2& 6&\pmod{17}\\\hline
  \end{array}
  \end{equation*}
Rearranged:
\begin{equation*}
  \begin{array}{*{17}{|r}||l|}\hline
3^k&1& 2&3& 4&5& 6& 7& 8&9&10&11&12&13&14&15&16&\pmod{17}\\\hline
  k&0&14&1&12&5&15&11&10&2& 3& 7&13& 4& 9& 6& 8&\pmod{16}\\\hline  
  \end{array}
\end{equation*}
\caption{Powers of $3$ \emph{modulo} $17$}\label{tab:17}
\end{sidewaystable}
If $3^k=\ell$, then we can denote $k$ by $\log_3\ell$.  But we can
think of these numbers as congruence classes:
\begin{equation*}
  3^k\equiv\ell\pmod{17}\iff k\equiv\log_3\ell\pmod{16}.
\end{equation*}
The usual
properties hold:
\begin{equation*}
  \log_3(xy)\equiv\log_3x+\log_3y\pmod{16};
  \qquad\log_3{x^n}\equiv n\log_3x\pmod{16}.  
\end{equation*}
For example, 
\begin{equation*}
\log_3(11\cdot 14)\equiv\log_311+\log_314\equiv7+9\equiv16\equiv0\pmod{16},
\end{equation*}
and therefore $11\cdot14\equiv3^0\equiv1\pmod{17}$.

We can define logarithms for any modulus that has a primitive root; then the base of the logarithms will be a primitive root.  If $b$
is a primitive root of a modulus $n$, and $\gcd(a,n)=1$, then there is some $s$
such that
\begin{equation*}
  b^s\equiv a\pmod n.
\end{equation*}
Then $s$ is unique \emph{modulo} $\ephi(n)$.  Indeed, by Theorem~\ref{thm:ord},
\begin{equation*}
  b^x\equiv b^y\pmod n\iff x\equiv y\pmod{\ephi(n)}.
\end{equation*}
Then $\log_ba$ can be defined as the least non-negative such $s$.

Another application of logarithms, besides multiplication problems, is
congruences of the form
\begin{equation*}
  x^d\equiv a\pmod n,
\end{equation*}
again where $n$ has a primitive root $b$.
The last congruence is then equivalent to
\begin{gather*}
  \log_b(x^d)\equiv\log_ba\pmod{\ephi(n)},\\
d\log_bx\equiv\log_ba\pmod{\ephi(n)}.
\end{gather*}
If this is to have a solution, then we must have
\begin{equation*}
  \gcd(d,\ephi(n))\divides \log_ba.
\end{equation*}
For example, let's work \emph{modulo} $7$:
\begin{equation*}
  \begin{array}{*{7}{|r}|}\hline
  k&0&1&2&3&4&5\\\hline
3^k&1&3&2&6&4&5\\\hline
  \end{array}
\quad
  \begin{array}{*{7}{|r}|}\hline
      \ell&1&2&3&4&5&6\\\hline
\log_3\ell&0&2&1&4&5&3\\\hline    
  \end{array}
\end{equation*}
Then we have, for example,
\begin{equation*}
  x^3\equiv2\pmod7
\iff3\log_3x\equiv2\pmod6,
\end{equation*}
so there is no solution, since $\gcd(3,6)=3$, and $3\ndivides 2$.
But we also have
\begin{align*}
  x^3\equiv6\pmod7
&\iff3\log_3x\equiv3\pmod6\\
&\iff\log_3x\equiv1\pmod2\\
&\iff\log_3x\equiv1,3,5\pmod6\\
&\iff x\equiv 3^1,3^3,3^5\pmod7\\
&\iff x\equiv3,6,5\pmod7.
\end{align*}
We expect no more than $3$ solutions, by Lagrange's Theorem.  Is
there an alternative to using logarithms?  As $6\equiv3^3\pmod7$, we
have
\begin{equation*}
  x^3\equiv6\pmod7\iff x^3\equiv3^3\pmod7;
\end{equation*}
but we cannot conclude from this $x\equiv3\pmod7$.

%\section{December 4, 2007 (Tuesday)}

For congruences \emph{modulo} $11$, we can use the following table:
\begin{equation*}
  \begin{array}{|c|*{10}{|r}||c|}\hline
           k& 0& 1& 2& 3& 4& 5& 6& 7& 8& 9&\log_2\ell\pod{10}\\\hline
2^k\pod{11}&1 & 2& 4&-3& 5&-1&-2&-4& 3&-5&\ell\\\hline    
  \end{array}
\end{equation*}
We have then
\begin{align*}
  4x^{15}\equiv7\pmod{11}
&\iff4x^5\equiv7\pmod{11}\\
&\iff\log_2(4x^5)\equiv\log_27\pmod{10}\\
&\iff\log_24+5\log_2x\equiv\log_27\pmod{10}\\
&\iff2+5\log_2x\equiv7\pmod{10}\\
&\iff5\log_2x\equiv5\pmod{10}\\
&\iff\log_2x\equiv1\pmod{2}\\
&\iff\log_2x\equiv1,3,5,7,9\pmod{10}\\
&\iff x\equiv 2^1,2^3,2^5,2^7,2^9\pmod{11}\\
&\iff x\equiv2,8,10,7,6\pmod{11}.
\end{align*}
Why are there five solutions?

\begin{theorem}
  Suppose $n$ has a primitive root, $\gcd(a,n)=1$, and
\begin{equation*}
d=\gcd(k,\ephi(n)).  
\end{equation*}
The 
following are equivalent:
  \begin{enumerate}
    \item\label{item:x^k}
The congruence 
\begin{equation}\label{eqn:cong}
x^k\equiv a\pmod n
\end{equation}
is soluble.
\item\label{item:d}
The congruence~\eqref{eqn:cong} has $d$ solutions.
\item\label{item:a^phi}
$a^{\ephi(n)/d}\equiv1\pmod n$.
  \end{enumerate}
\end{theorem}

\begin{proof}
  The following are equivalent:
  \begin{gather*}
    x^k\equiv a\text{ is soluble }\pmod n;\\
k\log x\equiv \log a\text{ is soluble }\pmod{\ephi(n)};\\
d\divides\log a;\\
\ephi(n)\divides\frac{\ephi(n)}d\cdot\log a;
\end{gather*}
\begin{gather*}
\frac{\ephi(n)}d\cdot\log a\equiv0\pmod{\ephi(n)};\\
\log(a^{\ephi(n)/d})\equiv0\pmod{\ephi(n)};\\
a^{\ephi(n)/d}\equiv1\pmod n.
  \end{gather*}
Thus~\eqref{item:x^k}$\Leftrightarrow$\eqref{item:a^phi}.
Trivially,~\eqref{item:d}$\Rightarrow$\eqref{item:x^k}.  Finally,
assume~\eqref{item:x^k}, so that $d\divides\log a$, as above.  Letting $r$ be the base of the logarithms, we have
\begin{align*}
  x^k\equiv a\pmod n
&\iff k\log x\equiv\log a\pmod{\ephi(n)}\\
&\iff\frac kd\cdot\log x\equiv\frac{\log a}d\pmod{\frac{\ephi(n)}d}\\
&\iff\log x\equiv\frac{\log a}k\pmod{\frac{\ephi(n)}d}\\
&\iff\begin{aligned}[t]
\log x&\equiv\frac{\log a}k+\frac{\ephi(n)}d\cdot
  j\pmod{\ephi(n)},\\
& \text{ where }j\in\{0,1,\dots,d-1\}
     \end{aligned}\\
&\iff
  \begin{aligned}[t]
    x&\equiv r^{(\log a)/k}\cdot(r^{\ephi(n)/d})^j\pmod n,\\
&\text{ where }j\in\{0,1,\dots,d-1\}.
  \end{aligned}
\end{align*}
Finally, these $d$ solutions are incongruent.  Indeed, since $\ord nr=\ephi(n)$, the powers $(r^{\ephi(n)/d})^j$ are incongruent; and $r^{(\log a)/k}$ is invertible.
\end{proof}

\section{Composite numbers with primitive roots}\label{sect:comp-roots}

We know that all primes have primitive roots.  Now we show that the
numbers with primitive roots are precisely:
\begin{align*}
&2,&&4,&&p^s,&&2\cdot p^s,
\end{align*}
where $p$ is an odd prime, and $s\geq1$.  We shall first show that the
numbers \emph{not} on this list do \emph{not} have primitive roots:

\begin{lemma}
  If $k>2$, then $2\divides\ephi(k)$.
\end{lemma}

\begin{proof}
  Suppose $k>2$.  Then either $k=2^s$, where $s>1$, or else
  $k=p^s\cdot m$ for some odd prime $p$, where $s>0$ and
  $\gcd(p,m)=1$.  In the first case, $\ephi(k)=2^s-2^{s-1}=2^{s-1}$,
  which is even.  In the second case, $\ephi(k)=\ephi(p^s)\cdot\ephi(m)$,
  which is even, since $\ephi(p^s)=p^s-p^{s-1}$, the difference of two
  odd numbers.
\end{proof}

\begin{theorem}
  If $m$ and $n$ are co-prime, both greater than $2$, then $mn$ has no
  primitive root.
\end{theorem}

\begin{proof}
  Suppose $\gcd(a,mn)=1$.  (This is the only possibility for a
  primitive root.)  Then $a$ is prime to $m$ and $n$, so
  \begin{align*}
    a^{\ephi(m)}&\equiv 1\pmod m,&
    a^{\ephi(n)}&\equiv 1\pmod n,
\end{align*}
Therefore $a^{\lcm(\ephi(m),\ephi(n))}\equiv 1$ \emph{modulo} $m$ and $n$, and hence \emph{modulo} $\lcm(m,n)$, which is $mn$.
By the lemma, $2$ divides both $\ephi(m)$ and $\ephi(n)$, so
\begin{equation*}
  \lcm(\ephi(m),\ephi(n))\divides\frac{\ephi(m)\ephi(n)}2,
\end{equation*}
that is, $\lcm(\ephi(m),\ephi(n))\divides\ephi(mn)/2$.  Therefore
\begin{equation*}
  \ord{mn}a\leq\frac{\ephi(mn)}2,
\end{equation*}
so $a$ is not a primitive root of $mn$.
\end{proof}

\begin{theorem}
  If $k\geq1$, then $2^{2+k}$ has no primitive root.
\end{theorem}

\begin{proof}
  Any primitive root of $2^{2+k}$ must be odd.  Let $a$ be odd.  We
  shall show by induction that
  \begin{equation*}
    a^{\ephi(2^{2+k})/2}\equiv1\pmod{2^{2+k}}.
  \end{equation*}
Since $\ephi(2^{2+k})=2^{2+k}-2^{1+k}=2^{1+k}$, it is enough to show
\begin{equation*}
  a^{2^k}\equiv1\pmod{2^{2+k}}.
\end{equation*}
The claim is true when $k=1$, since $a^2\equiv1\pmod8$ for all odd
numbers $a$.  Suppose the claim is true when $k$ is \emph{some} positive integer $\ell$, that is,
\begin{equation*}
  a^{2^{\ell}}\equiv1\pmod{2^{2+\ell}}.
\end{equation*}
This means
\begin{equation*}
  a^{2^{\ell}}=1+2^{2+\ell}\cdot m
\end{equation*}
for some $m$.  Now square:
\begin{align*}
  a^{2^{1+\ell}}
=(a^{2^{\ell}})^2
=(1+2^{2+\ell}\cdot m)^2
=&1+2^{3+\ell}\cdot m+2^{4+2\ell}\cdot m^2\\
=&1+2^{3+\ell}\cdot m\cdot(1+2^{1+\ell}\cdot m).
\end{align*}
Hence $a^{2^{1+\ell}}\equiv1\pmod{2^{3+\ell}}$,
so our claim is true when $k=\ell+1$.
\end{proof}

Now for the positive results.  These will use the following.

\begin{lemma}
  Let $r$ be a primitive root of $p$, and $k>0$.  Then
  \begin{equation*}
    \ord{p^k}r=(p-1)p^{\ell}
  \end{equation*}
for some $\ell$, where $0\leq\ell<k$.
\end{lemma}

\begin{proof}
  Let $\ord{p^k}r=n$.  Then $n\divides\ephi(p^k)$.  But
  $\ephi(p^k)=p^k-p^{k-1}=(p-1)\cdot p^{k-1}$.  Thus,
  \begin{equation*}
    n\divides(p-1)\cdot p^{k-1}.
  \end{equation*}
Also, $r^n\equiv1\pmod{p^k}$, so $r^n\equiv1\pmod p$, which means
$\ord pr\divides n$.  But $r$ is a primitive root of $p$, so $\ord
pr=\ephi(p)=p-1$.  Therefore
\begin{equation*}
  p-1\divides n.
\end{equation*}
The claim now follows.
\end{proof}

\begin{theorem}\label{thm:p^2}
  $p^2$ has a primitive root.  In fact, if $r$ is a primitive root of
  $p$, then either $r$ or $r+p$ is a primitive root of $p^2$.
\end{theorem}

\begin{proof}
  Let $r$ be a primitive root of $p$.  If $r$ is a primitive root of
  $p^2$, then we are done.  Suppose $r$ is not a primitive root of
  $p^2$.  Then $\ord{p^2}r=p-1$, by the last lemma.  Hence,
  \emph{modulo} $p^2$, we have
  \begin{align*}
    (r+p)^{p-1}
&\equiv r^{p-1}+(p-1)\cdot r^{p-2}\cdot p+\binom{p-1}2\cdot r^{p-3}\cdot
    p^2+\dotsb\\
&\equiv r^{p-1}+(p-1)\cdot r^{p-2}\cdot p\\
&\equiv 1+(p-1)\cdot r^{p-2}\cdot p\\
&\equiv 1-r^{p-2}\cdot p\\
&\not\equiv1,
  \end{align*}
since $p\ndivides r$.  (Note that this argument holds even if $p=2$.)
Hence $\ord{p^2}{r+p}\neq p-1$, so by the lemma, the order must be
$(p-1)\cdot p$, that is, $\ephi(p^2)$.  This means $r$ is a primitive
root of $p^2$.
\end{proof}

Alternatively, if $r$ is a primitive root of $p$, then either $r$ or
$r+rp$ is a primitive root of $p^2$.  For, $\ord{p^2}{1+p}=p$, simply
because the order is not $1$, but
\begin{equation*}
  (1+p)^p
=\sum_{j=0}^p\binom pjp^j
=1+p^2+\sum_{j=2}^p\binom pjp^j
\equiv1\pmod{p^2}.
\end{equation*}
Then $r$ and $1+p$ have orders $p-1$ and $p$ respectively,
\emph{modulo} $p^2$, so their product must have order $p(p-1)$ (see Exercise~\ref{xca:ord-prod}).

Now we can give another characterization of Carmichael numbers (which were defined on page~\pageref{Carmichael} as those composite numbers $n$ such that $a^n\equiv a\pod n$ for all $a$):

\begin{theorem}\label{thm:Car-char}
A composite  number $n$ is a Carmichael number if and only if, whenever
$\gcd(a,n)=1$, we have 
\begin{equation}\label{eqn:an-1}
a^{n-1}\equiv1\pmod n.
\end{equation}
\end{theorem}

\begin{proof}
Suppose $n$ is a Carmichael number and $\gcd(a,n)=1$.  If $p\divides n$, then $a^n\equiv a\pmod p$, so $a^{n-1}\equiv1\pod p$.  Since $n$ is squarefree by Theorem~\ref{thm:Car-sqf} (p.~\pageref{thm:Car-sqf}), we have that $n$ is the least common multiple of its prime divisors, and therefore~\eqref{eqn:an-1} holds.

Conversely, suppose~\eqref{eqn:an-1} holds whenever $\gcd(a,n)=1$.  The proof of Theorem~\ref{thm:Car-p-1} (p.~\pageref{thm:Car-p-1}) still works to show $p\divides n\implies p-1\divides n-1$.  Also, $n$ is squarefree.  Indeed, suppose $p^2\divides n$.  But $p^2$ has a primitive root $a$, and by the Chinese Remainder Theorem, we may assume $\gcd(a,n)=1$.  Then $a^{n-1}\equiv 1$ \emph{modulo} $n$ and therefore \emph{modulo} $p^2$, so $\ephi(p^2)\divides n-1$.  But $p\divides\ephi(p^2)$, so $p\divides n-1$, which is absurd.  Therefore $n$ must be squarefree, so by Theorem~\ref{thm:Carmichael}, it is a Carmichael number.
\end{proof}

\begin{theorem}\label{thm:p^n}
  All odd prime powers (that is, all powers of odd primes) have
  primitive roots.  In fact, a primitive root of $p^2$ is a primitive
  root of every power $p^{1+k}$, where $p$ is odd.
\end{theorem}

\begin{proof}
Assume $p$ is an odd prime.
  We know $p$ and $p^2$ have primitive roots.  Let $r$ be a primitive
  root of $p^2$.  We prove by induction that $r$ is a primitive root
  of $p^{1+k}$.  The claim is trivially true when $k=1$.  Suppose it
  is true when $k$ is some positive integer $\ell$.  This means
  \begin{equation*}
    \ord{p^{1+\ell}}r=(p-1)\cdot p^{\ell}.
  \end{equation*}
In particular,
\begin{equation*}
  r^{(p-1)\cdot p^{\ell-1}}\not\equiv1\pmod{p^{1+\ell}}.
\end{equation*}
However, since $\ephi(p^{\ell})=(p-1)\cdot p^{\ell-1}$, we have
\begin{equation*}
  r^{(p-1)\cdot p^{\ell-1}}\equiv 1\pmod{p^{\ell}}.
\end{equation*}
We can now conclude
\begin{equation*}
  r^{(p-1)\cdot p^{\ell-1}}=1+p^{\ell}\cdot m
\end{equation*}
for some $m$ that is indivisible by $p$.  Now raise both sides of this
equation to the power $p$:
\begin{align*}
r^{(p-1)\cdot p^{\ell}}
%&=(1+p^{\ell}\cdot m)^p\\
%&=1+p\cdot p^{\ell}\cdot m+\binom p2\cdot(p^{\ell}\cdot m)^2+ \binom
%p3\cdot(p^{\ell}\cdot m)^3+\dotsb\\
&=1+p^{1+\ell}\cdot m+\binom p2\cdot p^{2\ell}\cdot m^2+ \binom
p3\cdot p^{3\ell}\cdot m^3+\dotsb
\end{align*}
Since $p>2$ and $\ell\geq1$, so that $p\divides\binom p2$ and $2\ell\geq1+\ell$, we have
\begin{equation*}
  r^{(p-1)\cdot p^{\ell}}
\equiv1+p^{1+\ell}\cdot m
\not\equiv 1\pmod{p^{2+\ell}}.
\end{equation*}
Therefore we must have
\begin{equation*}
  \ord{p^{2+\ell}}r=(p-1)\cdot p^{1+\ell}=\ephi(p^{2+\ell}),
\end{equation*}
which means $r$ is a primitive root of $p^{2+\ell}$.
\end{proof}

For example, $3$ has the primitive root $2$, since
$2\not\equiv1\pmod3$, but $2^2\equiv1\pmod3$.  Hence, either $2$ or
$5$ is a primitive root of $9$, by Theorem~\ref{thm:p^2}.  In fact, both are.  Using
$5\equiv-4\pmod9$, we have:
\begin{equation*}
  \begin{array}{|c|r|r|}\hline
    k&2&3\\\hline
2^k\pmod9&4&-1\\\hline
(-4)^k\pmod9&-2&-1\\\hline
  \end{array},
\end{equation*}
so the order of $2$ and $-4$ is not $2$ or $3$ \emph{modulo} $9$; hence it must be $6$, since this is $\ephi(9)$.
By Theorem~\ref{thm:p^n} then, $27$ has $6$ non-congruent primitive roots, each congruent \emph{modulo} $9$ to one of $2$ and $-4$; those roots then are $-13$, $-7$, $-4$, $2$, $5$, and $11$.  Indeed, $\ephi(27)=18$ and we have
\begin{equation*}
  \begin{array}{|c|*{7}{|r}|r|}\hline
               k&  2&  3&  4&  5&  6&  7&  8& 9\\\hline
(-13)^k\pmod{27}&  7&-10& -5& 11& -8& -4& -2&-1\\\hline
 (-4)^k\pmod{27}&-11&-10& 13&  2& -8&  5&  7&-1\\\hline
    5^k\pmod{27}& -2&-10&  4& -7& -8&-13&-11&-1\\\hline
 (-7)^k\pmod{27}& -5&  8& -2& 13& 10&-11&  4&-1\\\hline
    2^k\pmod{27}&  4&  8&-11&  5& 10& -7& 13&-1\\\hline
   11^k\pmod{27}& 13&  8&  7& -4& 10&  2& -5&-1\\\hline
  \end{array}
\end{equation*}
But does $18$ have a primitive root?  The numbers $2$ and $-4$ cannot be primitive roots of $18$, since they are not prime to it;
but $\ephi(18)=6$ and we have
\begin{equation*}
  \begin{array}{|c|r|r|}\hline
    k&2&3\\\hline
(-7)^k\pmod{18}&-5&-1\\\hline
5^k\pmod{18}&7&-1\\\hline
  \end{array}
\end{equation*}
so $-7$ and $5$ are primitive roots of $18$.

\begin{theorem}
  If $p$ is an odd prime, and $r$ is a primitive root of $p^s$, then
  either $r$ or $r+p^s$ is a primitive root of $2p^s$---whichever one
  is odd.
\end{theorem}

\begin{proof}
Let $r$ be an odd primitive root of $p^s$.  Then $\gcd(r,2p^s)=1$, so $r$ has an order \emph{modulo} $2p^s$.  Since also $\ord{p^s}r=\ephi(p^s)$, we have
\begin{equation*}
\ephi(p^s)\divides\ord{2p^s}r.
\end{equation*}
But also $\ord{2p^s}r\divides\ephi(2p^s)$; and $\ephi(p^s)=\ephi(2p^s)$.  Hence $\ord{2p^s}r=\ephi(2p^s)$.
\end{proof}

\chapter{Quadratic reciprocity}\label{ch:qr}

\section{Quadratic equations}%\asterism{}

If $p\ndivides a$, then the linear congruence
\begin{equation*}
ax+b\equiv 0\pmod p
\end{equation*}
is always soluble.  The next step is to consider quadratic congruences,
\begin{equation}\label{eqn:gen-quad}
ax^2+bx+c\equiv0\pmod p,
\end{equation}
where still $p\ndivides a$.
For example, let us try to solve
\begin{equation}\label{eqn:2,-8,9}
  2x^2-8x+9\equiv0\pmod{11}.
\end{equation}
We cannot factorize the polynomial $2x^2-8x+9$ over $\Z$ (or even $\R$), since $8^2-4\cdot 2\cdot9=-8$, which is not a square (or even positive).  However, after replacing coefficients with residues \emph{modulo} $11$, we may be able to factorize.  Still, a better method of solution is \textbf{completing the square.}
We have, \emph{modulo} $11$,
\begin{align*}
  2x^2-8x+9\equiv0
  &\iff x^2-4x\equiv-\frac92\\
  &\iff x^2-4x+4\equiv 4-\frac92\\
&\iff(x-2)^2\equiv-\frac12\equiv\frac{10}2\equiv 5.
\end{align*}
(We did not need to compute the inverse of $2$ \emph{modulo} $11$, although we may see easily enough that it is $6$.)
If $5$ is a square \emph{modulo} $11$, then~\eqref{eqn:2,-8,9} has a solution; if
not, not.  One way to settle the question is by hunting: we have $5\equiv16\equiv4^2$, so 
\begin{align*}
    2x^2-8x+9\equiv0
&\iff(x-2)^2\equiv4^2\\
&\iff x-2\equiv\pm4\\
&\iff x\equiv 2\pm 4\equiv6\text{ or }9.
\end{align*}
Note that we have used Lagrange's Theorem (Theorem~\ref{thm:Lagrange-n}) to conclude that the congruence has exactly two solutions.
We now know
\begin{equation*}
2x^2-8x+9\equiv2(x-6)(x+2)\equiv2(x-6)(x-9).
\end{equation*}
Possibly, with some cleverness, we might have been able to see this from the beginning.
But suppose we want to solve
\begin{equation}\label{eqn:1,-4,2}
x^2-4x-3\equiv0\pmod{11}.
\end{equation}
We find
\begin{align*}
    x^2-4x-3\equiv0
&\iff x^2-4x+4\equiv 7\iff(x-2)^2\equiv7.
\end{align*}
Now, if $7\equiv k^2$, then we may assume $-5\leq k<5$.  The positive integers that are congruent to $7$ and are less than or equal to $5^2$ are $7$ and $18$,
and neither of them is a square.  Therefore the congruence~\eqref{eqn:1,-4,2} is insoluble.  In particular, the polynomial $x^2-4x-3$ has no factorization over $\Zmod[11]$; so it would have been futile to hunt for a factorization.  Completing the square is the way to go.

Another way to see that $7$ has no square root \emph{modulo} $11$ is to note first that $2$ is a primitive root of $11$.  Since $11\ndivides7$, but $7\equiv-4$, the following table shows that $7$ is not a square \emph{modulo} $11$, because $-4$ does not appear as an even power of $2$ (that is, a power of $2$ with even exponent):
\begin{equation*}
\begin{array}{|r|*5{|r}||l|}\hline
k     &0&1&2& 3&4&\operatorname{mod}5\\\hline
2^{2k}&1&4&5&-2&3&\operatorname{mod}11\\\hline
\end{array}
\end{equation*}
Indeed,
$2^m\equiv2^n\pod{11}$ if and only if $m\equiv n\pod{10}$, by Theorem~\ref{thm:ord}.  Since $10$ is even, the only numbers prime to $11$ that are squares \emph{modulo} $11$ are the even powers of $2$.

Considering the general quadratic congruence~\eqref{eqn:gen-quad}, and assuming $p$ is odd (so that $2$ is invertible \emph{modulo} $p$), we have
\begin{align*}
ax^2+bx+c\equiv 0
&\iff x^2+\frac bax\equiv-\frac ca\\
&\iff x^2+\frac bax+\frac{b^2}{4a^2}\equiv\frac{b^2}{4a^2}-\frac ca\\
&\iff\Bigl(x+\frac b{2a}\Bigr)^2\equiv \frac{b^2-4ac}{(2a)^2},
\end{align*}
just as when one derives the usual quadratic formula.  Working over $\R$, one knows that the equation $ax^2+bx+c=0$ (where $a\neq0$) is soluble if and only if $b^2-4ac\geq0$.  Another way to express this condition is that the discriminant $b^2-4ac$ must be a \emph{square} in $\R$.  It is the same \emph{modulo} $p$: the congruence~\eqref{eqn:gen-quad} is soluble if and only if $b^2-4ac$ is a square \emph{modulo} $p$.  In the terminology introduced in \S\ref{sect:Wilson}, this condition is that $b^2-4ac$ either is divisible by $p$ or is a \textbf{quadratic residue}%
\index{quadratic!--- residue}%
\index{residue!quadratic ---}
of $p$.  

As we have just observed, 
assuming $p\ndivides b^2-4ac$,
one way to tell whether  $b^2-4ac$ is a quadratic residue is first to find its least positive residue, say $m$, and then to check whether any of the residues $m+kp$ is a square, where
$0\leq k$ and also
$m+kp\leq((p-1)/2)^2$,
that is, 
\begin{equation*}
m+kp\leq\upvarpi^2, 
\end{equation*}
in the notation of~\eqref{eqn:varpi} in \S\ref{sect:Wilson} (p.~\pageref{eqn:varpi}).  So it is sufficient to check when $0\leq k<\upvarpi/2$.  This could still be a lot of work if $p$ is large.

We shall develop a way to test for quadratic residues that is more practical as well as theoretically interesting.

\section{Quadratic residues}\label{sect:qr}

We have just seen that the quadratic residues of $11$ are the even powers of $2$, namely $1$, $4$, $5$, $-2$, and $3$, or 
rather $1$, $4$, $5$, $9$, and $3$.
The
\textbf{quadratic non-residues}%
\index{quadratic!--- non-residue}%
\index{residue!quadratic non-{}---}%
\index{non-residue, quadratic}
are the odd powers:
$2$, $-3$, $-1$, $-4$, and $-5$, that is,
 $2$, $8$, $10$, $7$, and $6$.  So
there are five residues, and five non-residues.  (The general formulation of this equality will be Theorem~\ref{thm:eq}.)

\begin{theorem}[Euler's Criterion]%
\index{Euler!---'s Criterion}%
\index{theorem!Euler's Criterion}
%\sloppy
  Let $p$ be an odd prime, and $\gcd(a,p)=1$.  Then $a$ is a quadratic
  residue of $p$ if and only if
  \begin{equation}\label{eqn:1}
    a^{(p-1)/2}\equiv a^{\upvarpi}\equiv1\pmod p,
  \end{equation}
and $a$ is a quadratic
  non-residue of $p$ if and only if
  \begin{equation}\label{eqn:-1}
    a^{\upvarpi}\equiv-1\pmod p.
  \end{equation}
\end{theorem}

\begin{proof}
  Let $r$ be a primitive root of $p$.  Any solution of $x^2\equiv a\pmod p$ is $r^k$ for some $k$, and then
  \begin{equation*}
    a^{\upvarpi}\equiv(r^{2k})^{\upvarpi}\equiv(r^k)^{p-1}\equiv1\pmod{p}
  \end{equation*}
by Fermat's Theorem (Theorem~\ref{thm:Fermat}).

In any case, $a\equiv r^{\ell}\pmod p$ for some $\ell$.  Suppose
$a^{\upvarpi}\equiv1\pmod p$.  Then
\begin{equation*}
  1\equiv(r^{\ell})^{\upvarpi}\equiv r^{\ell\cdot\upvarpi}\pmod p,
\end{equation*}
so $\ord pr\divides \ell\cdot\upvarpi$, that is,
\begin{equation*}
  p-1\divides\ell\cdot\upvarpi.
\end{equation*}
Therefore $\ell/2$ is an integer, that is, $\ell$ is even.  Say
$\ell=2m$.  Then $a\equiv r^{2m}\equiv(r^m)^2\pmod p$.

Since
$a^{p-1}\equiv1\pmod p$, by Fermat's Theorem, we have $a^{\upvarpi}\equiv\pm1\pmod p$, so the second part of the claim follows.
\end{proof}

Another way to prove the theorem arises from the following considerations, which also lead to the alternative proof of Wilson's Theorem promised at the end of \S\ref{sect:Wilson} (p.~\pageref{Wilson}).  Suppose $a$ is a
quadratic non-residue of $p$.  If $b\in\{1,\dots,p-1\}$, then the
congruence
\begin{equation*}
  bx\equiv a\pmod p
\end{equation*}
has a unique solution in $\{1,\dots,p-1\}$, and we denote the
solution by $a/b$.  Then $b\neq a/b$, since $a$ is not a quadratic
residue of $p$.
Now we define a sequence $(b_1,\dots,b_{\upvarpi})$
recursively.  If $b_k$ has
been chosen when $k<\ell<\upvarpi$, then let 
$b_{\ell}$ be the least element of
$\{1,\dots,p-1\}\setminus\{b_1,a/b_1,\dots,b_{\ell-1},a/b_{\ell-1}\}$.  Note then that $a/b_{\ell}$ must be in this set too, since otherwise $a/b_{\ell}=b_k$ for some $k$ such that $k<\ell$, and then $b_{\ell}=a/b_k$.
We now have
\begin{equation*}
  \Bigl\{b_1,\frac a{b_1},\dots,b_{\upvarpi},\frac
  a{b_{\upvarpi}}\Bigr\}=\{1,\dots,p-1\}.
\end{equation*}
Now multiply everything together:
\begin{equation}\label{eqn:p-1}
  a^{\upvarpi}\equiv(p-1)!\pmod p.
\end{equation}
If we have Wilson's Theorem (Theorem~\ref{thm:Wilson}, p.~\pageref{thm:Wilson}), we can conclude~\eqref{eqn:-1}.  Conversely, this and~\eqref{eqn:p-1} give us Wilson's Theorem.

Now suppose $a$ is a quadratic residue of $p$.  We choose the $b_k$ as
before, except this time let $b_1$ be the least positive solution of
$x^2\equiv a\pmod p$, and replace $a/b_1$ with the next least positive
solution, which is $p-b_1$.  We have then
\begin{equation*}
  \Bigl\{b_1,p-b_1,b_2,\frac a{b_2},\dots,b_{\upvarpi},\frac
  a{b_{\upvarpi}}\Bigr\}=\{1,\dots,p-1\},
\end{equation*}
and multiplication now gives us
\begin{equation*}
-a^{\upvarpi}\equiv(p-1)!\pmod p.
\end{equation*}
Now~\eqref{eqn:1} is equivalent to Wilson's Theorem.  Since we do have~\eqref{eqn:1} when $a=1$, Wilson's Theorem holds.\footnote{This is the first proof of Wilson's Theorem given by Hardy and Wright~\cite[p.~68]{MR568909}.}

\section{The Legendre symbol}

Again, $p$ is an odd prime, and $p\ndivides a$.  
Euler's Criterion can be abbreviated by
\begin{equation}\label{eqn:Leg-comp}
  a^{\upvarpi}\equiv\ls ap\pmod p,
\end{equation}
where $(a/p)$ is called the
\textbf{Legendre symbol.}%
\index{Legendre}%
\index{Legendre!--- symbol}%
\footnote{Named for
Adrien-Marie Legendre, 1752--1833.}
More precisely, we have
\begin{equation*}
  \ls ap=
  \begin{cases}
    1,&\text{ if $a$ is a quadratic residue of $p$};\\
-1,&\text{ if $a$ is a quadratic non-residue of $p$}.
  \end{cases}
\end{equation*}

\begin{theorem}\label{thm:ls}
If $p$ is an odd prime not dividing $a$ or $b$, then:
\begin{gather}\notag
\ls{a\pm kp}p=\ls ap,\\\notag
\ls{a^2}p=1,\\\notag
\ls1p=1,\\\label{eqn:cases}
\ls{-1}p=
  \begin{cases}
    1,&\text{ if }p\equiv 1\pmod 4,\\
-1,&\text{ if }p\equiv3\pmod 4,
  \end{cases}\\\notag
  \ls{ab}p=\ls ap\ls bp.
\end{gather}
\end{theorem}

\begin{proof}
The first three equations follow immediately from the definitions; the others, from Euler's Criterion as summarized by~\eqref{eqn:Leg-comp}.  (Also~\eqref{eqn:cases}
is equivalent to Theorem~\ref{thm:Wilson-app} on page~\pageref{thm:Wilson-app}.)
\end{proof}

With these properties, we can calculate many Legendre
symbols.  For example, 
\begin{gather*}
  \ls{50}{19}=\ls{12}{19}=\ls2{19}^2\ls3{19}=\ls3{19},\\
3^{\upvarpi}\equiv 3^9\equiv 3^8\cdot3\equiv
9^4\cdot 3\equiv 81^2\cdot 3\equiv5^2\cdot 3\equiv6\cdot3\equiv
18\equiv-1\mod{19}, 
\end{gather*}
so $(50/19)=-1$, which means the congruence $x^2\equiv50\pmod{19}$ has
no solution.

We may ask whether~\eqref{eqn:cases} has a simpler form, owing to the existence of only finitely many $p$ satisfying one of the cases.  This possibility fails.

\begin{theorem}
  There are infinitely many primes $p$ such that $p\equiv3\pmod
  4$.
\end{theorem}

\begin{proof}
  Suppose $(q_1,q_2,\dots,q_n)$ is a list of primes.  We shall prove
  that there is a prime $p$, not on this list, such that
  $p\equiv3\pmod 4$.  Let
  \begin{equation*}
    s=4q_1\cdot q_2\dotsm q_n-1.
  \end{equation*}
Then $s\equiv3\pmod 4$.  Then $s$ must have a prime factor $p$ such
that $p\equiv 3\pmod 4$.  Indeed, if all prime factors of $s$ are
congruent to $1$, then so must $s$ be.  But $p$ is not any of the $q_k$.
\end{proof}

A similar argument \emph{fails} to show that there are infinitely many primes $p$ such that $p\equiv1\pod4$.  For, even though $4q_1\cdot q_2\dotsm q_n-3\equiv1\pod4$, possibly all prime factors of $4q_1\cdot q_2\dotsm q_n-3$ are congruent to $3$.  (This is the case when $n=1$ and $q_1=3$, for example.)  Nonetheless, we still have:

\begin{theorem}
  There are infinitely many primes $p$ such that $p\equiv1\pmod
  4$.  
\end{theorem}

\begin{proof}
  Suppose $(q_1,q_2,\dots,q_n)$ is a list of primes.  We shall prove
  that there is a prime $p$, not on this list, such that
  $p\equiv1\pmod 4$.  Let
  \begin{equation*}
    s=2q_1\cdot q_2\dotsm q_n.
  \end{equation*}
Then $s^2+1$ is odd, so it is divisible by some odd prime $p$, which is distinct from each of the $q_k$.
This means $s^2+1\equiv0\pmod p$, so
$s$ is a solution of the congruence $x^2\equiv-1\pmod
p$.  Then $(-1/p)=1$, so $p\equiv 1\pmod 4$,
by~\eqref{eqn:cases} above. 
\end{proof}

From the rules so far, we obtain the following table:
\begin{equation*}
  \begin{array}{|c*{12}{|r}|}\hline
     a&1&2&3&4&5&6&7&8&9&10&11&12\\\hline
(a/13)&1& &1&1& & & & &1& 1&  & 1\\\hline
  \end{array}
\end{equation*}
Indeed, under the squares $1$, $4$, and $9$, we put $1$.  Also
$4^2=16\equiv3$, so $(3/13)=1$.  Finally, by~\eqref{eqn:cases}, we have $(-1/13)=1$; or we can just compute this: $(-1)^{\upvarpi}=(-1)^6=1$.  Hence the table will be symmetric; that is, $(13-a/13)=(-a/13)=(-1/13)\cdot(a/13)=(a/13)$.
In particular, $(10/13)=1$ and $(12/13)=1$.  So
half of the slots have been filled with $1$.  The other half must take
$-1$, by the following.

\begin{theorem}\label{thm:eq}
For all odd primes $p$,
\begin{equation*}
\sum_{k=1}^{p-1}\ls kp=0.
\end{equation*}
\end{theorem}

\begin{proof}
  Let $r$ be a primitive root of $p$.  Then
  \begin{equation*}
    \sum_{k=1}^{p-1}\ls kp
=\sum_{k=1}^{p-1}\ls{r^k}p
=\sum_{k=1}^{p-1}\ls rp^k.
%=\sum_{k=1}^{p-1}(-1)^k=0,
  \end{equation*}
But $(r/p)=-1$, because $r$ is a primitive root and therefore
$r^{\upvarpi}\equiv-1\pmod p$.  Hence
  \begin{equation*}
    \sum_{k=1}^{p-1}\ls kp
%=\sum_{k=1}^{p-1}\ls{r^k}p
%=\sum_{k=1}^{p-1}\ls rp^k.
=\sum_{k=1}^{p-1}(-1)^k=0.\qedhere
  \end{equation*}
\end{proof}

So now we can complete the table above:
\begin{equation*}
  \begin{array}{|c*{12}{|r}|}\hline
     a&1& 2&3&4& 5& 6& 7& 8&9&10&11&12\\\hline
(a/13)&1&-1&1&1&-1&-1&-1&-1&1& 1&-1& 1\\\hline
  \end{array}
\end{equation*}

\section{Gauss's Lemma}

Again, $p$ is an odd prime.  Given an integer $k$, we have
\begin{gather*}
\Bigl[\frac kp\Bigr]\leq\frac kp<\Bigl[\frac kp\Bigr]+1,\\
p\cdot\Bigl[\frac kp\Bigr]\leq k<p\cdot\Bigl[\frac kp\Bigr]+p,\\
0\leq k-p\cdot\Bigl[\frac kp\Bigr]<p.
\end{gather*}
Thus the least positive residue of $k$ \emph{modulo} $p$ is
$k-p\cdot[k/p]$.  For use in some proofs, let us define 
\begin{equation}\label{eqn:kp}
\size k_p=\begin{cases}
k-p\cdot[k/p],&\text{ if this is less than $p/2$,}\\%}k-p\cdot[k/p]<p/2;\\
p-(k-p\cdot[k/p]),&\text{ otherwise. }%k-p\cdot[k/p]>p/2.	
\end{cases}
\end{equation}
Then $0\leq\size k_p<p/2$, and $\size k_p$ is the least distance between $k$ and a multiple of $p$.  
%Recall also the notation $\upvarpi=(p-1)/2$ from \S\ref{sect:Wilson}.

\begin{theorem}[Gauss's Lemma]\label{thm:GL}%
\index{theorem!Gauss's Lemma}%
\index{Gauss!---'s Lemma}
  Let $p$ be an odd prime, and $\gcd(a,p)=1$.  Then
  \begin{equation*}
    \ls ap=(-1)^n,
  \end{equation*}
where $n$ is the number of elements $k$ of the set
\begin{equation*}
  \bigl\{a,2a,3a,\dots,\upvarpi a\bigr\}
\end{equation*}
%such that $k-p\cdot[k/p]>p/2$.
whose least positive residues exceed $p/2$.
\end{theorem}

\begin{proof}%[Proof of Gauss's Lemma]
If $\size{ka}_p=\size{\ell a}_p$, then $ka\equiv\pm\ell a\pod p$, so $k=\pm\ell\pod p$.  Therefore
\begin{equation*}
\{1,2,\dots,\upvarpi\}=\{\size a_p,\size{2a}_p,\dots,\size{\upvarpi a}_p\},
\end{equation*}
so
\begin{equation*}
\prod_{k=1}^{\upvarpi}k
=
\prod_{k=1}^{\upvarpi}\size{ka}_p.
\end{equation*}
Also $\size{ka}_p\equiv\pm ka\pod p$, and $\size{ka}_p\equiv-ka\pod p$ if and only if $ka$ has least positive residue exceeding $p/2$.  Therefore, 
with $n$ as in the statement, we have
\begin{equation*}
\upvarpi!\cdot a^{\upvarpi}
\equiv\prod_{k=1}^{\upvarpi}(ka)
\equiv(-1)^n\cdot\prod_{k=1}^{\upvarpi}\size{ka}_p
\equiv(-1)^n\cdot\prod_{k=1}^{\upvarpi}k
\equiv(-1)^n\cdot\upvarpi!\mod p,
\end{equation*}
which yields the claim by Euler's Criterion.
\end{proof}

For example, to find $(3/19)$, we can look at
\begin{align*}
  &3,&& 6,&& 9,&& 12,&& 15,&& 18,&& 21,&& 24,&& 27,
\end{align*}
whose remainders on division by $19$ are, respectively,
\begin{align*}
  &3,&& 6,&& 9,&& 12,&& 15,&& 18,&& 2,&& 5,&& 8.
\end{align*}
Of these, only $12$, $15$, and $18$ exceed $19/2$, and they are three; so
\begin{equation*}
  \ls3{19}=(-1)^3=-1.
\end{equation*}

We shall use Gauss's Lemma to prove the Law of Quadratic Reciprocity,
by which we shall be able to relate $(p/q)$ and $(q/p)$ when both $p$
and $q$ are odd primes.  Meanwhile, besides the direct application of
Gauss's Lemma to computing Legendre symbols, we have the following, which we shall also need in order to take full advantage of the Law of Quadratic Reciprocity:

\begin{theorem}\label{thm:8}
  If $p$ is an odd prime, then
  \begin{equation*}
    \ls2p=
    \begin{cases}
      1,&\text{ if }p\equiv\pm1\pmod 8;\\
-1,&\text{ if }p\equiv\pm3\pmod 8.
    \end{cases}
  \end{equation*}
\end{theorem}

\begin{proof}
  To apply Gauss's Lemma, we look at the numbers
$2\cdot1$, $2\cdot2$, \dots, $2\cdot\upvarpi$.
Each is its own remainder on division by $p$.  Hence $(2/p)=(-1)^n$,
where $n$ is the number of integers $k$ such that
\begin{equation*}
  \frac p2<2k\leq p-1,
\end{equation*}
or rather $p/4<k\leq\upvarpi$.  This means
\begin{equation*}
  n=\upvarpi-\Bigl[\frac p4\Bigr].
\end{equation*}
Now consider
the possibilities:
\begin{gather*}
p=8k+1\implies n=4k-\Bigl[2k+\frac14\Bigr]=2k,\\
p=8k+3\implies n=4k+1-\Bigl[2k+\frac34\Bigr]=2k+1,\\
p=8k+5\implies n=4k+2-\Bigl[2k+\frac54\Bigr]=4k+1,\\
p=8k+7\implies n=4k+3-\Bigl[2k+\frac74\Bigr]=4k+2.
\end{gather*}
In each case then, $(2/p)$ is as claimed.
\end{proof}

As $13\equiv-3\pmod 8$, we have $(2/13)=-1$, which we found by other methods above.  
An alternative formulation of the theorem is
\begin{equation*}
\ls 2p=(-1)^{(p^2-1)/8},
\end{equation*}
since
\begin{gather*}
p\equiv\pm1\mod8
\implies p\equiv\pm1,\pm7\mod16
\implies p^2\equiv1\mod16,\\
p\equiv\pm3\mod8
\implies p\equiv\pm3,\pm5\mod16
\implies p^2\equiv9\mod16.
\end{gather*}
We can also
use the theorem to find some primitive roots.
Given a prime $q$ and an integer $a$ that $q$ does not divide, we know that $a$ is a primitive root of $q$, provided that
\begin{equation*}
a^d\not\equiv1\pmod q
\end{equation*}
whenever $d$ is a \emph{proper} divisor of $q-1$.  Verifying this condition is easier, the fewer proper divisors $q$ has.  If $q$ is odd, then $q-1$ has the fewest possible divisors when it is $2p$ for some $p$.  Recall from page~\pageref{Germain} that in this case $p$ is called a
\textbf{Germain prime,}%
\index{Germain, --- prime}%
\index{prime! Germain ---}
assuming $p$ itself is odd.
That is, an odd prime $p$ is a Germain prime if and only if $2p+1$ is also prime.

\begin{theorem}
  Suppose $p$ is a Germain prime, and let $\upvarpi=(p-1)/2$.  Then $2p+1$ has the primitive
  root $(-1)^{\upvarpi}\cdot2$, which is $2$ if $p\equiv1\pmod 4$, and
  is otherwise $-2$.
\end{theorem}

\begin{proof}%[Proof of theorem]
Let $r=(-1)^{\upvarpi}\cdot2$, and denote $2p+1$ by $q$.  We want to show
  $\ord qr$ is not $1$, $2$, or $p$.  But $p\geq3$, so $q\geq7$, and hence
  $r^1,r^2\not\equiv1\pmod q$.  Hence $\ord qr$ is not $1$ or $2$.  Also, from Euler's
  Criterion,
  \begin{equation*}
    r^p\equiv r^{(q-1)/2}\equiv\ls rq\pmod q.
  \end{equation*}
So it is enough to show $(r/q)=-1$.
We consider two cases.  
\begin{asparaenum}[1.]
\item
If $p\equiv1\pmod4$, then $r=2$, but also
$q\equiv3\pmod 8$, so 
\begin{equation*}
\ls rq=\ls2q=-1
\end{equation*}
 by the last theorem.  
\item
If $p\equiv3\pmod4$, then
$r=-2$, but also $q\equiv7\pmod8$, and
\begin{equation*}
\ls{-1}q=(-1)^{(q-1)/2}=(-1)^p=-1, 
\end{equation*}
so $(r/q)=(-2/q)=(-1/q)(2/q)=-1$.\qedhere
\end{asparaenum}
\end{proof}

Hence, for example, we have the following Germain primes and their
primitive roots:  
\begin{equation*}%\mbox{}\hspace{-1cm}
\setlength{\arraycolsep}{2.5pt}
  \begin{array}{*{15}{|r}|}\hline
                     p& 3& 5&11&23&29&41& 53& 83&
                     89&113&131&173&179%&191&233
\\\hline
                  2p+1&
                  7&11&23&47&59&83&107&167&179&227&263&347&359%&383&467
\\\hline
\text{p.r.\ of $2p+1$}&-2& 2&-2&-2& 2& 2&  2& -2&  2&  2& -2&  2& -2%&
                                %-2&  2
\\\hline
  \end{array}
\end{equation*}
It is not known whether there
infinitely many Germain primes.  However, some of them give examples
of Mersenne numbers that are not primes, as noted on
page~\pageref{Germain}: 

\begin{theorem}\label{thm:Germain}
If $p$ is a Germain prime, and $2p+1\equiv\pm1\pmod8$, then $2^p-1$ is
not prime, because
\begin{equation*}
  2^p\equiv1\pmod{2p+1}.
\end{equation*}
\end{theorem}

\begin{proof}
  Let $q=2p+1$.  Under the given conditions, we have $(2/q)=1$ by
  Theorem~\ref{thm:8}, so $2^q\equiv1\pod q$ by Euler's Criterion.
\end{proof}


Another consequence of Theorem~\ref{thm:8} is:

\begin{theorem}
  There are infinitely many primes congruent to $-1$ \emph{modulo} $8$.
\end{theorem}

\begin{proof}
  Let $q_1$, \dots, $q_n$ be a finite list of primes.  We show that
  there is $p$ not on the list such that $p\equiv-1\pmod8$.  Let
  \begin{equation*}
    M=(4q_1\dotsm q_n)^2-2.
  \end{equation*}
Then $M\equiv-2\pmod{16}$, so $M$ is not a power of $2$; in
particular, $M$ has odd prime divisors.
Also, for every odd prime divisor $p$ of $M$, we have
\begin{equation*}
  (4q_1\dotsm q_n)^2\equiv2\pmod p,
\end{equation*}
so $(2/p)=1$, and therefore $p\equiv\pm1\pmod 8$.  Since
$M/2\equiv-1\pmod8$, we conclude that not every odd prime divisor of
$M$ can be congruent to $1$ \emph{modulo}~$8$.
\end{proof}

\section{The Law of Quadratic Reciprocity}%\asterism{}

\setcounter{equation}0
We now aim to establish the Law of Quadratic Reciprocity, Theorem~\ref{thm:qr} below.
To prove the Law, we shall use the following consequence of Gauss's
Lemma (Theorem~\ref{thm:GL}):

\begin{lemma}
  If $p$ is an odd prime, $p\ndivides a$, and $a$ is odd, then
  \begin{equation*}
    \ls ap=(-1)^m,
  \end{equation*}
where
\begin{equation*}
    m=\sum_{k=1}^{\upvarpi}\left[\frac{ka}p\right]. 
\end{equation*}
\end{lemma}

\begin{proof}
With $n$ as in Gauss's Lemma, we need only show $m\equiv n\pod2$.
  As in the proof of Gauss's Lemma, we have
  \begin{equation*}
\{1,2,\dots,\upvarpi\}=\{\size a_p,\size{2a}_p,\dots,\size{\upvarpi a}_p\}.
\end{equation*}
We now work with modulus $2$, so that $-1\equiv1$, and
$a+1\equiv0$.  Then
\begin{equation*}
0
%\equiv a+1
\equiv(a+1)\cdot\sum_{k=1}^{\upvarpi}k
\equiv\sum_{k=1}^{\upvarpi}(ka-k)
%\equiv\sum_{k=1}^{\upvarpi}ka+\sum_{k=1}^{\upvarpi}k
%\equiv\sum_{k=1}^{\upvarpi}ka-\sum_{k=1}^{\upvarpi}\size{ka}_p
\equiv\sum_{k=1}^{\upvarpi}(ka+\size{ka}_p).
\end{equation*}
From the original definition~\eqref{eqn:kp}
of $\size k_p$ on page~\pageref{eqn:kp},
and because $-1\equiv1$, we have
\begin{equation*}
ka+\size{ka}_p\equiv
\begin{cases}
	p\cdot[ka/p],&\text{ if }(\text{residue of $ka$ \emph{modulo}
          $p$})<p/2,\\ 
	p\cdot[ka/p]+p,&\text{ otherwise.}
\end{cases}
\end{equation*}
Therefore
\begin{equation*}
0\equiv\sum_{k=1}^{\upvarpi}p\cdot\Bigl[\frac{ka}p\Bigr]+np
\equiv m+n.\qedhere
\end{equation*}
\end{proof}


The following was:
\begin{compactitem}
\item
  conjectured by Euler, 1783;\index{Euler}
\item
  imperfectly proved by Legendre, 1785, 1798;\index{Legendre}
\item
discovered and proved independently by Gauss, 1795, at age 18.
\end{compactitem}
The following proof is due to Gauss's student Eisenstein.  We have so
far denoted $(p-1)/2$ by $\upvarpi$; but now, going back to the
original definition~\eqref{eqn:varpi} on page~\pageref{eqn:varpi}, we
must use $\upvarpi(p)$: 

\begin{theorem}[Law of Quadratic Reciprocity]\label{thm:qr}
  If $p$ and $q$ are distinct odd primes, then
\begin{equation*}
\ls pq\ls qp=(-1)^{\upvarpi(p)\cdot\upvarpi(q)}.
\end{equation*}
\end{theorem}

\begin{proof}%[Proof of Quadratic Reciprocity]
  By the lemma, it is enough to show
\begin{equation*}
\frac{p-1}2\cdot\frac{q-1}2=
\upvarpi(p)\cdot\upvarpi(q)=
  \sum_{k=1}^{\upvarpi(p)}\left[\frac{kq}p\right]+
\sum_{\ell=1}^{\upvarpi(q)}\left[\frac{\ell p}q\right].
\end{equation*}
We do this by considering a rectangle $ABCD$ in the Cartesian plane as in Figure~\ref{fig:qr}.
\begin{figure}[ht]
\centering
\begin{pspicture}(-1,-1)(4.5,3.5)
\psline{->}(-1,0)(4.5,0)
\psline{->}(0,-1)(0,3.5)
\psline(3.5,0)(3.5,2.5)(0,2.5)
\uput[dl](0,0){$A$}
\uput[ur](3.5,0){$B$}
\uput[ur](3.5,2.5){$C$}
\uput[ur](0,2.5){$D$}
\psline(0,0)(3.5,2.5)
\psline[linestyle=dotted](2,0)(2,1.429)(0,1.429)
\uput[d](3.5,0){$\displaystyle\frac p2$}
\uput[l](0,2.5){$q/2$}
\uput[d](2,0){$k$}
\uput[l](0,1.429){$kq/p$}
\end{pspicture}
\caption{Two ways of counting, for the Law of Quadratic Reciprocity}\label{fig:qr}
\end{figure}
The number of points in the interior of $ABCD$ with integral coordinates is $[p/2]\cdot[q/2]$, that is, $\upvarpi(p)\cdot\upvarpi(q)$.  None of these points lie on the diagonal $AC$.  The number of points in the interior of triangle $ABC$ with first coordinate $k$ and second coordinate integral is $[kp/q]$.  Therefore the number of points in the interior of $ABC$ with integral coordinates is $\sum_{k=1}^{\upvarpi(p)}[kq/p]$.  A similar consideration of triangle $ACD$ yields the claim.
\end{proof}

For example, suppose $p=13$ and $q=7$.  The points that we count in the proof are shown in Figure~\ref{fig:qr2}.
\begin{figure}[ht]
\centering
\begin{pspicture}(-1,-1)(7.5,4.5)
\multips(1,0)(1,0){6}{\psdots[dotsize=1pt
    1](0,1)(0,2)(0,3)} 
\psline{->}(-1,0)(7.5,0)
\psline{->}(0,-1)(0,4.5)
\psline(6.5,0)(6.5,3.5)(0,3.5)
\uput[dl](0,0){$A$}
\uput[ur](6.5,0){$B$}
\uput[ur](6.5,3.5){$C$}
\uput[ur](0,3.5){$D$}
\psline(0,0)(6.5,3.5)
\uput[d](6.5,0){$\displaystyle\frac{13}2$}
\uput[l](0,3.5){$7/2$}
\end{pspicture}
\caption{Example of the proof of quadratic reciprocity}\label{fig:qr2}
\end{figure}
Counted in columns, the number of points inside $ABC$ is $0+1+1+2+2+3$, which is
\begin{equation*}
\Bigl[\frac7{13}\Bigr]+
\Bigl[\frac{14}{13}\Bigr]+
\Bigl[\frac{21}{13}\Bigr]+
\Bigl[\frac{28}{13}\Bigr]+
\Bigl[\frac{35}{13}\Bigr]+
\Bigl[\frac{42}{13}\Bigr].
\end{equation*}
Counted in rows, the number of points inside $ACD$ is $1+3+5$, which is
\begin{equation*}
\Bigl[\frac{13}7\Bigr]+
\Bigl[\frac{26}7\Bigr]+
\Bigl[\frac{39}7\Bigr].
\end{equation*}

The more useful form of the Law of Quadratic Reciprocity is:
\begin{equation*}
  \ls qp=
  \begin{cases}
    (p/q),&\text{ if }p\equiv1\text{ or }q\equiv 1\pmod 4;\\
   -(p/q),&\text{ if }q\equiv3\equiv p\pmod 4.
  \end{cases}
\end{equation*}
It is important to remember here that both $p$ and $q$ are \emph{odd primes.}  
We have not defined the symbol $(a/n)$ except when $n$ is an odd prime
not dividing $a$. 
In this case, we can reduce the computation to computation of symbols
$(p/q)$ by means of 
Theorems~\ref{thm:ls} and~\ref{thm:8}.  
\begin{table}[ht]
\begin{align*}
  \ls{365}{941}
&=\ls{5}{941}\ls{73}{941}&&\text{[factorizing]}\\
&=\ls{941}5\ls{941}{73}&&[5,73\equiv1\pod 4]\\
&=\ls15\ls{65}{73}&&\text{[dividing]}\\
&=\ls5{73}\ls{13}{73}&&\text{[factorizing]}\\
&=\ls{73}5\ls{73}{13}&&[5,13\equiv1\pod 4]\\
&=\ls35\ls8{13}&&\text{[dividing]}\\
&=\ls53\ls2{13}^3&&\text{[$5\equiv1\pod 4$; factorizing]}\\
&=\ls23\ls2{13}&&[(p/q)^2=1]\\
&=(-1)(-1)=1&&[3\equiv3\And13\equiv-3\pod 8].
\end{align*}
\caption{Computation of $(365/941)$}\label{table:(365/941)}
\end{table}
For example, we can compute
one Legendre symbol as in Table~\ref{table:(365/941)}.
Similarly, we have
\begin{equation*}
  \ls{47}{199}
=-\ls{199}{47}
=-\ls{11}{47}
=\ls{47}{11}
=\ls3{11}
=-\ls{11}3
=-\ls23=1.
\end{equation*}
Thus we can compute any Legendre symbol $(a/p)$, as long as we can
recognize which numbers less than $p$ are prime. 

The value of $(2/p)$ cannot be computed by the Law of Quadratic
Reciprocity; we need Theorem~\ref{thm:8}.  We \emph{can} use the Law
to compute $(3/p)$ when we need it; but we can also compute it once
for all as follows.   

\begin{theorem}
For all primes greater than $3$,
\begin{equation*}
  \ls 3p=
  \begin{cases}
    1,&\text{ if }p\equiv\pm1\pmod{12},\\
-1,&\text{ if }p\equiv\pm5\pmod{12}.
  \end{cases}
\end{equation*}
\end{theorem}

\begin{proof}
We have
\begin{gather*}
  \ls 3p=
  \begin{cases}
    \ls p3,&\text{ if }p\equiv1\pmod 4,\\
-\ls p3,&\text{ if }p\equiv 3\pmod 4,
  \end{cases}\\
\ls p3=
\begin{cases}
  1,&\text{ if }p\equiv1\pmod 3,\\
-1,&\text{ if }p\equiv2\pmod 3.
\end{cases}
\end{gather*}
It is a Chinese remainder problem to compute
\begin{align*}
  \left\{
  \begin{aligned}
    p&\equiv1\pod 4\\
    p&\equiv1\pod 3
  \end{aligned}
\right\}&\iff p\equiv1\pod{12},\\
  \left\{
  \begin{aligned}
    p&\equiv1\pod 4\\
    p&\equiv2\pod 3
  \end{aligned}
\right\}&\iff p\equiv5\pod{12},\\
  \left\{
  \begin{aligned}
    p&\equiv3\pod 4\\
    p&\equiv1\pod 3
  \end{aligned}
\right\}&\iff p\equiv7\pod{12},\\
  \left\{
  \begin{aligned}
    p&\equiv3\pod 4\\
    p&\equiv2\pod 3
  \end{aligned}
\right\}&\iff p\equiv11\pod{12}.\qedhere
\end{align*}
\end{proof}

One could find a similar rule for $(q/p)$ for any fixed $q$.

\section{Composite moduli}%\asterism{}

Assuming $\gcd(a,n)=1$, we know when the congruence $x^2\equiv a\pmod
n$ has solutions, provided $n$ is an odd prime; but what about the
other cases?  When $n=2$, then the congruence always has the solution
$1$. 
If $\gcd(m,n)=1$, and $\gcd(a,mn)=1$, then the congruence $x^2\equiv
a\pmod{mn}$ is soluble if and only if the system
\begin{align*}
    x^2&\equiv a\pmod m,&
x^2&\equiv a\pmod n
\end{align*}
is soluble.  By the Chinese Remainder Theorem, the system is soluble
if and only if the individual congruences are separately soluble.
Indeed, suppose $b^2\equiv a\pmod m$, and $c^2\equiv a\pmod n$.  By
the Chinese Remainder Theorem, there is some $d$ such that $d\equiv
b\pmod m$ and $d\equiv c\pmod n$.  Then $d^2\equiv b^2\equiv a\pmod
m$, and $d^2\equiv c^2\equiv a\pmod n$, so $d^2\equiv a\pmod{mn}$. 

For example, suppose we want to solve
\begin{equation*}
  x^2\equiv365\pmod{667}.
\end{equation*}
Factorize $667$ as $23\cdot29$.  Then we first want to solve
\begin{align*}
  x^2&\equiv365\pmod{23},&
  x^2&\equiv365\pmod{29}.
\end{align*}
But we have $(365/23)=(20/23)=(5/23)=(23/5)=(3/5)=-1$ by the formula
for $(3/p)$, so the first of the two congruences is insoluble, and
therefore the original congruence is insoluble.  It doesn't matter
whether the second of the two congruences is insoluble.

Contrast with the following: $(2/11)=-1$, and
$(7/11)=-(11/7)=-(4/7)=-1$; so the congruences
\begin{align*}
  x^2&\equiv2\pmod{11},&x^2&\equiv7\pmod{11}
\end{align*}
are insoluble; but $x^2\equiv14\pmod{11}$ is soluble.

Now consider
\begin{equation*}
  x^2\equiv361\pmod{667}.
\end{equation*}
One may notice that this has the solutions $x\equiv\pm19$; but there
are others, and we can find them as follows.  We first solve
\begin{align*}
  x^2&\equiv16\pmod{23},&x^2&\equiv13\pmod{29}.
\end{align*}
The first of these is solved by $x\equiv\pm4\pmod{23}$ (and nothing
else, since $23$ is prime).  For the second, note
$13\equiv42,71,100\pmod{29}$, so $x\equiv\pm10\pmod{29}$.  So the
solutions of the original congruence are the solutions of one of the
following systems:
\begin{align*}
&  \left\{
  \begin{aligned}
    x&\equiv 4 \pmod{23},\\
    x&\equiv 10\pmod{29}
  \end{aligned}
\right\},
&&
 \left\{
  \begin{aligned}
    x&\equiv 4\pmod{23},\\
    x&\equiv -10\pmod{29}
  \end{aligned}
\right\},\\
&  \left\{
  \begin{aligned}
    x&\equiv -4\pmod{23},\\
    x&\equiv 10\pmod{29}
  \end{aligned}
\right\},
&&
 \left\{
  \begin{aligned}
    x&\equiv -4\pmod{23},\\
    x&\equiv -10\pmod{29}
  \end{aligned}
\right\}.
\end{align*}
One finds
$x\equiv\pm19, \pm280\pmod{667}$, or alternatively
\begin{equation*}
x\equiv648,280,387,19\pmod{667}.
\end{equation*}

So now $x^2\equiv a\pmod n$ is soluble if and only if the congruences
\begin{equation*}
  x^2\equiv a\pmod{p^{n(p)}}
\end{equation*}
are soluble, where $n=\prod_{p\divides n}p^{n(p)}$.  

\begin{theorem}
If $p$ is odd, $p\ndivides a$, and $(a/p)=1$, then
the congruence
\begin{equation}\label{eqn:x2a}
x^2\equiv a\pmod{p^k}
\end{equation}
has two solutions for each positive $k$.
\end{theorem}

\begin{proof}
The set $\{x^2\colon x\in\Zmodu[p^k]\}$ consists of those $a$ in
$\Zmodu[p^k]$ such that~\eqref{eqn:x2a} is soluble.  For such $a$, we
have $(a/p)=1$.  Thus
\begin{equation*}
  \{x^2\colon x\in\Zmodu[p^k]\}\included\{a\in\Zmodu[p^k]\colon(a/p)=1\}.
\end{equation*}
But we have also
\begin{equation*}
  \size{\{a\in\Zmodu[p^k]\colon(a/p)=1\}}=\frac{\ephi(p^k)}2.
\end{equation*}
Indeed, this formula is correct when $k=1$, by Theorem~\ref{thm:eq} on
page~\pageref{thm:eq}.  Moreover, for every element $a$ of $\Zmod[p]$,
exactly $p^{k-1}$ elements of $\Zmodu[p^k]$ have the residue $a$
\emph{modulo} $p$: those elements are $a$, $a+p$,
$a+2p$, \dots, $a+(p^{k-1}-1)\cdot p$.  This yields the claim for
arbitrary positive $k$, since the value of $(a/p)$ depends only on the
residue of $a$ \emph{modulo} $p$. 

Each congruence~\eqref{eqn:x2a} has at most $2$ solutions, and
therefore
\begin{equation*}
  \size{\{x^2\colon x\in\Zmodu[p^k]\}}\geq\frac{\ephi(p^k)}2.
\end{equation*}
For, if
$x^2=y^2\pmod{p^k}$, then $p\divides(x+y)(x-y)$, but if $p$ divides
both $x+y$ and $x-y$, then $p$ divides $2x$ and therefore $x$, and
similarly $p\divides y$.  Assuming we have neither of these
conclusions, we have $p^k\divides x\pm y$, that is, $x\equiv\pm
y\pod{p^k}$. 

Combining what we have so far yields
\begin{equation*}
  \size{\{x^2\colon x\in\Zmodu[p^k]\}}
  =\size{\{a\in\Zmodu[p^k]\colon(a/p)=1\}}=\frac{\ephi(p^k)}2. 
\end{equation*}
But we have also shown that the function $x\mapsto x^2$ from
$\Zmodu[p^k]$ to itself sends at most two elements to the same
element.  Since $\Zmodu[p^k]$ has just $\ephi(p^k)$ elements, the
squaring function must send \emph{exactly} two elements to the same
element.  This just means~\eqref{eqn:x2a} has exactly two solutions when
$(a/p)=1$. 
\end{proof}

In this proof, we have used a kind of pigeonhole
principle:\index{Pigeonhole Principle}% 
\index{theorem!Pigeonhole Principle}
If the $\ephi(p^k)$-many elements of $\Zmodu[p^k]$
are pigeons, and the squares of those elements are pigeon-holes, then
there are at most two pigeons for each hole, so there are at least
$\ephi(p^k)/2$-many holes; but there are at most $\ephi(p^k)/2$-many
holes, therefore there are exactly that many, and there are two
pigeons for each hole.  

An alternative argument that~\eqref{eqn:x2a} is soluble is by induction.
Suppose $b^2\equiv a\pod{p^{k}}$ for some positive $k$.  This 
  means
  \begin{equation*}
    b^2=a+c\cdot p^{k}
  \end{equation*}
for some $c$.  Then
\begin{align*}
  (b+p^{k}\cdot y)^2
&=b^2+2bp^{k}\cdot y+p^{2k}\cdot y^2\\
&=a+(c+2by)p^{k}+p^{2k}\cdot y^2
\end{align*}
Therefore
  $(b+p^{k}\cdot y)^2\equiv a\pmod{p^{k+1}}
\iff c+2by\equiv0\pmod p$.  But the latter congruence is soluble,
  since $p$ is odd.

We must finally consider powers of $2$.

\begin{theorem}
  Suppose $a$ is odd.
  \begin{enumerate}
    \item
$x^2\equiv a\pmod 2$ is soluble.
\item
$x^2\equiv a\pmod 4$ is soluble if and only if $a\equiv 1\pmod 4$.
\item
The following are equivalent:
  \begin{enumerate}
\item\label{item:all}
$x^2\equiv a\pmod{2^{2+k}}$ is soluble for all positive $k$;
\item\label{item:some}
$x^2\equiv a\pmod{2^{2+k}}$ is soluble for some positive $k$;
    \item\label{item:8}
$x^2\equiv a\pmod 8$ is soluble;
\item\label{item:a18}
$a\equiv 1\pmod 8$.
  \end{enumerate}
  \end{enumerate}
\end{theorem}

\begin{proof}
The only hard part is to show that, if $a\equiv1\pod 8$, then for all
positive $k$, the congruence $x^2\equiv a\pod{2^{2+k}}$ is soluble.
We prove this by
induction.  It is easily true when $k=1$.  Suppose it is true when
$k=\ell$, and in fact $b^2\equiv
a\pmod{2^{2+\ell}}$.  Then
$b^2=a+2^{2+\ell}\cdot c$ for some $c$.  Hence 
  \begin{align*}
    (b+2^{1+\ell}\cdot y)^2
&=b^2+2^{2+\ell}\cdot by+2^{2+2\ell}\cdot y^2\\
&=a+2^{2+\ell}\cdot c+2^{2+\ell}\cdot by+2^{2+2\ell}\cdot y^2\\
&=a+2^{2+\ell}\cdot(c+by)+2^{2+2\ell}\cdot y^2,
  \end{align*}
and this is congruent to $a$ \emph{modulo} $2^{3+\ell}$ if and only if
$c+by\equiv 0\pmod 2$.  But this congruence is soluble, since $b$ is
odd (since $a$ is odd).
\end{proof}

\chapter{Sums of squares}

Now we shall show that, if $n$ is a natural
number, then the Diophantine equation
\begin{equation}\label{eqn:4}
  x^2+y^2+z^2+w^2=n
\end{equation}
is soluble.  
This is easy when $n$ is $1$ or $2$, since
\begin{align*}
1^2+0^2+0^2+0^2&=1,&1^2+1^2+0^2+0^2&=2.
\end{align*}
We continue by showing:
\begin{compactenum}[1)]
\item
for each odd prime $p$,~\eqref{eqn:4} is soluble when $n=mp$ for some $m$ where $m<p$;
\item
for each odd prime $p$,~\eqref{eqn:4} is soluble when $n=p$;
\item
the set of $n$ for which~\eqref{eqn:4} is soluble is closed under multiplication.
\end{compactenum}
For the first step, the following lemma is more than enough.
Note that the lemma is nothing new when $p$ is odd and $(a/p)=1$.

\begin{lemma}
  For every odd prime $p$, for every integer $a$, the congruence
  \begin{equation*}
    x^2+y^2\equiv a\pmod p
  \end{equation*}
is soluble.
\end{lemma}

\begin{proof}
If $0\leq s\leq t\leq\upvarpi$, then $0\leq s+t<p$.  If also $s^2\equiv
t^2\pod p$, then $p\divides(t+s)(t-s)$ and hence $p\divides t-s$, so
$s=t$.  This shows that no two distinct elements of the set
\begin{equation*}
  \{x^2\colon 0\leq x\leq\upvarpi\}
\end{equation*}
are congruent to one another \emph{modulo} $p$; and the same is true
for the set
\begin{equation*}
  \{a-y^2\colon 0\leq y\leq\upvarpi\}.
\end{equation*}
But each of these sets has $(p+1)/2$ elements, so one element from one
of the sets must be congruent to an element of the other, by the
pigeonhole principle.% 
\index{Pigeonhole Principle}%
\index{theorem!Pigeonhole Principle}
\end{proof}

Another way to express the lemma is that, for all odd primes $p$, there
are $a$, $b$, and $m$ such that
\begin{equation*}
a^2+b^2+1^2+0^2=  a^2+b^2+1=mp.
\end{equation*}
We may assume $\size a$ and $\size b$ are less than $p/2$, so $a^2+b^2<p^2/2$, and hence $m<p$.

\begin{theorem}[Euler]\label{thm:Euler-4}%
\index{Euler!---'s Theorem}%
\index{theorem!Euler's Th---}
  The product of two sums of four squares is the sum of four squares, and indeed
  \begin{equation}\label{eqn:ET4}
    (a^2+b^2+c^2+d^2)(x^2+y^2+u^2+v^2)=
    \left\{
    \begin{aligned}
      (ax&+by+cu+dv)^2\\
{}+(ay&-bx+cv-du)^2\\
{}+(au&-bv-cx+dy)^2\\
{}+(av&+bu-cy-dx)^2.
    \end{aligned}
    \right\}
  \end{equation}
\end{theorem}

One can prove this by multiplying out either side; but there is a
neater way to proceed.  In $\C$, if $z=x+y\mi$, we define
\begin{equation*}
\bar z=x-y\mi;
\end{equation*}
this is the \textbf{conjugate}%
\index{conjugate}
of $z$.
If we think of $z$ as the matrix in~\eqref{eqn:mat} on page~\pageref{eqn:mat} in \S\ref{sect:other}, then $\bar z$ is its transpose.  Then $z\cdot\bar z=x^2+y^2$, an element of $\R$.  More generally, $\overline{z\cdot w}=\bar w\cdot\bar z=\bar z\cdot\bar w$. 

Now we define the set $\Ham$ of \textbf{quaternions}%
\index{quaternion}
as the set of matrices
\begin{equation}\label{eqn:q}
\begin{pmatrix}
z&w\\-\bar w&\bar z
\end{pmatrix},
\end{equation}
where $z$ and $w$ range over $\C$.  Then $\Ham$ is still a ring, albeit not commutative. Indeed, we identify $\C$ with its image in $\Ham$ under the map
\begin{equation*}
z\mapsto
\begin{pmatrix}
z&0\\0&\bar z
\end{pmatrix},
\end{equation*}
and we define
\begin{equation*}
\mj=
\begin{pmatrix}
0&1\\-1&0
\end{pmatrix}.
\end{equation*}
Then every element of $\Ham$ is uniquely $z+w\mj$ for some $z$ and $w$ in $\C$; moreover, $\mj^2=-1$.  But $\mj\cdot\mi=-\mi\cdot\mj$, by the computation
\begin{equation*}
\begin{pmatrix}
0&1\\-1&0
\end{pmatrix}
\cdot
\begin{pmatrix}
\mi&0\\0&-\mi
\end{pmatrix}
=
\begin{pmatrix}
0&-\mi\\-\mi&0
\end{pmatrix}
=-
\begin{pmatrix}
\mi&0\\0&-\mi
\end{pmatrix}
\cdot
\begin{pmatrix}
0&1\\-1&0
\end{pmatrix}.
\end{equation*}
We may write $\mk$ for $\mi\cdot\mj$; then every element of $\Ham$ is uniquely $x+y\mi+u\mj+v\mk$ for some $x$, $y$, $u$, and $v$ in $\R$. 
If the matrix in~\eqref{eqn:q} is $\alpha$, then we define
\begin{equation*}
\bar{\alpha}=
\begin{pmatrix}
\bar z&-w\\\bar w&z
\end{pmatrix},
\end{equation*}
which is the transpose of the matrix resulting from taking the conjugate of every entry.  Hence if also $\beta\in\Ham$, then $\overline{\beta\cdot\alpha}=\bar{\alpha}\cdot\bar{\beta}$. 
Moreover,
\begin{equation*}
  \alpha\cdot\bar{\alpha}=z\cdot\bar z+w\cdot\bar w;
\end{equation*}
this is an element of $\R$, so it commutes with all quaternions.  
If $\alpha=x+y\mi+u\mj+v\mk$, then $\alpha\cdot\bar{\alpha}=x^2+y^2+z^2+w^2$.
We have also
\begin{equation*}
\beta\cdot\alpha\cdot\overline{\beta\cdot\alpha}
=\beta\cdot\alpha\cdot\bar{\alpha}\cdot\bar{\beta}
=\beta\cdot\bar{\beta}\cdot\alpha\cdot\bar{\alpha},
\end{equation*}
which is just Euler's Theorem.  Indeed, if $\beta=a+b\mi+c\mj+d\mk$, then
\begin{align*}
\beta\cdot\alpha
&=\bigl((a+b\mi)+(c+d\mi)\mj\bigr)\cdot\bigl((x+y\mi)+(u+v\mi)\mj\bigr)\\
&=\left\{
\begin{aligned}
  (a+b\mi)\cdot(x+y\mi) &- (c+d\mi)\cdot(u-v\mi) \\
{}+ \bigl((a+b\mi)\cdot(u+v\mi) &+ (c+d\mi)\cdot(x-y\mi)\bigr)\mj
\end{aligned}
\right\}\\
&=
\left\{
\begin{aligned}
    ax&-by-cu-dv\\
{}+(ay&+bx+cv-du)\mi\\
{}+(au&-bv+cx+dy)\mj\\
{}+(av&+bu-cy+dx)\mk,
\end{aligned}
\right\}
\end{align*}
and therefore
\begin{equation*}
(a^2+b^2+c^2+d^2)\cdot(x^2+y^2+u^2+v^2)
=\left\{
\begin{aligned}
    (ax&-by-cu-dv)^2\\
{}+(ay&+bx+cv-du)^2\\
{}+(au&-bv+cx+dy)^2\\
{}+(av&+bu-cy+dx)^2.
\end{aligned}
\right\};
\end{equation*}
this yields~\eqref{eqn:ET4} when $\beta$ is replaced with $\bar{\beta}$.

\begin{theorem}[Lagrange]
  Every positive integer is the sum of four squares.
\end{theorem}

\begin{proof}
  By the lemma and Euler's Theorem (Theorem \ref{thm:Euler-4}), it is now enough to show the
  following.  Let $p$ be a prime.  Suppose $m$ is a positive integer less than $p$
  such that 
  \begin{equation}\label{eqn:abcd}
    a^2+b^2+c^2+d^2=mp
  \end{equation}
for some $a$, $b$, $c$, and $d$.  We shall show that the same is true
for some smaller positive $m$, unless $m$ is already $1$.  

First we show that, if $m$ is even, then we can replace it with
$m/2$.  Indeed, if $a^2+b^2=n$, then
\begin{equation*}
  \Bigl(\frac{a+b}2\Bigr)^2+
  \Bigl(\frac{a-b}2\Bigr)^2=\frac n2,
\end{equation*}
and if $n$ is even, then so are $(a\pm b)/2$.  In~\eqref{eqn:abcd} then,
if $m$ is even, then we may assume that $a^2+b^2$ and $c^2+d^2$ are
both even, so
\begin{equation*}
  \Bigl(\frac{a+b}2\Bigr)^2+
  \Bigl(\frac{a-b}2\Bigr)^2+
  \Bigl(\frac{c+d}2\Bigr)^2+
  \Bigl(\frac{c-d}2\Bigr)^2=\frac m2\cdot p.
\end{equation*}
Henceforth we may assume $m$ is odd.  Then there are $x$, $y$, $u$, and
$v$ \emph{strictly} between $-m/2$ and $m/2$ such that, \emph{modulo} $m$,
\begin{align*}
  x&\equiv a,&y&\equiv b,&u&\equiv c,&v&\equiv d.
\end{align*}
Then
\begin{equation*}
  x^2+y^2+u^2+v^2\equiv0\pmod m,
\end{equation*}
but also
$x^2+y^2+u^2+v^2<m^2$, so
\begin{equation*}
  x^2+y^2+u^2+v^2=km
\end{equation*}
for some positive $k$ less than $m$.  We now have
\begin{equation*}
(a^2+b^2+c^2+d^2)(x^2+y^2+u^2+v^2)=km^2p.
\end{equation*}
By Euler's Theorem, we know the left-hand side as a sum of four
squares; moreover, each of the squared numbers in that sum is
divisible by $m$:
\begin{gather*}
ax+by+cu+dv\equiv x^2+y^2+u^2+v^2\equiv0\pmod m,\\
ay-bx+cv-du\equiv xy-yx+uv-vu=0,\\
au-bv-cx+dy\equiv xu-yv-ux+vy=0,\\
av+bu-cy-dx\equiv xv+yu-uy-vx=0.
\end{gather*}
Therefore we obtain $kp$ as a sum of four squares.  This yields the
claim, as discussed above.
\end{proof}

\appendix

\chapter{Foundations}\label{ch:foundations-again}

\section{Construction of the natural numbers}\label{sect:omega}

In \S\ref{sect:N} it is \emph{assumed} that the set $\N$ of natural numbers
exists with certain properties.  We can \emph{prove} this assertion by
\emph{constructing} $\N$.  The following is the most direct
formulation of the construction that I can come up with.  The construction is basically John von Neumann's~\cite{von-Neumann} of 1923.

Of course we shall still have to assume \emph{something.}
We start with the undefined
notion of a \textbf{class.}\index{class}  A class is a sort of thing
that has \textbf{members}%
\index{member}
or 
\textbf{elements.}%
\index{element}
Let us denote classes by boldface capital letters.
If a class $\class C$ has a member $a$, we write
\begin{equation*}
  a\in\class C.
\end{equation*}
The members determine the class, in the sense that two classes with
the same members are identical.  A class $\class D$ \textbf{includes}
a class $\class C$, so that $\class C$ is a \textbf{subclass}%
\index{subclass}
of $\class D$, if every member of $\class C$ is a member of
$\class D$.  In this case, we write
\begin{equation*}
  \class C\included\class D.
\end{equation*}
If $\class C$ is a \textbf{proper} subclass of $\class D$,---a subclass that is not the whole class itself---, we write
\begin{equation*}
  \class C\pincluded\class D.
\end{equation*}
In ordinary language, one tends to confuse the notions of membership
and inclusion; but here we must keep them distinct.  
For our purposes, a \textbf{set}%
\index{set}
is a class with two special properties:
\begin{compactenum}
  \item
it is a member of other classes;
\item
its own members are sets.\footnote{This means our sets are \emph{hereditary} sets; but we need not consider any other kind of set.}
\end{compactenum}
Some classes are not sets; for example, the class of all sets that are not members of themselves is not a set.  This is the \textbf{Russell Paradox}~\cite{Russell-letter}.\footnote{The Burali-Forti Paradox, Theorem~\ref{thm:BF} below, was discovered earlier.  The \emph{resolution} of the paradoxes, by distinguishing sets from classes, took some time.}
We may denote sets by plainface minuscule letters.

Let us restrict our attention to classes whose \emph{only}
members are sets.
A class in this sense is called \textbf{transitive}%
\index{transitive class}
 when it confuses
the notions of membership and inclusion to the point that it includes
each of its members.  Symbolically, a class $\class C$ is transitive if and only if
\begin{equation*}
  x\in y\And y\in\class C\implies x\in\class C.
\end{equation*}
A \emph{set} is called an \textbf{ordinal number,}%
\index{ordinal number, ordinal}
or just an \textbf{ordinal,}
if it is transitive and well-ordered by membership.
 The class of ordinals is denoted by
\begin{equation*}
\on.
\end{equation*}
The Greek letters $\alpha$,
$\beta$, $\gamma$, \dots, will denote ordinals.
A well-ordering is to be understood in particular as a \emph{strict} ordering, so that $\alpha\notin\alpha$.


\begin{lemma}
$\on$ is transitive, that is, every element of an
  ordinal is an ordinal.  Also every ordinal \emph{properly} includes
  its elements.
\end{lemma}

\begin{proof}
Suppose $\alpha\in\on$ and $b\in\alpha$.  Then
$b\included\alpha$ by transitivity of $\alpha$, so $b$, like $\alpha$, is well-ordered by membership.
Suppose $c\in b$ and $d\in c$.  Then
$c\in\alpha$, so $c\included\alpha$, and hence
$d\in\alpha$.  Since $d\in c$ and $c\in b$, and
all are elements of $\alpha$, where membership is a transitive
relation, we have $d\in b$.  Thus $b$ is transitive.  Now we know $b$
is an ordinal.  Therefore $\alpha\included\on$.  So $\on$ is transitive.   
Finally, $b\pincluded\alpha$ simply because membership is a
strict ordering of $\alpha$.
\end{proof}

\begin{lemma}
  Every ordinal contains every ordinal that it properly includes.
\end{lemma}

\begin{proof}
  Suppose $\beta\pincluded\alpha$.  Then $\alpha\setminus\beta$
  contains some $\gamma$.  Then $\beta\included\gamma$; indeed, if
  $\delta\in\beta$, then, since $\gamma\notin\beta$, we have $\gamma\notin\delta$ and $\gamma\neq\delta$, so $\delta\in\gamma$.  
  We show that, if $\gamma$ is the \emph{least} member of $\alpha\setminus\beta$, then $\gamma=\beta$.
  Suppose
  $\beta\pincluded\gamma$.  Then $\gamma\setminus\beta$ contains some
  $\delta$.  In particular, $\delta\in\alpha\setminus\beta$.
  %  , so by what we have just shown, $\beta\included\delta$.
  By the last lemma, $\delta\pincluded\gamma$, so $\gamma\notin\delta$.
  In particular, $\gamma$ was not the least element
  of $\alpha\setminus\beta$. 
\end{proof}

\begin{theorem}[Burali-Forti Paradox \protect{\cite{Burali-Forti}}]\label{thm:BF}
$\on$ is transitive and well-ordered by membership; so it is not a set.
\end{theorem}

\begin{proof}
By the next-to-last lemma, $\on$ is transitive.  Now
let $\alpha$ and $\beta$ be two ordinals such that
$\beta\notin\alpha$.  We prove $\alpha\included\beta$, so that either
$\alpha=\beta$ or $\alpha\in\beta$ by the last lemma.  If not, then
$\alpha\setminus\beta$ has a least element, $\gamma$.  This means
every element of $\gamma$ is an element of $\beta$; that is,
$\gamma\included\beta$.  But $\gamma\neq\beta$ (since
$\beta\notin\alpha$), so $\gamma\in\beta$ by the lemma, contrary to
assumption. 

If $a$ is a set of ordinals
with an element $\beta$, then the least element of $a$ is the least
element of $a\cap\beta$, if this set is nonempty; otherwise it is
$\beta$.  Thus $\on$ is well-ordered by membership.  In particular, it cannot contain itself; so it must not be a set.
\end{proof}

Since, on $\on$ and hence on every ordinal, the relations of
membership and proper inclusion are the same, they can both be denoted by
$<$. However, we have not yet established that there \emph{are} any
ordinals, or even any sets at all.

We take it for granted that there is an \textbf{empty set,} which is generally denoted by $\emptyset$, but which, in the present context, we
denote by
\begin{equation*}
  0.
\end{equation*}
We also assume that if $x$ and $y$ are sets, then so is
the class whose members are just $y$ and the
members of $x$; this is the class---now a \emph{set}---denoted by
\begin{equation*}
x\cup\{y\}.
\end{equation*}
We are interested mainly in the set $x\cup\{x\}$,
which we denote by
\begin{equation*}
  x'.
\end{equation*}
The following is easy to show.

\begin{theorem}
$\on$ contains $0$ and is closed under the operation $x\mapsto x'$.
\end{theorem}

An ordinal is called a \textbf{limit} if it is neither $0$ nor
$\alpha'$ for any $\alpha$.
The class of ordinals that neither \emph{are} limits nor
\emph{contain} limits\footnote{The following is a remark on English grammar.  One could say, `The class of ordinals
  that neither \emph{are} nor \emph{contain} limits is denoted by
  $\upomega$'; but this would violate the principles laid down by Fowler in his \emph{Modern English Usage}~\cite[Cases]{MEU} of 1926 and
  reaffirmed by Gowers in the second edition~\cite{MEU2} of 1982. 
  In the original sentence, namely `The class of ordinals that neither \emph{are} limits nor
\emph{contain} limits is denoted by $\upomega$',
  the second instance of \emph{limits} is the direct
  object of \emph{contain,} so it is notionally in the `objective
  case'; but the first instance of \emph{limits} is is not an object
  of \emph{are} (which does not take objects), but is in the
  `subjective case', like the subject, \emph{that,} of the relative
  clause.  On similar grounds, the common 
  expression `$x$ is less than or equal to $y$' is objectionable,
  unless \emph{than,} like \emph{to,} is construed as a preposition.
  However, allowing \emph{than} to be used as a preposition can cause
  ambiguity: does `She likes tea better than me' mean `She likes tea
  better than she likes me', or `She likes tea better than I do'?
  Therefore it is recommended in \cite[Than 6]{MEU} and (less strongly)
  in \cite{MEU2} that \emph{than} not be used as a preposition.  On these grounds,
  `$x\leq y$' should be read as `$x$ is less than $y$ or [$x$ is]
  equal to $y$.'  But I don't believe anybody does so, and this itself is grounds for rethinking Fowler's grammatical distinctions.} is denoted by  
\begin{equation*}
\upomega.
\end{equation*}

\begin{theorem}[Dedekind\footnote{Dedekind recognized that the natural
      numbers have the properties given by this theorem, and that all
      structures with these properties are isomorphic
      {\cite[II: \S\S~71, 132]{MR0159773}.}}]
The class $\upomega$ satisfies the Peano Axioms
when $0$ is considered as the \emph{first} element of
$\upomega$, and $\alpha'$ is the \emph{successor} of
$\alpha$.
\end{theorem}

\begin{proof}
We must show three things.
\begin{asparaenum}[1.]
\item
Since $\alpha\in\alpha'$, we have $0\neq\alpha'$.
\item
If $\alpha$ and $\beta$ are distinct ordinals, then we may assume
$\alpha\in\beta$, so that $\beta\notin\alpha$ and $\beta\neq\alpha$, and therefore $\beta\notin\alpha'$; but
$\beta\in\beta'$, so $\alpha'\neq\beta'$. 
\item
Suppose $\class C\included\upomega$.  Then
$\upomega\setminus\class C$ has a least element $\alpha$.  Either
$\alpha=0$ or else $\alpha=\beta'$ for some $\beta$, which must be in $\class C$.
Hence $\class C$ either does not contain $0$ or else is not closed
under succession. 
\qedhere
\end{asparaenum}
\end{proof}

We have so far not assumed that $\upomega$ is a set.  If it \emph{is} a set, then it is in $\on$; if it is \emph{not} a set, then it must \emph{be} $\on$.  As far as number theory is concerned, there does not appear to be any need to make a decision one way or other; but it seems to be customary to consider $\upomega$ and its subclasses as sets.  If $\upomega$ is a set, it is the least of the 
\textbf{transfinite}%
\index{transfinite} ordinals.

We denote $\{0\}$ by $1$.  Then $\upomega\setminus\{0\}$ also satisfies the Peano Axioms, when $1$ is considered as the first element.  You just have to decide whether to begin the natural numbers with $0$ or $1$; but if you start with $0$, you should adjust the definitions of addition, multiplication, exponentiation, and factorial accordingly, so that
\begin{align*}
m+0&=m,&
m\cdot0&=0,&
m^0&=1,&
0!&=1;
\end{align*}
also one should note that the ordering of $\upomega$ satisfies
\begin{equation*}
m\leq n\iff\Exists xm+x=n.
\end{equation*}

\section{Why it matters}

Some teachers and texts give the impression that the properties of the natural numbers can be derived from a single principle, such as the so-called Well-Ordering Principle.  My excellent high school teacher Mr Brown did this.  Burton does this, writing for example, `With the Well-Ordering Principle available, it is an easy matter to derive the First Principle of Finite Induction'~\cite[p.~2]{Burton}.  The principle of induction here is that a set containing the first natural number, and containing the successor of each natural number that it contains, contains all of the natural numbers.
One needs \emph{more} than well-ordering to prove this, since \emph{every} ordinal number is well-ordered, but the ordinals like $\upomega'$ that are greater than $\upomega$ do not admit induction in the sense referred to.  Indeed, $\upomega$ is distinguished among all of the transfinite ordinals as the one that admits induction in the present sense. 

Burton is saved from true inconsistency by having written on the previous page, 
\begin{quote}
We shall make no attempt to construct the integers axiomatically, assuming instead that they are already given and that any reader of this book is familiar with many elementary facts about them.
\end{quote}
Burton's proof of induction relies on some of these unspecified `elementary facts'.  
On the other hand, the needed `facts' are so simple that it seems dishonest not to name them.
Burton could have axiomatized the set of natural numbers by the requirements:
\begin{compactenum}[1)]
\item
it is well ordered,
\item
there is no greatest element,
\item
every element after the first is a successor.
\end{compactenum}
Like the Peano Axioms, these conditions determine the set up to isomorphism.

By referring, in the passage quoted above, to an `attempt to construct the integers axiomatically', Burton confuses two approaches to the natural numbers:
\begin{compactenum}[1)]
\item
\emph{assuming} they exist so as to satisfy the Peano Axioms, as we did in \S\ref{sect:N};
\item
constructing them as $\upomega$, as we did in the last section.
\end{compactenum}
The construction of $\upomega$ is perhaps too specialized for a number
theory course.  However, I will suggest that every mathematician
should know the Peano Axioms and know that they determine the natural
numbers up to isomorphism.  It might prevent certain infelicities and
mistakes, such as can be found, for example, in Burton. 

Before proving induction as Theorem 1.2, Burton proves the
`Archi\-medean property' as Theorem 1.1.  Before stating this theorem,
he says, 
\begin{quote}
Because this principle [of well-ordering] plays a crucial role in the
proofs here and in subsequent chapters, let us use it to show that the
set of positive integers has what is known as the Archimedean
property. 
\end{quote}
This comment does not clarify why the Archimedean property should be
proved.  Will it be needed later, or is is just a warming-up example
of the use of well-ordering? 

Burton's `Second Principle of Finite Induction' is that a set $S$
contains all positive integers if  
\begin{compactenum}
\item
$S$ contains $1$, and
\item
$S$ contains $k+1$ when it contains $1$, \dots, $k$.
\end{compactenum}
This statement may be useful for the writer in a hurry.  Such a writer
may attempt a proof by the `First Principle' of induction, only to
find that the weaker inductive hypothesis there, namely $k\in S$, is
not enough.  Then the writer can just assume that $1$, \dots, $k$ are
all in $S$.  But it would be better to go back and erase the proof
that $1\in S$, then prove $k\in S$ on the assumption that $1$, \dots,
$k-1$ are in $S$, using what I have called `Strong
Induction'~(Theorem~\ref{thm:SI}).  In case $k=1$, one has proved
$1\in S$; this need not be treated separately. 

Burton says presently, `Mathematical induction is often used as a
method of definition as well as a method of proof.'  This is a
misconception that Peanso shared, but that Landau identified in his
\emph{Foundations of Analysis}~\cite{MR12:397m}.  Definition by
induction should be called something else, like definition by
recursion, because it is logically stronger than proof by induction,
as noted in \S\ref{sect:N}. 

\chapter{Some theorems without their proofs}\label{ch:unproved}

I state some theorems, without giving proofs; some of them are recent
and reflect ongoing research:

\begin{theorem}[Dirichlet]
  If $\gcd(a,b)=1$, and $b>{0}$, then $\{a+bn\colon n\in\N\}$ contains
  infinitely many primes.
\end{theorem}

That is in an arithmetic progression whose initial term is prime to
the common difference, there are infinitely many primes.  It is
moreover possible to find arbitrary long arithmetic progressions
consisting entirely of primes:\footnote{This theorem is not mentioned
  in Burton \cite{Burton}.} 

\begin{theorem}[Ben Green and Terence Tao, 2004 \cite{Green--Tao}]
  For every $n$, there are $a$ and $b$ such that each of the numbers
  $a, a+b, a+{2}b,\dots,a+nb$ is prime (and $b>{0}$).
\end{theorem}

Is it possible that each of
the numbers  
\begin{equation*}
a,a+b,a+{2}b,a+{3}b,\dots
\end{equation*}
 is
prime?  Yes, if $b={0}$.
What if $b>{0}$?  Then No, since $a\divides a+ab$.  But what if $a=1$?
Then replace $a$ with $a+b$.

Two primes $p$ and $q$ are 
\textbf{twin primes}%
\index{twin primes}%
\index{prime!twin ---s}
if $\size{p-q}={2}$.
The list of all primes begins: 
\begin{equation*}
{2},\underbrace{{3},5,7},
\underbrace{11,13},\underbrace{17,19},23,\underbrace{29,31},37,
\underbrace{41,43},47,\dots 
\end{equation*}
and
there are several twins.  Are there infinitely many?  People think so,
but cannot prove it.  We do have:

\begin{theorem}[Goldston, Pintz, Y\i ld\i r\i m, 2005 \cite{GPY}]
  For every positive real number $\epsilon$, there are primes~$p$
  and~$q$ such that ${0}<q-p<\epsilon\cdot\log p$.
\end{theorem}

The logarithm function also appears in the much older

\begin{theorem}[Prime Number Theorem]\label{thm:PNT}
Let $\pi(n)$ be the number of primes~$p$ such that $p\leq n$.  Then
\begin{equation*}
\lim_{n\to\infty}\frac{\pi(n)}{n/\log n}=1.
\end{equation*}
\end{theorem}


\chapter{Exercises}\label{ch:exercises}

In the following exercises, if a \emph{statement} is given that is not a
definition, then 
the exercise is to prove the statement.
Minuscule letters range over $\Z$, or sometimes just over $\N$; letters $p$, $p_i$, and $q$ range over the prime numbers.

Many of these exercises are inspired by exercises in \cite[Ch.~2]{Burton}.


%\section{Exercise set}

\begin{xca}\label{xca:A}
Prove the unproved propositions in
Chapter~\ref{ch:foundations}.
\end{xca}


%\section{Exercise set}
%set II
%\Opensolutionfile{math-365-text-raw-solutions}
\begin{xca}
  An integer $n$ is a triangular number if and only if
  $8n+1$ is a square number.
  \begin{soln}
  If $n$ is triangular, then $x=k(k+1)/2$ for some $k$, and then
  $8n+1=4k^2+4k+1=(2k+1)^2$.  Conversely, if $8n+1$ is square, then,
  since this number is also odd, the square is $(2k+1)^2$ for some
  $k$, and then $n=\bigl((2k+1)^2-1)\bigr)/8=k(k+1)/2$, a triangular
  number. 
  \end{soln}
\end{xca}

\begin{xca}\mbox{}
  \begin{compactenum}
    \item
If $n$ is triangular, then so is $9n+1$.
\item
Find infinitely many pairs $(k,\ell)$ such that, if $n$ is triangular,
then so is $kn+\ell$.
  \end{compactenum}
\end{xca}

\begin{xca}
  If $a=n(n+3)/2$, then $t_a+t_{n+1}=t_{a+1}$.
\end{xca}

\begin{xca}
  The 
\textbf{pentagonal numbers}%
\index{pentagonal number}%
\index{number!pentagonal ---}
are $1$, $5$, $12$, \dots: call these $p_1$,
  $p_2$, \&c.
  \begin{compactenum}
    \item
Give a recursive definition of these numbers.
\item
Find a closed expression for $p_n$ (that is, an expression not
involving $p_{n-1}$, $p_{n-2}$, \&c.). 
\item
Find such an expression involving triangular numbers and square numbers.
  \end{compactenum}
\end{xca}

\begin{xca}
Given a positive modulus $n$ and an integer $a$, find a formula for the unique residue in $\{a,\dots,a+n-1\}$ of an arbitrary integer $x$.  (Gauss does this in the \emph{Disquisitiones Arithmeticae.})
\end{xca}

\begin{xca}
Show that every cube is congruent to $0$ or $\pm1$ \emph{modulo} $7$.
\end{xca}

\begin{xca}\mbox{}\label{xca:7}
  \begin{compactenum}
    \item
$7\divides2^{3n}+6$.
\item
Given $a$ in $\Z$ and $k$ in $\N$, find integers $b$ and $c$ such
that $b\divides a^{kn}+c$ for all $n$ in $\N$.
  \end{compactenum}
\end{xca}

\begin{xca}
$\gcd(a,a+1)=1$.
\end{xca}

\begin{xca}
$(k!)^n\divides(kn)!$ for all $k$ and $n$ in $\N$.
\end{xca}

\begin{xca}
If $a$ and $b$ are co-prime, and $a$ and $c$ are
  co-prime, then $a$ and $bc$ are co-prime.
\end{xca}

\begin{xca}
  Let $\gcd(204,391)=n$.  
  \begin{compactenum}
    \item
  Compute $n$.
\item
Find a solution of $204x+391y=n$.
  \end{compactenum}
\end{xca}

\begin{xca}
  Let $\gcd(a,b)=n$.
  \begin{compactenum}
    \item
If $k\divides\ell$ and $\ell\divides2k$, then
$\size{\ell}\in\{\size{k},\size{2k}\}$. 
\item
Show $\gcd(a+b,a-b)\in\{n,2n\}$.
\item
Find an example for each possibility.
\item
$\gcd(2a+3b,3a+4b)=n$.
\item
Solve $\gcd(ax+by,az+bw)=n$.
  \end{compactenum}
\end{xca}

\begin{xca}
  $\gcd(a,b)\divides\lcm(a,b)$. 
\end{xca}

\begin{xca}
  When are $\gcd(a,b)$ and $\lcm(a,b)$ the same?
\end{xca}

\begin{xca}
The binary operation $(x,y)\mapsto\gcd(x,y)$ on $\N$ is
  commutative and associative.
\end{xca}

\begin{xca}
  The co-prime relation on $\N$, namely
  \begin{equation*}
  \{(x,y)\in\N\times\N\colon\gcd(x,y)=1\}
  \end{equation*}
---is it reflexive?
  irreflexive? symmetric?  anti-symmetric?  transitive?
\end{xca}

\begin{xca}
  Give complete solutions, or show that they do not exist, for:
  \begin{compactenum}
    \item
$14x-56y=34$;
\item
$10x+11y=12$.
  \end{compactenum}
\end{xca}

\begin{xca}
  I have some 1-TL pieces and some 50- and 25-Kr pieces: 16 coins in
  all.  They make 6 TL.
  How many coins of each denomination have I got?
\end{xca}

  \begin{xca}\label{xca:p-mod-6}
    $p\equiv\pm1\pmod6$ if $p>3$.  (This exercise is used in Exercise~\ref{xca:perf-6}.)
  \end{xca}

  \begin{xca}
    If $p\equiv1\pmod3$ then $p\equiv1\pmod6$.
  \end{xca}

  \begin{xca}
    If $n\equiv2\pmod3$, then $n$ has a factor $p$ such that
    $p\equiv2\pmod3$. 
  \end{xca}

  \begin{xca}
    Find all primes of the form $n^3-1$.
  \end{xca}

  \begin{xca}
    Find all $p$ such that $3p+1$ is square.
  \end{xca}

  \begin{xca}
    Find all $p$ such that $p^2+2$ is prime.
  \end{xca}

  \begin{xca}
    $n^4+4$ is composite unless $n=\pm1$.
  \end{xca}

  \begin{xca}
    If $n$ is positive, then $8^n+1$ is composite.
  \end{xca}

  \begin{xca}
    Find all integers $n$ such that the equation
    \begin{equation*}
      x^2=ny^2
    \end{equation*}
has only the zero solution.  Prove your findings.
  \end{xca}

  \begin{xca}
    If $p_1<\dotsb<p_n$, prove that the sum
    \begin{equation*}
      \frac1{p_1}+\dotsb+\frac1{p_n}
    \end{equation*}
is not an integer.
  \end{xca}

%\section{Exercise Set}

%set IV

  \begin{xca}
    Prove that the following are equivalent:
    \begin{compactenum}
      \item
Every even integer greater than $2$ is the sum of two primes.
\item
Every integer greater than $5$ is the sum of three primes.
    \end{compactenum}
  \end{xca}

  \begin{xca}
    Infinitely many primes are congruent to $-1$ \emph{modulo} $6$.
  \end{xca}

\begin{xca}
With $\mtheta(x)=\sum_{p\leq x}\log p$ as in \S\ref{sect:B}, and defining
\begin{equation*}
\psi(x)=\sum_{k=1}^{\infty}\mtheta(\oldsqrt[k]{\vphantom x}x),
\end{equation*}
show
\begin{equation*}
\log[x]!=\sum_{j=1}^{\infty}\psi\Bigl(\frac xj\Bigr).
\end{equation*}
\end{xca}

\begin{xca}\label{xca:Mangoldt}
Define the \textbf{Mangoldt function,} $\Lambda$, by
\begin{equation*}
\Lambda(n)=
    \begin{cases}
      \log p,&\text{ if $n=p^m$ for some positive $m$};\\
     0,&\text{ otherwise.}
    \end{cases}
\end{equation*}
\begin{compactenum}
\item
$\log k=\sum_{d\divides k}\Lambda(d)$ (as in Exercise~\ref{xca:Mangoldt-2}).
\item
$\log(n!)=\sum_{j=1}^n\Lambda(j)[n/j]$.
\item
Now give another proof of Theorem~\ref{thm:Legendre}, that %$\log(n!)=\displaystyle\sum_{p\leq n}\log p\sum_{j=1}^{\infty}\Bigl[\displaystyle\frac n{p^j}\Bigr]$.
\begin{equation*}
\log(n!)=\sum_{p\leq n}\log p\sum_{j=1}^{\infty}\Bigl[\frac n{p^j}\Bigr].
\end{equation*}
\end{compactenum}
\end{xca}

\begin{xca}
Prove that $\sum_p1/p$ diverges.
\end{xca}

  \begin{xca}
    Find all $n$ such that
    \begin{compactenum}
      \item
$n!$ is square;
\item
$n!+(n+1)!+(n+2)!$ is square.
    \end{compactenum}
  \end{xca}

  \begin{xca}
    Determine whether $a^2\equiv b^2\pmod n\implies a\equiv b\pmod
    n$. 
  \end{xca}

  \begin{xca}
    Compute $\sum_{k=1}^{1001}k^{365}\pmod 5$.
  \end{xca}

  \begin{xca}
    $39\divides 53^{103}+103^{53}$.
  \end{xca}

  \begin{xca}
  Solve  $6^{n+2}+7^{2n+1}\equiv x\pmod{43}$.
  \end{xca}

  \begin{xca}
    Determine whether $a\equiv b\pmod n\implies c^a\equiv c^b\pmod
    n$. 
  \end{xca}

  \begin{xca}
    Solve the system
    \begin{equation*}
      \begin{cases}
	x\equiv 1\pmod{17},\\
	x\equiv 8\pmod{19},\\
	x\equiv 16\pmod{21}.
      \end{cases}
    \end{equation*}
  \end{xca}

  \begin{xca}
    The system
    \begin{equation*}
    \begin{cases}
      x\equiv a\pmod n\\
      x\equiv b\pmod m
    \end{cases}
    \end{equation*}
has a solution if and only if $\gcd(n,m)\divides b-a$.
  \end{xca}

% new problems

\begin{xca}\label{xca:even-perf-why}
In the proof of Theorem~\ref{thm:even-perf} (p.~\pageref{thm:even-perf}), how do we use that $n$ is even?
\end{xca}

\begin{xca}
Show that every even perfect number is a triangular number.
\end{xca}

\begin{xca}\label{xca:perf-6}
\mbox{}
\begin{enumerate}
\item
If $a\equiv b\pmod6$, show $2^a\equiv2^b\pmod9$.
\item
Show that $n\equiv1\pmod 9$ for every even perfect number $n$ other than $6$.  (See Exercise~\ref{xca:p-mod-6}.)
\end{enumerate}
\end{xca}

\begin{xca}\label{xca:div-prod}
Find every positive integer that is equal to the product of its proper divisors.  (See Exercise~\ref{xca:prod-d}.)
\end{xca}

  \begin{xca}
    Compute $16{200}$ \emph{modulo} $19$.
  \end{xca}

  \begin{xca}
    If $p\neq q$, and $\gcd(a,pq)=1$, and
    $n=\lcm(p-1,q-1)$, show
    \begin{equation*}
    a^n\equiv1\pmod{pq}.
    \end{equation*}
  \end{xca}

\begin{xca}\label{xca:Carmichael} %new problem
Prove Theorem~\ref{thm:Carmichael} (p.~\pageref{thm:Carmichael}).
\end{xca}

  \begin{xca}\label{xca:13}
    Show $a^{13}\equiv a\pmod{70}$.
  \end{xca}

  \begin{xca}
    Assuming $\gcd(a,p)=1$, and $0\leq n<p$, solve the congruence
    \begin{equation*}
    a^nx\equiv b\pmod p.
    \end{equation*}
  \end{xca}

  \begin{xca}
    Solve $2^{14}x\equiv 3\pmod{23}$.
  \end{xca}

  \begin{xca}
    Show $\displaystyle\sum_{k=1}^{p-1}k^p\equiv0\pmod p$.
  \end{xca}

  \begin{xca}
    We can write the congruence $2^p\equiv2\pmod p$ as
    \begin{equation*}
      2^p-1\equiv 1\pmod p.
    \end{equation*}
Show that, if $n\divides 2^p-1$, then $n\equiv 1\pmod p$.
(\emph{Suggestion:}  Do this first if $n$ is a prime $q$.  Then
$2^{q-1}\equiv1\pmod q$.  If $q\not\equiv1\pmod p$, then $\gcd(p,q-1)=1$,
so $pa+(q-1)b=1$ for some $a$ and $b$.  Now look at
$2^{pa}\cdot2^{(q-1)b}$ \emph{modulo} $n$.)
  \end{xca}

  \begin{xca}
    Let $F_n=2^{2^n}+1$.  (Then $F_0,\dots,F_4$ are primes.)  Show 
    \begin{equation*}
      2^{F_n}\equiv2\pmod{F_n}.
    \end{equation*}
  \end{xca}

  \begin{xca}
    Show that $1105$, $2821$, and $15841$ are Carmichael
    numbers.\footnote{Carmichael did this in 1910~\cite{MR1558896}.}
    \begin{soln}
      First, factorize: $1105=5\cdot13\cdot17$,
      $2821=7\cdot13\cdot31$, and $15841=7\cdot31\cdot73$. 
    \end{soln}
  \end{xca}

  \begin{xca}\label{xca:p-1}
Assuming $p$ is an \emph{odd} prime:
    \begin{compactenum}
      \item
$(p-1)!\equiv p-1\pmod{1+2+\dotsb+(p-1)}$;
\item
$1\cdot3\dotsm(p-2)\equiv(-1)^{(p-1)/2}\cdot(p-1)\cdot(p-3)\dotsm2\pmod
  p$;
\item
$1\cdot3\dotsm(p-2)\equiv(-1)^{(p-1)/2}\cdot2\cdot4\dotsm(p-1)\pmod
  p$;
\item
$1^2\cdot 3^2\dotsm(p-2)^2\equiv(-1)^{(p+1)/2}\pmod p$. 
    \end{compactenum}
  \end{xca}

  \begin{xca}
$\mtau(n)\leq2\sqrt n$.
  \end{xca}

\begin{xca}\label{xca:prod-d}
$\prod_{d\divides n}=n^{\mtau(n)/2}$.  (See Exercise~\ref{xca:div-prod}.)
\end{xca}

  \begin{xca}
$\mtau(n)$ is odd if and only if $n$ is square.
  \end{xca}

  \begin{xca}
    Assuming $n$ is odd: $\msig(n)$ is odd if and only if $n$ is
    square. 
  \end{xca}

  \begin{xca}
    $\displaystyle\sum_{d\divides n}\frac 1d=\frac{\msig(n)}n$.
  \end{xca}

  \begin{xca}
    $\{n\colon\mtau(n)=k\}$ is infinite (when $k>1$), but
    $\{n\colon\msig(n)=k\}$ is finite.
  \end{xca}

  \begin{xca}
Let $m\in\Z$.
    The number-theoretic function $n\mapsto n^m$ is multiplicative.
  \end{xca}

  \begin{xca}\label{xca:div-p}
    Let $\upomega(n)$ be the number of \emph{distinct} prime divisors of
    $n$, and let $m$ be a non-zero integer.  Then $n\mapsto
    m^{\upomega(n)}$ is multiplicative. 
  \end{xca}

\begin{xca}\label{xca:Moebius-inv}
Prove the other half of the M\"obius Inversion Theorem (Theorem~\ref{thm:MIF} on page~\pageref{thm:MIF}): if $F$ and $f$ are arithmetic functions such that
\begin{equation*}
    f(n)=\sum_{d\divides n}\mmu\Bigl(\frac nd\Bigr)\cdot F(d),
  \end{equation*}
then
\begin{equation*}
F(n)=\sum_{d\divides n}f(d).
\end{equation*}
\end{xca}

  \begin{xca}\label{xca:Mangoldt-2}
  Let $\Lambda$ be the Mangoldt function defined in Exercise~\ref{xca:Mangoldt}.
     \begin{compactenum}
       \item
$\log n=\displaystyle\sum_{d\divides n}\Lambda(d)$.
\item
$\Lambda(n)=\displaystyle\sum_{d\divides n}\mmu\Bigl(\frac nd\Bigr)\log
  d$.
\item
$\Lambda(n)=-\displaystyle\sum_{d\divides n}\mmu(d)\log d$.
     \end{compactenum}
  \end{xca}

\begin{xca}
$\prod_{p\divides n}(1-p)=\sum_{d\divides n}\mmu(d)\cdot d$.
\end{xca}

  \begin{xca}\label{ex:f-mult}
If $f$ is multiplicative and non-zero, then
\begin{equation*}
\sum_{d\divides n}\mmu(d)\cdot f(d)=\prod_{p\divides n}(1-f(p)).
\end{equation*}
  \end{xca}

\begin{xca}
If $\upomega$ is as in Exercise \ref{xca:div-p}, then
$\displaystyle\sum_{d\divides n}\mmu(d)\cdot\mtau(d)=(-1)^{\upomega(n)}$.
  \end{xca}

%\section{Exercise Set}

%set VII

  \begin{xca}
    $f(568)=f(638)$ when $f\in\{\mtau,\msig,\ephi\}$.
  \end{xca}

  \begin{xca}
    Solve:
    \begin{compactenum}
      \item
$n=2\ephi(n)$.
\item
$\ephi(n)=\ephi(2n)$.
\item
$\ephi(n)=12$.  (Do this without a table.  There are 6 solutions.)
    \end{compactenum}
  \end{xca}

  \begin{xca}
    Find a sequence $(a_n\colon n\in\N)$ of positive integers such that
    \begin{equation*}
      \lim_{n\to\infty}\frac{\ephi(a_n)}{a_n}=0.
    \end{equation*}
(If you assume that there \emph{is} an answer to this problem, then it
    is not hard to see what the answer must be.  To actually
    \emph{prove} that the answer is correct, recall that, formally,
    \begin{equation*}
      \sum_n\frac 1n=\prod_p\frac1{1-\frac1p},
    \end{equation*}
so $\displaystyle\lim_{n\to\infty}\prod_{k=1}^n\frac1{1-\frac1{p_k}}=\infty$ if
$(p_k\colon k\in\N)$ is the list of primes.)
  \end{xca}

  \begin{xca}
    Prove $\displaystyle\sum_{d\divides
    n}\mmu(d)\ephi(d)=\prod_{p\divides n}(2-p)$.  (This is a special
    case of Exercise~\ref{ex:f-mult}.)
  \end{xca}

  \begin{xca}
    If $n$ is 
    squarefree, and $k\geq0$,
    show
    \begin{equation*}
      \sum_{d\divides n}\msig(d^k)\ephi(d)=n^{k+1}.
    \end{equation*}
  \end{xca}

  \begin{xca}
    $\displaystyle\sum_{d\divides n}\msig(d)\ephi\Bigl(\frac
    nd\Bigr)=n\mtau(n)$. 
  \end{xca}

  \begin{xca}
    $\displaystyle\sum_{d\divides n}\mtau(d)\ephi\Bigl(\frac
    nd\Bigr)=\msig(n)$. 
  \end{xca}
  \begin{xca}
    \begin{compactenum}
      \item
Show $a^{100}\equiv1\pmod{1000}$ if $\gcd(a,1000)=1$.
\item
Find $n$ such that $n^{101}\not\equiv n\pmod{1000}$.
    \end{compactenum}
  \end{xca}

  \begin{xca}\label{ex:a13}
    \begin{compactenum}
      \item
Show $a^{24}\equiv1\pmod{35}$ if $\gcd(a,35)=1$.
\item\label{a13}
Show $a^{13}\equiv a\pmod{35}$ for all $a$.
\item
Is there $n$ such that $n^{25}\not\equiv n\pmod{35}$?
    \end{compactenum}
  \end{xca}

  \begin{xca}
    If $\gcd(m,n)=1$, show $m^{\ephi(n)}\equiv n^{\ephi(m)}\pmod{mn}$. 
  \end{xca}

  \begin{xca}
    If $n$ is odd, and is not a prime power, and if $\gcd(a,n)=1$,
    show $a^{\ephi(n)/2}\equiv 1\pmod n$.  (This generalizes
    Exercise~\ref{ex:a13}\eqref{a13}.) 
  \end{xca}

  \begin{xca}
    Solve $5^{10000}x\equiv1\pmod{153}$.
  \end{xca}

%\section{Exercise Set}

%set VIII

  \begin{xca}
    We have $(\pm3)^2\equiv2\pmod7$.  Compute the orders of $2$, $3$,
    and~$-3$, \emph{modulo} $7$.
  \end{xca}

  \begin{xca}
Suppose $\ord na=k$, and $b^2\equiv a\pmod n$.
\begin{compactenum}
  \item
Show that $\ord nb\in\{k,2k\}$.
\item
Find an example for each possibility of $\ord nb$.
\item
Find a condition on $k$ such that $\ord nb=2k$.
\end{compactenum}
  \end{xca}

  \begin{xca}
This is about $23$:
    \begin{compactenum}
      \item\label{part:a}
Find a primitive root of least absolute value.    
\item
How many primitive roots are there?
\item
Find these primitive roots as powers of the root found
in~\eqref{part:a}.
\item
Find these primitive roots as elements of $[-11,11]$.
    \end{compactenum}
  \end{xca}

  \begin{xca}
    Assuming $\ord pa=3$, show:
    \begin{compactenum}
      \item
$a^2+a+1\equiv0\pmod3$;
\item
$(a+1)^2\equiv a\pmod 3$;
\item
$\ord p{a+1}=6$.
    \end{compactenum}
  \end{xca}

  \begin{xca}
    Find all elements of $[-30,30]$ having order $4$
    \emph{modulo} $61$.
  \end{xca}

  \begin{xca}
$f(x)\equiv0\pmod n$ may have more than $\deg(f)$ solutions:
    \begin{compactenum}
      \item
Find four solutions to $x^2-1\equiv0\pmod{35}$.
\item
Find conditions on $a$ such that the congruence
$x^2-a^2\equiv0\pmod{35}$ has four distinct solutions, and find these
solutions.
\item
If $p$ and $q$ are odd primes, find conditions on $a$ such that the
congruence $x^2-a^2\equiv0\pmod{pq}$ has four distinct solutions, and
find these solutions.
    \end{compactenum}
  \end{xca}

  \begin{xca}
    If $\ord na=n-1$, then $n$ is prime.
  \end{xca}

  \begin{xca}
If $a>1$, show $n\divides\ephi(a^n-1)$.
  \end{xca}

  \begin{xca}
If $2\ndivides p$ and $p\divides n^2+1$, show
    $p\equiv1\pmod4$. 
  \end{xca}

  \begin{xca}\mbox{}
    \begin{compactenum}
      \item
Find conditions on $p$ such that, if $r$ is a primitive root of $p$,
then so is $-r$.
\item
If $p$ does not meet these conditions, then what is $\ord p{-r}$?
    \end{compactenum}
  \end{xca}

%\section{Exercise Set}

%set IX


  \begin{xca}\label{IX.1}
For $(\Z/(17))^{\times}$:
    \begin{compactenum}
\item\label{IX.1(a)}
construct a table of logarithms using $5$ as the base; 
\item\label{IX.1(b)}
using this (or some other table, with a different base), solve:
\begin{compactenum}
  \item
$x^{15}\equiv14\pmod{17}$;
\item
$x^{4095}\equiv14\pmod{17}$;
\item
$x^4\equiv4\pmod{17}$;
\item
$11x^4\equiv7\pmod{17}$.
\end{compactenum}
    \end{compactenum}
  \end{xca}

  \begin{xca}
    If $n$ has primitive roots $r$ and $s$, and
    $\gcd(a,n)=1$, prove
    \begin{equation*}
      \log_sa\equiv\frac{\log_ra}{\log_rs}\pmod{\ephi(n)}.
    \end{equation*}
  \end{xca}

  \begin{xca}
    In $(\Z/(337))^{\times}$, for any base, show 
    \begin{equation*}
    \log(-a)\equiv\log a+168\pmod{336}.
    \end{equation*}
  \end{xca}

  \begin{xca}
    Solve $4^x\equiv13\pmod{17}$.
  \end{xca}

\begin{xca}\label{xca:ord-prod}
\begin{compactenum}
\item
If $\ord ra$ and $\ord rb$ are relatively prime, show
\begin{equation*}
\ord r{ab}=\lcm(\ord ra,\ord rb).
\end{equation*}
\item
Show that this may fail if $\ord ra$ and $\ord rb$ are not relatively prime.
\end{compactenum}
\end{xca}

  \begin{xca}
How many primitive roots has $22$?  Find them.
  \end{xca}

  \begin{xca}\label{IX.6}
    Find a primitive root of $1250$.
  \end{xca}

  \begin{xca}
    Define the function $\uplambda$ by the rules
    \begin{align*}
\uplambda(2^k)&=
\begin{cases}
  \ephi(2^k),&\text{ if }0<k<3;\\
  \ephi(2^k)/2,&\text{ if }k\geq3;
\end{cases}\\
\uplambda(2^k\cdot p_1{}^{\ell(1)}\dotsm p_m{}^{\ell(m)})
&=\lcm(\uplambda(2^k),\ephi(p_1{}^{\ell(1)}),\dotsc,\ephi(p_m{}^{\ell(m)})).
    \end{align*}
where the $p_i$ are distinct odd primes.\footnote{Carmichael defined
  this function in 1910~\cite{MR1558896}.}
\begin{compactenum}
  \item
Prove that, if $\gcd(a,n)=1$, then $a^{\uplambda(n)}\equiv1\pmod n$.
\item
Using this, show that, if $n$ is not $2$ or $4$ or an odd prime power
or twice an odd prime power, then $n$ has no primitive root.
\end{compactenum}
  \end{xca}

  \begin{xca}\label{IX.8}
    Solve the following quadratic congruences.
    \begin{compactenum}
      \item
$8x^2+3x+12\equiv0\pmod{17}$;
\item
$14x^2+x-7\equiv0\pmod{29}$;
\item
$x^2-x-17\equiv0\pmod{23}$;
\item
$x^2-x+17\equiv0\pmod{23}$.
    \end{compactenum}
  \end{xca}

%\section{Exercise Set}

% set X


  \begin{xca}\label{X.1}
The Law of Quadratic Reciprocity makes it easy to compute many Legendre
symbols, but this law is not always needed.  Compute $(n/17)$ and
$(m/19)$ for as many $n$ in $\{1,2,\dots,16\}$ and $m$ in
$\{1,2,\dots,18\}$ as you can, 
using only that, whenever $p$ is an odd prime, and $a$ and $b$ are
prime to $p$, then:
\begin{itemize}
  \item
$a\equiv b\pmod p\implies(a/p)=(b/p)$;
\item
$(1/p)=1$;
\item
$(-1/p)=(-1)^{(p-1)/2}$\;;
\item
$(a^2/p)=1$;
\item
$(2/p)=
  \begin{cases}
    1,&\text{ if }p\equiv\pm1\pmod8;\\
   -1,&\text{ if }p\equiv\pm3\pmod8.
  \end{cases}$
\end{itemize}
  \end{xca}


  \begin{xca}\label{X.2}
    Compute all of the Legendre symbols $(n/17)$ and $(m/19)$ by means
    of Gauss's Lemma. 
  \end{xca}

  \begin{xca}
    Find all primes of the form $5\cdot 2^n+1$ that have $2$ as a
    primitive root.
  \end{xca}

  \begin{xca}
    For every prime $p$, show that there is an integer $n$ such that
    \begin{equation*}
      p\divides(3-n^2)(7-n^2)(21-n^2).
    \end{equation*}
  \end{xca}

  \begin{xca}\mbox{}
    \begin{compactenum}
      \item
If $a^n-1$ is prime, show that $a=2$ and $n$ is prime.
\item
Primes of the form $2^p-1$ are called 
\textbf{Mersenne primes.}%
\index{Mersenne!--- prime}%
\index{prime!Mersenne ---}
Examples are $3$, $7$, and $31$.
Show
that, if $p\equiv3\pmod4$, and $2p+1$ is a prime $q$, then
$q\divides2^p-1$, and therefore $2^p-1$ is not prime.  (\emph{Hint:}
Compute $(2/q)$.)
    \end{compactenum}
  \end{xca}


  \begin{xca}\label{X.6}
    Assuming $p$ is an odd prime, and $2p+1$ is a prime $q$, show that $-4$
    is a primitive root of $q$.  (\emph{Hint:}  Show $\ord
    q{-4}\notin\{1,2,p\}$.) 
  \end{xca}

%\section{Exercise Set}

% set XI


  \begin{xca}\label{XI.1}
    Compute the Legendre symbols $(91/167)$ and $(111/941)$.
  \end{xca}

  \begin{xca}
Find $(5/p)$ in terms of the class of $p$ \emph{modulo}
$5$.  
  \end{xca}

  \begin{xca}
    Find $(7/p)$ in terms of the class of $p$
    \emph{modulo} $28$.
  \end{xca}

  \begin{xca}
The $n$th 
\textbf{Fermat number,}%
\index{Fermat!--- number, --- prime} or $F_n$, is $2^{2^n}+1$.  A
\textbf{Fermat prime}%
\index{prime!Fermat ---}
 is a Fermat number that is prime.
\begin{compactenum}
  \item
Show that every prime number of the form $2^m+1$ is a Fermat prime.
\item
Show $4^k\equiv4\pmod{12}$ for all positive $k$.
\item
If $p$ is a Fermat prime, show $(3/p)=-1$.
\item
Show that $3$ is a primitive root of every Fermat prime.
\item
Find a prime $p$ less than $100$ such that $(3/p)=-1$, but $3$ is not
a primitive root of $p$.
\end{compactenum}
  \end{xca}

  \begin{xca}
    Solve the congruence $x^2\equiv11\pmod{35}$.
  \end{xca}

  \begin{xca}\label{XI.6}
We have so far defined the Legendre symbol $(a/p)$ only when
    $p\ndivides a$; but if $p\divides a$, then we can define $(a/p)=0$.
    We can now define $(a/n)$ for
    arbitrary $a$ and arbitrary \emph{odd} $n$: the result is the
    \textbf{Jacobi symbol,}%
\index{Jacobi symbol}
and
    the definition is
    \begin{equation*}
      \ls an=\prod_p\ls ap^{k(p)},\quad\text{ where }\quad
      n=\prod_pp^{k(p)}. 
    \end{equation*}
    \begin{compactenum}
      \item
Prove that the function $x\mapsto(x/n)$ on $\Z$ is 
\textbf{completely multiplicative}%
\index{multiplicative function!completely ---}%
\index{completely multiplicative function}%
\index{function!completely multiplicative ---}
in the sense that $(ab/n)=(a/n)\cdot(b/n)$ for all
  $a$ and $b$ (not necessarily co-prime).
\item
If $\gcd(a,n)=1$, and the congruence $x^2\equiv a\pmod n$ is soluble,
show $(a/n)=1$.
\item
Find an example where $(a/n)=1$, and $\gcd(a,n)=1$, but $x^2\equiv
a\pmod n$ is insoluble.
\item
If $m$ and $n$ are co-prime, show
\begin{equation*}
  \ls mn\cdot\ls nm=(-1)^k,\quad\text{ where }\quad
  k=\frac{m-1}2\cdot\frac{n-1}2. 
\end{equation*}
    \end{compactenum}
  \end{xca}
%\Closesolutionfile{math-365-text-raw-solutions}

%\chapter{Solutions}

%\Readsolutionfile{math-365-text-raw-solutions}


\chapter{2007--8 examinations}\label{ch:exams}

In the following examinations,  the set of natural numbers is
$\{0,1,2,\dots\}$ or $\upomega$, while (as usual)
$\N=\upomega\setminus\{0\}=\{1,2,3,\dots\}$. 

\section{In-term examination}

% exam 1

The exam lasts 90 minutes.
All answers must be justified to the reader.

\begin{problem}
For all natural numbers $k$ and integers $n$, prove
\begin{equation*}
  k!\divides n\cdot(n+1)\dotsm(n+k-1).
\end{equation*}
\end{problem}

\begin{solution}
  \begin{equation*}
  \frac{n\cdot(n+1)\dotsm(n+k-1)}{k!}=
  \begin{cases}
    \displaystyle
\binom{n+k-1}k,&\text{ if }n>0;\\
0,&\text{ if }n\leq0<n+k;\\
(-1)^k\cdot\displaystyle
\binom{-n}k,&\text{ if }n+k\leq0.
  \end{cases}
  \end{equation*}
\end{solution}

\begin{remark*}
  Every binomial coefficient $\binom ji$ is an integer for the reason
  implied by its name:  it is one of the coefficients in the expansion
  of $(x+y)^j$.  (It is pretty obvious that those coefficients in this
  expansion must be integers, but one can prove it by induction on
  $j$.) 
\end{remark*}

\begin{remark*}
  In the set $\{n,n+1,\dots,n+k-1\}$, one of the elements is
  divisible by $k$, one by $k-1$, one by $k-2$, and so forth.  This
  observation is not enough to solve the problem, since for example,
  in the set $\{3,4,5\}$, one of the elements is divisible by $4$, one
  by $3$, and one by $2$, but $4!\ndivides 3\cdot 4\cdot 5$.
\end{remark*}

\begin{remark*}
  For similar reasons, proving the claim by induction is difficult.
  It is therefore not recommended.
  However, one way to proceed is as follows.  The claim is trivially true (for
  all~$n$) when $k=0$, since $0!=1$, which divides everything.  (When
  $k=0$, then the product $n\cdot(n+1)\dotsm(n+k-1)$ is the
  `empty product', so it should be understood as the neutral element for
  multiplication, namely~$1$.)
  As a first inductive hypothesis, we suppose the claim is true (for
  all~$n$) when
  $k=\ell$.  We want to show 
  \begin{equation}\label{1}
    (\ell+1)!\divides n\cdot(n+1)\dotsm(n+\ell)
  \end{equation}
for all $n$.  We first prove it when $n\geq-\ell$ by
entering a second induction.
The relation~\eqref{1} is true when $n=-\ell$, since then
$n\cdot(n+1)\dotsm(n+\ell)=0$.
As a second inductive
hypothesis, we suppose the relation is true when $n=m$, so that
  \begin{equation}\label{2}
    (\ell+1)!\divides m\cdot(m+1)\dotsm(m+\ell).
  \end{equation}
By the first inductive hypothesis, we have
\begin{equation*}
  \ell!\divides(m+1)\dotsm(m+\ell).
\end{equation*}
Since also $\ell+1\divides m+\ell+1-m$, we have
\begin{equation*}
  (\ell+1)!\divides(m+1)\dotsm(m+\ell)(m+\ell+1-m).
\end{equation*}
Distributing, we have
\begin{equation*}
  (\ell+1)!\divides(m+1)\dotsm(m+\ell)(m+\ell+1)-m\cdot(m+1)\dotsm(m+\ell).
\end{equation*}
By the second inductive hypothesis,~\eqref{2}, we conclude
\begin{equation*}
  (\ell+1)!\divides(m+1)\dotsm(m+\ell)(m+\ell+1).
\end{equation*}
So the second induction is complete, and~\eqref{1} holds when
$n\geq-\ell$.  It therefore holds for all $n$, since
\begin{equation*}
  n\cdot(n+1)\dotsm(n+\ell)=(-1)^{\ell+1}(-n-\ell)\cdot(-n-\ell+1)\dotsm(-n). 
\end{equation*}
Hence the \emph{first} induction is now complete.
\end{remark*}

\begin{problem}
  Find the least natural number $x$ such that 
  \begin{equation*}
    \begin{cases}
  x\equiv1\pmod5,\\
  x\equiv3\pmod 6,\\
  x\equiv5\pmod7.
    \end{cases}
  \end{equation*}
\end{problem}

\begin{solution}
We have
\begin{align*}
  6\cdot 7&\equiv1\cdot 2\equiv 2\pmod 5,& 2\cdot 3\equiv 1\pmod 5;\\
  5\cdot 7&\equiv-1\cdot1\equiv-1\pmod 5,& -1\cdot 5\equiv 1\pmod 6;\\
  5\cdot 6&\equiv-1\cdot(-2)\equiv 2\pmod 7,& 2\cdot 4\equiv 1\pmod 7.
\end{align*}
Therefore, \emph{modulo} $5\cdot 6\cdot 7$ (which is $210$), we
conclude
\begin{align*}
  x
&\equiv 1\cdot 6\cdot7\cdot3+3\cdot5\cdot7\cdot5+5\cdot5\cdot6\cdot
  4\\
&\equiv126+525+600\\
&\equiv1251\\
&\equiv201.
\end{align*}
Therefore \fbox{$x=201$} (since $0\leq201<210$).
\end{solution}

\begin{remark*}
  Instead of solving the equations
  \begin{align*}
  2x_1&\equiv 1\pmod5,\\
-1x_2&\equiv1\pmod6,\\
2x_3&\equiv1\pmod7,
  \end{align*}
(getting $(x_1,x_2,x_3)=(3,5,4)$ as above,) one may solve
  \begin{align*}
  2y_1&\equiv 1\pmod5,\\
-1y_2&\equiv3\pmod6,\\
2y_3&\equiv5\pmod7,
  \end{align*}
getting $(y_1,y_2,y_3)=(3,3,6)$.  But then
\begin{equation*}
    x\equiv 
6\cdot7\cdot3+5\cdot7\cdot3+5\cdot6\cdot6
\end{equation*}
(that is, one doesn't use as coefficients the numbers $1$, $3$, and
$5$ respectively, because they are already incorporated in the $y_i$).
\end{remark*}

\begin{remark*}
  Some people noticed, in effect, that the original system is
  equivalent to
  \begin{equation*}
    \begin{cases}
  x+9\equiv10\equiv0\pmod5,\\
  x+9\equiv12\equiv0\pmod 6,\\
  x+9\equiv14\equiv0\pmod7,
    \end{cases}
  \end{equation*}
which in turn means $x+9\equiv0\pmod{210}$ and so yields the minimal
positive solution $x=201$.  But not every such problem will be so easy.
\end{remark*}

\begin{problem}
  Find all integers $n$ such that $n^4+4$ is prime.
\end{problem}

\begin{solution}
We can factorize as follows:
\begin{align*}
  n^4+4
&=n^4+4n^2+4-4n^2\\
&=(n^2+2)^2-(2n)^2\\
&=(n^2+2+2n)\cdot(n^2+2-2n)\\
&=((n+1)^2+1)\cdot((n-1)^2+1).
\end{align*} 
Both factors are positive.  Moreover, one of the factors is $1$ if and
only if $n=\pm1$.  So $n^4+4$ is prime \emph{only} if $n=\pm1$.
Moreover, if
$n=\pm1$, then $n^4+4=5$, which is prime.  So the answer is,
\fbox{$n=\pm1$.} 
\end{solution}

\begin{problem}
  \begin{compactenum}
\item\label{a}
Find a solution to the equation $151x+71y=1$.
\item\label{b}
Find integers $s$ and $t$ such that
\begin{equation*}
\gcd(a,b)=1\implies\gcd(151a+71b,sa+tb)=1.
\end{equation*}
  \end{compactenum}
\end{problem}

\begin{solution}
\eqref{a} We compute
      \begin{align*}
151&=71\cdot2+9,\\
71&=9\cdot7+8, \\
9&=8\cdot 1+1,
      \end{align*}
and hence
      \begin{align*}
9&=151-71\cdot2,\\
8&=71-(151-71\cdot2)\cdot7=-151\cdot 7+71\cdot15,\\
1&=151-71\cdot2-(-151\cdot 7+71\cdot15)=151\cdot8-71\cdot17.
      \end{align*}
Thus, \fbox{$(8,-17)$} is a solution to $151x+71y=1$.

\eqref{b}
We want $s$ and $t$ such that, if
$a$ and $b$ are co-prime, then so are $151a+71b$ and $sa+tb$.  It is
enough if we can obtain $a$ and $b$ as linear combinations of
$151a+71b$ and $sa+tb$.  That is, it is enough if we can solve
\begin{equation*}
  (151a+71b)x+(sa+tb)y=a
\end{equation*}
and (independently) $(151a+71b)x+(sa+tb)y=b$.  The first equation can
be rearranged as
\begin{equation*}
  (151x+sy)a+(71x+ty)b=a,
\end{equation*}
which is soluble if and only if the linear system
\begin{equation*}
  \left\{
  \begin{aligned}
    151x+sy&=1,\\
    71x+ty&=0
  \end{aligned}
\right.
\end{equation*}
is soluble.  Similarly, we want to be able to solve
\begin{equation*}
  \left\{
  \begin{aligned}
    151x+sy&=0,\\
    71x+ty&=1.
  \end{aligned}
\right.
\end{equation*}
It is enough if the coefficient matrix 
$\begin{pmatrix}
  151&s\\
71&t
\end{pmatrix}$ is invertible \emph{over the integers;} this means
\begin{equation*}
\pm1=  \det\begin{pmatrix}
  151&s\\
71&t
\end{pmatrix}=151t-71s
\end{equation*}
(since $\pm1$ are the only invertible integers).  A solution to this
equation is \fbox{$(17,8)$.}
\end{solution}

\begin{remark*}
  Another method for \eqref{a} is to solve
  \begin{gather*}
    151x\equiv1\pmod{71},\\
9x\equiv1\pmod{71},\\
x\equiv8\pmod{71},
  \end{gather*}
and then solve
\begin{gather*}
  151\cdot8+71y=1,\\
y=\frac{-1207}{71}=-17.
\end{gather*}
But finding inverses may not always be so easy as finding the inverse
of $9$ \emph{modulo} $71$.
\end{remark*}

\begin{problem}
Find the least positive $x$ such that
\begin{equation*}
19^{365}x\equiv2007\pmod{17}.
\end{equation*}
\end{problem}

\begin{solution}
  By applying the elementary-school division algorithm as necessary
  [computations omitted here], we find
  \begin{gather*}
19\equiv2\pmod{17},\\
    365\equiv13\pmod{16},\\
2007\equiv1\pmod{17},
  \end{gather*}
which means our problem is equivalent to solving
\begin{gather*}
  2^{13}x\equiv1\pmod{17},\\
  x\equiv2^3\pmod{17},\\
  x\equiv8\pmod{17};
\end{gather*}
so \fbox{$x=8$} (since $0<8\leq17$).
\end{solution}

\begin{remark*}
  Some people failed to use that $2^{16}\equiv1\pmod{17}$ by Fermat's Theorem.  Of these, some happened to notice an alternative
  simplification: $2^4\equiv-1\pmod{17}$; but a simplification along
  these lines, unlike the Fermat Theorem, may not always be available.
\end{remark*}

\begin{problem}
Prove $a^{13}\equiv a\pmod{210}$ for all $a$.  
\end{problem}

\begin{solution}
  We have the prime factorization $210=2\cdot 3\cdot5\cdot7$, along
  with the following implications:
  \begin{itemize}
\item
If $2\ndivides a$, then $a\equiv1\pmod2$, and hence
$a^{12}\equiv1\pmod2$;
\item
if $3\ndivides a$,  then $a^2\equiv1\pmod3$, and hence
$a^{12}\equiv1\pmod3$;
\item
if $5\ndivides a$, then $a^4\equiv1\pmod2$, and hence $a^{12}\equiv1\pmod5$;
\item
if $7\ndivides a$, then $a^6\equiv1\pmod2$, and hence $a^{12}\equiv1\pmod7$.
  \end{itemize}
This means that, for all $a$, we have
\begin{gather*}
  a^{13}\equiv a\pmod 2,\\
  a^{13}\equiv a\pmod 3,\\
  a^{13}\equiv a\pmod 5,\\
  a^{13}\equiv a\pmod 7.
\end{gather*}
Therefore $a^{13}\equiv a\pmod{210}$ for all $a$, since
$210=\lcm(2,3,5,7)$. 
\end{solution}

\begin{remark*}
  One should be clear about the restrictions on $a$, if any.  The
  argument here assumes that the reader is familiar with the equivalence
  between the two forms of Fermat's Theorem:
  \begin{compactenum}
    \item
$a^{p-1}\equiv1\pmod p$ when $p\ndivides a$;
\item
$a^p\equiv p\pmod p$ for all $a$.
  \end{compactenum}
\end{remark*}

\begin{problem}
On $\upomega$, we define the binary relation $\leq$ so that $a\leq b$ if and
only if the equation $a+x=b$ is soluble.  Prove the following for all
natural numbers $a$, $b$, and $c$.  You may use the `Peano Axioms'
and the standard facts about addition and multiplication that follow
from them.
\begin{compactenum}
  \item
$0\leq a$.
\item
$a\leq b\iff a+c\leq b+c$.
\item
$a\leq b\iff a\cdot(c+1)\leq b\cdot (c+1)$.
\end{compactenum}
\end{problem}

\begin{solution}
  (a)  $0+a=a$.

(b)  By the definition of $\leq$, and the standard cancellation
  properties for addition, we have
  \begin{align*}
    a\leq b&\iff a+d=b\text{ for some }d\\
&\iff a+c+d=b+c\text{ for some }d\\
&\iff a+c\leq b+c.
  \end{align*}

(c)  We use induction on $a$.  By part (a), the claim is trivial when
  $a=0$.  Suppose it is true when $a=d$; we shall prove it is true
  when $a=d+1$.  Note that, if $d+1\leq b$, then $d+e+1=b$ for some
  $e$, so $b$ is a successor: $b=e+1$ for some $e$; in particular,
  $b\neq0$.  Similarly, if 
  $(d+1)\cdot(c+1)\leq b\cdot(c+1)$, then $b\neq0$, so $b$ is a
  successor.  So it is enough now to observe:
  \begin{align*}
    d+1\leq e+1&\iff d\leq e&&\text{[by (b)]}\\
&\iff d\cdot(c+1)\leq e\cdot(c+1)&&\text{[by I.H.]}\\
&\iff d\cdot(c+1)+c+1\leq e\cdot(c+1)+c+1&&\text{[by (b)]}\\
&\iff (d+1)\cdot(c+1)\leq (e+1)\cdot(c+1).
  \end{align*}
This completes the induction.
\end{solution}

\begin{remark*}
   In (c), one may proceed as in (b):
   \begin{align*}
     a\leq b
&\implies a+d=b\text{ for some }d\\
&\implies a\cdot(c+1)+d\cdot(c+1)=b\cdot(c+1)\\
&\implies a\cdot(c+1)\leq b\cdot(c+1).
   \end{align*}
Conversely, if $a\cdot(c+1)\leq b\cdot(c+1)$, then
$a\cdot(c+1)+d=b\cdot(c+1)$ for some $d$; but then $d$ must be a
multiple of $c+1$ (although this is not proved in my notes on
`Foundations of number-theory', which are the source of this
problem).  So we have
\begin{gather*}
  a\cdot(c+1)+e\cdot(c+1)=b\cdot(c+1),\\
(a+e)\cdot(c+1)=b\cdot(c+1),\\
a+e=b,\\
a\leq b
\end{gather*}
by the standard cancellation properties of multiplication.
\end{remark*}

\section{In-term examination}

% exam 2

The exam lasts 90 minutes.
Answers must be justified.  Solutions should follow a reasonably
efficient procedure.

\begin{problem}
  We define exponentiation on $\upomega$ recursively by $n^0=1$ and
  $n^{m+1}=n^m\cdot n$.  Prove that $n^{m+k}=n^m\cdot n^k$ for all
  $n$, $m$, and $k$ in $\upomega$.
\end{problem}

\begin{solution}
Use induction on $k$.  For the base step, that is, $k=0$, we have
\begin{equation*}
  n^{m+0}=n^m=n^m\cdot1=n^m\cdot n^0.
\end{equation*}
So the claim holds when $k=0$.
For the inductive step, suppose, as an inductive hypothesis, that the
claim holds when $k=\ell$, so that
\begin{equation*}
n^{m+\ell}=n^m\cdot n^{\ell}.  
\end{equation*}
Then
\begin{align*}
  n^{m+(\ell+1)}
&=n^{(m+\ell)+1}&&\\
&=n^{m+\ell}\cdot n&&\text{[by def'n of exponentiation]}\\
&=(n^m\cdot n^{\ell})\cdot n&&\text{[by inductive hypothesis]}\\
&=n^m\cdot(n^{\ell}\cdot n)&&\\
&=n^m\cdot n^{\ell+1}&&\text{[by def'n of exponentiation].}
\end{align*}
Thus the claim holds when $k=\ell+1$.  This completes the induction
and the proof.
\end{solution}

\begin{remark*}
  Some people apparently forgot that, by the convention of this
  course, the first element of $\upomega$ is $0$, so that the induction here
  must start with the case $k=0$.  This convention can be inferred
  from the statement of the problem, since the given recursive definition of
  exponentiation starts with $n^0$, not $n^1$.
\end{remark*}

\begin{remark*}
The formal recursive definition of exponentiation
is intended to be make precise the informal definition
\begin{equation*}
  n^m=\underbrace{n\cdot n\dotsm n}_m.
\end{equation*}
Likewise, mathematical induction makes precise the informal proof
\begin{equation*}
  n^{m+k}=\underbrace{n\cdot n\dotsm n}_{m+k}
=\underbrace{n\cdot n\dotsm n}_m\cdot\underbrace{n\cdot n\dotsm n}_k=
n^m\cdot n^k.
\end{equation*}
Everybody knows $n^{m+k}=n^m\cdot n^k$; the point of the problem is to
prove it precisely, so the informal proof is not enough.
\end{remark*}

\begin{problem}
  Find some $n$ such that $35\cdot\ephi(n)\leq 8n$.
\end{problem}

\begin{solution}
  We want $\displaystyle\frac{\ephi(n)}n\leq\frac8{35}$.  We have
  \begin{equation*}
    \frac{\ephi(n)}n=\prod_{p\divides n}\frac{p-1}p.
  \end{equation*}
If we take enough primes, this product should get down to $8/35$.  As
$35=5\cdot7$, we might try the primes up to $7$.  Indeed,
\begin{equation*}
  \frac
  12\cdot\frac23\cdot\frac45\cdot\frac67=\frac{2\cdot4}{5\cdot7}=\frac8{35};
\end{equation*}
so we may let \fbox{$n=2\cdot3\cdot5\cdot7=210$.}
\end{solution}


\begin{problem}
  Suppose $f$ and $g$ are multiplicative functions on
  $\N$.  Define~$h$ and $H$ by $h(n)=f(n)\cdot g(n)$ and
  $H(n)=\displaystyle\sum_{d\divides n}f(d)\cdot g\Bigl(\displaystyle\frac nd\Bigr)$.  Prove that these are
  multiplicative. 
\end{problem}

\begin{solution}
  Suppose $\gcd(m,n)=1$.  Then
  \begin{align*}
    h(mn)
&=f(mn)\cdot g(mn)&&\\
&=f(m)\cdot f(n)\cdot g(m)\cdot g(n)&&\text{[by multiplicativity of $f$ and $g$]}\\
&=f(m)\cdot g(m)\cdot f(n)\cdot g(n)&&\\
&=h(m)\cdot h(n),
  \end{align*}
so $h$ is multiplicative.  Also, since every divisor of $mn$ can be
factorized \emph{uniquely} as $d\cdot e$, where $d\divides m$ and
$e\divides n$, we have
\begin{align*}
  H(mn)
&=\sum_{d\divides mn}f(d)\cdot g\Bigl(\frac{mn}d\Bigr)&&\\
&=\sum_{d\divides m}\sum_{e\divides
    n}f(de)\cdot g\Bigl(\frac{mn}{de}\Bigr)&&\\
&=\sum_{d\divides m}\sum_{e\divides
    n}f(d)\cdot f(e)\cdot g\Bigl(\frac{m}{d}\Bigr)\cdot 
  g\Bigl(\frac{n}{e}\Bigr)&&\text{[mult.~of $f$, $g$]}\\
&=\sum_{d\divides m}f(d)\cdot \Bigl(\frac{m}{d}\Bigr)\cdot \sum_{e\divides
    n}f(e)\cdot g\Bigl(\frac{m}{d}\Bigr)\cdot 
  g\Bigl(\frac{n}{e}\Bigr)&&\text{[distributivity]}\\
&=\biggl(\sum_{d\divides m}f(d)\cdot \Bigl(\frac{m}{d}\Bigr)\biggr)\cdot \sum_{e\divides
    n}f(e)\cdot g\Bigl(\frac{m}{d}\Bigr)\cdot 
  g\Bigl(\frac{n}{e}\Bigr)&&\text{[distributivity]}\\
&=H(m)\cdot H(n),
\end{align*}
so $H$ is multiplicative.
\end{solution}

\begin{remark*}
  The assumption that $\gcd(m,n)=1$ is essential here, because
  otherwise we could not conclude, for example, $f(mn)=f(m)\cdot
  f(n)$; neither could we do the trick with the divisors of $mn$.
\end{remark*}

\begin{remark*}
  Since $f$ is multiplicative, we know for example that
  $\sum_{d\divides n}f(d)$ is a multiplicative function of $n$.  Hence
  $\sum_{d\divides n}f(n/d)$ is also multiplicative, since it is the
  same function.  Likewise, once we know that $fg$ is multiplicative,
  then we know that $\sum_{d\divides n}f(d)g(d)$ is multiplicative.
  But we \emph{cannot} conclude so easily that  $\sum_{d\divides
  n}f(d)g(n/d)$ is multiplicative.  It
  does not make sense to say
  $g(n/d)$ is multiplicative, since it has two variables.  We do not
  have $g(mn/d)=g(m/d)\cdot g(n/d)$; neither do we have
  $g(n/de)=g(n/d)\cdot g(n/e)$.  What we have is
  $g(mn/de)=g(m/d)g(n/e)$, if $d\divides m$ and $e\divides n$; but it
  takes some work to make use of this.
\end{remark*}

\begin{problem}
  Concerning $13$:
  \begin{compactenum}
\setlength{\itemsep}{0pt}
\setlength{\parsep}{0pt}
\setlength{\parskip}{0pt}
\setlength{\topsep}{0pt}
    \item
Show that $2$ is a primitive root.
\item
Find all primitive roots as powers of $2$.
\item
Find all primitive roots as elements of $[1,12]$.
\item
Find all elements of $[1,12]$ that have order $4$ \emph{modulo} $13$.
  \end{compactenum}
\end{problem}

\begin{solution}
  (a) \emph{Modulo} $13$, we have 
  \begin{equation*}
  \begin{array}{*{13}{|r}|}\hline
k  &1&2&3&4&5& 6& 7&8&9&10&11&12\\\hline
2^k&2&4&8&3&6&12&11&9&5&10& 7&1\\\hline
    \end{array}
  \end{equation*}

(b) $2^k$, where $\gcd(k,12)=1$; so \fbox{$2$, $2^5$, $2^7$,
    $2^{11}$.}

(c) From the table, \fbox{$2$, $6$, $11$, $7$.}

(d) $2^k$, where $4=12/\gcd(k,12)$, that is, $\gcd(k,12)=3$, so $k$ is
  $3$ or~$9$; so, again from the table, \fbox{$8$, $5$.}
\end{solution}

\begin{problem}[4 points]
  Prove $\displaystyle\sum_{d\divides
  n}\mmu(d)\cdot\msig(d)=\prod_{p\divides n}(-p)$. 
\end{problem}

\begin{solution}
  Each side of the equation is a multiplicative function of $n$, so it
  is enough to check the claim when $n$ is a prime power.
  Accordingly, we have 
  \begin{multline*}
    \sum_{d\divides
  p^s}\mmu(d)\cdot\msig(d)=\sum_{k=0}^s\mmu(p^k)\cdot\msig(p^k)=\\
    =\mmu(1)\cdot\msig(1)+\mmu(p)\cdot\msig(p)=1-(1+p)=-p=\prod_{q\divides p^s}(-q).  
  \end{multline*}
This establishes the claim when $n$ is a prime power, hence for all $n$.
\end{solution}

\begin{remark*}
  It should be understood in the product $\prod_{p\divides n}(-p)$
  that $p$ is prime.  This product is a multiplicative function of
  $n$, because if $\gcd(m,n)=1$, and $p\divides mn$, then $p\divides
  m$ or $p\divides n$, but not both, so that $\prod_{p\divides
  mn}(-p)=\prod_{p\divides m}(-p)\cdot\prod_{p\divides n}(-p)$.
\end{remark*}

\begin{remark*}
  Using multiplicativity of functions to prove their equality is a
  powerful technique.  It works like magic.  It is possible here to
  prove the desired 
  equation directly, for arbitrary $n$; but the proof is long and
  complicated.
It is not enough to write out part of the summation, detect a pattern,
  and claim (as some people did) that everything cancels but what is
  wanted: one must
  \emph{prove} this claim precisely.  One way is as follows.
Every positive integer $n$ can be written as $\prod_{p\in
  A}p^{s(p)}$,  
  where $A$ is a (finite) set of prime numbers, and each exponent
  $s(p)$ is at least $1$.  (Note the streamlined method of writing a
  product.)  Then the only divisors $d$ of
  $n$ for which $\mmu(d)\neq0$ are those divisors of the form $\prod_{p\in B}p$
  for some subset $B$ of $A$.  Moreover, each such number \emph{is} a divisor
  of $n$.  Hence
  \begin{align*}
    \sum_{d\divides n}\mmu(d)\cdot\msig(d)
&=\sum_{X\included A}\mmu\Bigl(\prod_{p\in
      X}p\Bigr)\cdot\msig\Bigl(\prod_{p\in X}p\Bigr)\\
&=\sum_{X\included A}(-1)^{\size X}\cdot\prod_{p\in X}(1+p)\\
&=\sum_{X\included A}(-1)^{\size X}\cdot\sum_{Y\included X}\prod_{p\in
      Y}p\\
&=\sum_{Y\included A}\prod_{p\in Y}p\cdot\sum_{Y\included X\included
      A}(-1)^{\size X}\\
&=\sum_{Y\included A}\prod_{p\in Y}p\cdot(-1)^{\size
      Y}\cdot\sum_{Z\included A\setminus Y}(-1)^{\size Z}\\
&=\sum_{Y\included A}\prod_{p\in Y}p\cdot(-1)^{\size
      Y}\cdot\sum_{j=0}^{\size{A\setminus Y}}\binom{\size{A\setminus
	Y}}j(-1)^j\\ 
&=\sum_{Y\included A}\prod_{p\in Y}p\cdot(-1)^{\size
      Y}\cdot(1+(-1))^{\size{A\setminus Y}}\\
&=\prod_{p\in A}p\cdot(-1)^{\size A}\\
&=\prod_{p\in A}(-p).
  \end{align*}
This proves the desired equation; but it is probably easier just to
use the multiplicativity of each side, as above.
\end{remark*}

\begin{problem}
  Solve $6^{3164}x\equiv2\pmod{365}$.
\end{problem}

\begin{solution}
  $365=5\cdot73$, so $\ephi(365)=\ephi(5)\cdot\ephi(73)=4\cdot72=288$.
  And $288$ goes into $3164$ ten times, with remainder $284$.
  Therefore, \emph{modulo} $365$, we have
  \begin{align*}
    6^{3164}x\equiv2&\iff 6^{284}x\equiv2\\
&\iff
    \begin{aligned}[t]
      x&\equiv2\cdot6^4\\
&\equiv2\cdot36^2\\
&\equiv2\cdot1296\\
&\equiv2\cdot201\\
&\equiv402\\
&\equiv37.
    \end{aligned}
  \end{align*}
\end{solution}

\begin{remark*}
  One may note that, since $4\divides 72$, we have that
  $a^{72}\equiv1\pmod{365}$ whenever $\gcd(a,365)=1$.  Such an
  observation might make computations easier in some problems, though
  perhaps not in this one.
\end{remark*}

\begin{problem}
  Show that the least positive primitive root of $41$ is $6$.  (Try to
  compute as few powers as possible.) 
\end{problem}

\begin{solution}
  $\ephi(41)=40=2^3\cdot5=8\cdot5$, so the proper divisors of
  $\ephi(41)$ are divisors of $8$ or $20$.  So we want to show,
  \emph{modulo} $41$,
  \begin{compactenum}
    \item
when $\ell\in\{2,3,4,5\}$, then either $\ell^8$ or $\ell^{20}$ is
congruent to $1$;
\item
neither $6^8$ nor $6^{20}$ is congruent to $1$.
  \end{compactenum}
To establish that $\ell^{2k}\equiv1$, it is enough to show
$\ell^k\equiv\pm1$. 
To establish that $\ell^{2k}\not\equiv1$, it is enough to show
$\ell^k\not\equiv\pm1$.  So we proceed:
\begin{compactenum}
  \item
$2^2\equiv4$; $2^4\equiv4^2\equiv16$;
    $2^8\equiv16^2\equiv256\equiv10$;
    $2^{10}\equiv2^8\cdot2^2\equiv10\cdot4\equiv40\equiv-1$. 
\item
$3^2\equiv9$; $3^4\equiv9^2\equiv81\equiv-1$.
\item
$4^5\equiv2^{10}\equiv-1$.
\item
$5^2\equiv25\equiv-16$;
  $5^4\equiv16^2\equiv256\equiv10\equiv2^8\equiv4^4$; hence
  $5^{20}\equiv4^{20}\equiv1$;
\item
$6^2\equiv36\equiv-5$; $6^4\equiv25\equiv-16$; $6^8\equiv256\equiv10$;
  $6^{10}\equiv10\cdot(-5)\equiv-50\equiv-9$; $6^{20}\equiv81\equiv-1$.
\end{compactenum}
\end{solution}

\begin{remark*}
  Another possible method is first to write out all of the powers of
  $6$ (\emph{modulo} $41$), thus
  showing that $6$ is a primitive root, and then to select from
  among these the other primitive roots of $41$, write them as
  positive numbers, and note that $6$ is
  the least.  That is, one can start with
  \begin{equation*}
    \begin{array}{*{11}{|r}|}\hline
k  &  1& 2&  3&  4&  5&  6&  7&  8&  9&10\\\hline
6^k&  6&-5& 11&-16&-14& -2&-12& 10& 19&-9\\\hline\hline
k  & 11&12& 13& 14& 15& 16& 17& 18& 19&20\\\hline
6^k&-13& 4&-17&-20&  3& 18&-15& -8& -7&-1\\\hline\hline
k  & 21&22& 23& 24& 25& 26& 27& 28& 29&30\\\hline
6^k& -6& 5&-11& 16& 14&  2& 12&-10&-19& 9\\\hline\hline
k  & 31&32& 33& 34& 35& 36& 37& 38& 39&40\\\hline
6^k& 13&-4& 17& 20& -3&-18& 15&  8&  7& 1\\\hline      
\end{array}
  \end{equation*}
Then $6$ is indeed a primitive root of $41$, so every primitive root
of $41$ takes the form $6^k$, where $\gcd(k,40)=1$.  So the incongruent
primitive roots are $2^k$, where
\begin{equation*}
k\in\{1,3,7,9,11,13,17,19,21,23,27,29,31,33,37,39\}
\end{equation*}
(that is, $k$
is an odd positive integer less than $40$ and indivisible by $5$).
From the table, if we convert these powers to congruent positive
integers less than $41$, we get the list
\begin{equation*}
  6,11,29,19,28,24,26,34,35,30,12,22,13,17,15,7
\end{equation*}
The least number on the list is $6$.
\end{remark*}

\begin{remark*}
  Some people noted that $6$ is the least element of the set
  $\{6^k\colon0<k\leq40\And\gcd(k,40)=1\}$.  This is true, but it
  does not establish the claim that $6$ is the least positive
  primitive root of $41$, since some of the powers in the set may be
  congruent \emph{modulo} $41$ to lesser positive numbers, which
  numbers will still be primitive roots.
\end{remark*}

\section{In-term examination}

% exam 3

The exam lasts 90 minutes.  
Several connected problems involve the prime number~$23$.
As usual, answers must be reasonably justified to the reader.  


Bracketed numbers (as [\ref{XI.1}]) 
refer to related homework exercises.

\begin{problem}\label{prob:Legendre}
Compute the Legendre symbol $\ls{63}{271}$.\hw{\ref{XI.1}}
\end{problem}

\begin{solution}
  $\ls{63}{271}
  =\ls{7\cdot3^2}{271}=\ls7{271}=-\ls{271}7=-\ls57=-\ls75=-\ls25=-(-1)=1$.   
\end{solution}

\begin{remark*}
  The computation uses the following features of the Legendre symbol:
  \begin{compactenum}
\item
the complete multiplicativity of $x\mapsto(x/p)$;
\item
that $(a/p)=\pm1$;
    \item
the Law of Quadratic Reciprocity;
\item
the dependence of $(a/p)$ only on the class of $a$ \emph{modulo} $p$;
\item
the rule for $(2/p)$.
  \end{compactenum}
%The Jacobi symbol $(-a/p)$ is not always equal to $-(a/p)$.
If $(p/q)=-(q/p)$ by the Law of Quadratic
Reciprocity, then also $-(q/p)=(-1/p)(q/p)=(-q/p)$, since
$p\equiv3\pmod4$.  So one could also argue
$(63/271)=(7\cdot 3^2/271)=(7/271)=-(271/7)=(-271/7)=(2/7)=1$. 

However, the equation $(63/271)=-(271/63)$
is not available without explanation and proof.  Because $63$ is not prime,
$(271/63)$ is not a Legendre symbol.  
It is a Jacobi symbol, but these were defined only in [\ref{XI.6}].
\end{remark*}

\begin{problem}[3 points]
  Find the Legendre symbol $(a/29)$, given that\hw{\ref{X.2}}
  \begin{equation*}
  \Bigl\{ka-29\cdot\left[\displaystyle\frac{ka}{29}\right]\colon 1\leq
  k\leq14\Bigr\}= \{1,2,5,6,7,10,11,12,15,16,20,21,25,26\}.
  \end{equation*}
\end{problem}

\begin{solution}
The given set has $6$ elements greater than $29/2$.
  Since $ka-29\cdot[ka/29]$ is the remainder of $ka$ after division by
  $29$, by Gauss's Lemma we have
  $(a/29)=(-a)^6=1$. 
\end{solution}

\begin{problem}[3 points]
  The numbers $1499$ and $2999$ are prime.  Find
  a primitive root of $2999$.\hw{\ref{X.6}}
\end{problem}

\begin{solution}
Since $2999=2\cdot1499+1$, it has the primitive root
$(-1)^{(1499-1)/2}\cdot 2$, that is,~$-2$.% [by a theorem proved in class].  
\end{solution}

\begin{remark*}
  The number $1499$ is a Germain prime.  If $p$ is a Germain prime, so
  that $2p+1$ is a prime $q$, then the number of (congruence classes 
  of) primitive roots of $q$ is $\ephi(\ephi(q))$, which is $p-1$ or
  $(q-3)/2$.  So \emph{almost} half the numbers that are prime to $q$
  are primitive roots of $q$.  We showed $(-1)^{(p-1)/2}\cdot2$ is a
  primitive root; the cited homework exercise shows $-4$ is a
  primitive root.
By the same method of proof, if $q\ndivides r$, then the following are
  equivalent:
  \begin{compactenum}
    \item
$r$ is a primitive root of $q$;
\item
$\ord qr\not\in\{1,2,p\}$;
\item
$r\not\equiv\pm1\pmod q$ and $(r/q)=1$.
  \end{compactenum}
In particular, to show $r$ is a primitive root of $q$, it is not
enough to show $(r/q)=1$.  (One must also show $r^2\neq1\pmod q$; and
again, this is enough only in case $(q-1)/2$ is prime.)
\end{remark*}

\begin{problem}[4 points]\label{prob:logs}
Fill out the following table of logarithms.  (It should be clear what
method you used.) \hw{\ref{IX.1}\eqref{IX.1(a)}}
%\renewcommand{\arraystretch}{1.6}
\begin{equation*}
  \begin{array}{|c*{11}{|p{0.4cm}}|l|}\hline
    k&$1$&$2$&$3$&$4$&$5$&$6$&$7$&$8$&$9$&$10$&$11$&
    (\operatorname{mod} 23)\\\hline 
 \log_5k&&&&&&&&&&&&(\operatorname{mod} 22)\\\hline
 \log_5(-k)&&&&&&&&&&&&(\operatorname{mod} 22)\\\hline
  \end{array}
\end{equation*}
\end{problem}

\begin{solution}
  First compute powers of $5$, then rearrange:
%\renewcommand{\arraystretch}{1.3}
\begin{gather*}
  \begin{array}{|c*{11}{|r}|l|}\hline
    \ell&0&1&2&3&4&5&6&7&8&9&10&
    (\operatorname{mod} 22)\\\hline 
    5^{\ell}&1&5&2&10&4&-3&8&-6&-7&11&9&(\operatorname{mod} 23)\\\hline
    5^{\ell+11}&-1&-5&-2&-10&-4&3&-8&6&7&-11&-9&(\operatorname{mod}
    23)\\\hline 
  \end{array}\\
  \begin{array}{|c*{11}{|r}|l|}\hline
         k & 1& 2& 3& 4& 5& 6& 7& 8& 9&10&11&(\operatorname{mod} 23)\\\hline 
 \log_5  k & 0& 2&16& 4& 1&18&19& 6&10& 3& 9&(\operatorname{mod} 22)\\\hline
 \log_5(-k)&11&13& 5&15&12& 7& 8&17&21&14&20&(\operatorname{mod} 22)\\\hline
  \end{array}
\end{gather*}
\end{solution}

\begin{remark*}
  Implicitly, $5$ must be a primitive root of $23$, which implies
  $5^{11}\equiv-1\pmod{23}$.  Hence $\log_5(-1)\equiv11\pmod{22}$, and more
  generally $\log_5(-k)\equiv\log_5 k\pm11\pmod{22}$.  Thus the second
  row of the table can be obtained easily from the first.
\end{remark*}

\begin{problem}[3 points]\label{prob:L-table}
%\renewcommand{\arraystretch}{2}
  Fill out the following table of Legendre symbols.  (Again, your
  method should be clear.)
  \begin{equation*}
    \begin{array}{|c*{11}{|p{0.5cm}}|}\hline
      a&$1$&$2$&$3$&$4$&$5$&$6$&$7$&$8$&$9$&$10$&$11$\\\hline
\ls{a}{23}&&&&&&&&&&&\\\hline
\ls{-a}{23}&&&&&&&&&&&\\\hline
    \end{array}
  \end{equation*}
\end{problem}

\begin{solution}
  The quadratic residues of $23$ are just the even powers of a
  primitive root, such as $5$.  Those even powers are just the numbers
  whose logarithms are even.  So, in the logarithm table in
  Problem~\ref{prob:logs}, we can replace even numbers with $1$, and
  odd numbers with 
  $-1$, obtaining
%\renewcommand{\arraystretch}{2}
  \begin{equation*}
    \begin{array}{|c*{11}{|r}|}\hline
      a&1&2&3&4&5&6&7&8&9&10&11\\\hline
\ls{a}{23}&
        1&1&1&1&-1&1&-1&1&1&-1&-1\\\hline
\ls{-a}{23}&
        -1&-1&-1&-1&1&-1&1&-1&-1&1&1\\\hline
    \end{array}
  \end{equation*}
\end{solution}

\begin{remark*}
One can find the Legendre symbols by means of Euler's Criterion and
the properties in the remark on Problem~\ref{prob:Legendre} (as in
[\ref{X.1}]), or by Gauss's Lemma (as in [\ref{X.2}]); but
really, all of the necessary work has already been done in
Problem~\ref{prob:logs}.   
\end{remark*}

\begin{problem}[7 points]
Solve the following congruences \emph{modulo} $23$.\hw{\ref{IX.1}\eqref{IX.1(b)}}
\begin{multicols}{2}
\begin{compactenum}
  \item
$x^2\equiv 8$
\item
$x^{369}\equiv7$
\end{compactenum}
\end{multicols}
\end{problem}

\begin{solution}
(a)  From the solution to Problem~\ref{prob:logs}, we have
  $8\equiv5^6\equiv(5^3)^2\equiv10^2$, so
  \begin{equation*}
    x^2\equiv 8\iff \text{\fbox{$x\equiv\pm10\equiv10,13$}}.
  \end{equation*}
  \begin{minipage}[t]{10cm}
  (b)  From the computation at the right, as well as
  Problem~\ref{prob:logs}, we have
\begin{align*}
  x^{369}\equiv7\pmod{23}
&\iff x^{17}\equiv7\pmod{23}\\
&\iff 17\log_5x\equiv 19\pmod{22}\\
&\iff\log_5x\equiv\frac{19}{17}\equiv\frac{-3}{-5}\equiv\frac35\pmod{22}\\
&\iff\log_5x\equiv
  3\cdot 9\equiv27\equiv5\pmod{22}\\
&\iff x\equiv 5^5\equiv-3\pmod{23}\\
&\iff\text{\fbox{$x\equiv20$}}\pmod{23}
\end{align*}
  \end{minipage}
\hfill
%  Code from TUGboat Vol. 18 (1997), No. 2 
\newdimen\digitwidth
\settowidth\digitwidth{0}
\def~{\hspace{\digitwidth}}
\def\divrule#1#2{%
   \noalign{\moveright#1\digitwidth%
   \vbox{\hrule width#2\digitwidth}}}
22\,
\begin{tabular}[b]{@{}r@{}}
   16\\\hline
\big)
\begin{tabular}[t]{@{}l@{}}
  369\\
  22\\\divrule02
  149\\
  132\\\divrule03
  ~17
\end{tabular}
\end{tabular}
\end{solution}

\begin{remark*}
Some people seemed to overlook the information available from
  Problem~\ref{prob:logs}. 
  In part (a), one may note from Problem~\ref{prob:L-table} that there
  must be a solution, since $(8/23)=1$; but there is no need to do
  this, if one actually \emph{finds} the solutions.
\end{remark*}

\begin{problem}[3 points]
Solve the congruence $x^2-x+5\equiv0\pmod{23}$.    \hw{\ref{IX.8}}
\end{problem}

\begin{solution}
  Complete the square:
  \begin{align*}
    x^2-x+5\equiv0
&\iff x^2-x+\frac14\equiv\frac14-5\equiv\frac{-19}4\equiv1\\
&\iff\Bigl(x-\frac12\Bigr)^2\equiv1\\
&\iff x-\frac12\equiv\pm 1\\
&\iff x\equiv\frac12\pm1\equiv12\pm1\equiv\text{\fbox{$11,13$}}\pmod{23}.
  \end{align*}
\end{solution}

\begin{remark*}
  Although fractions with denominators prime to $23$ are permissible
  here, one may avoid them thus:
  \begin{align*}
    x^2-x+5\equiv0
&\iff x^2+22x+5\equiv0\\
&\iff x^2+22x+121\equiv 121-5\equiv 116\equiv1\\
&\iff (x+11)^2\equiv1\\
&\iff x+11\equiv\pm1.
  \end{align*}
Alternatively, one may apply the identity
\begin{equation*}
  4a(ax^2+bx+c)=(2ax+b)^2-(b^2-4ac),
\end{equation*}
finding in the present case
\begin{align*}
  x^2-x+5\equiv0
&\iff 4x^2-4x+20\equiv0\\
&\iff(2x-1)^2\equiv1-20\equiv-19\equiv4.  
\end{align*}
All approaches used to far can be used on any quadratic congruence
(with odd prime modulus).  Nonetheless, many people chose to look for
a factorization.  Here are some that were found:
\begin{gather*}
  x^2-x+5\equiv x^2-x-110\equiv(x-11)(x+10);\\
  x^2-x+5\equiv x^2-x+143\equiv(x-11)(x-13);\\
  \begin{aligned}
    &x^2-x+5\equiv0\\
&\iff-22x^2+22x-18\equiv0\\
&\iff-11x^2+11x-9\equiv0\\
&\iff12x^2-12x+14\equiv0\\
&\iff6x^2-6x+7\equiv0\\
&\iff6x^2+17x+7\equiv0\\
&\iff(3x+7)(2x+1)\equiv0;
  \end{aligned}\qquad\qquad
  \begin{aligned}
    &x^2-x+5\equiv0\\
&\iff-22x^2+22x-18\equiv0\\
&\iff-11x^2+11x-9\equiv0\\
&\iff12x^2+11x-9\equiv0\\
&\iff12x^2-12x-9\equiv0\\
&\iff4x^2-4x-3\equiv0\\
&\iff(2x-3)(2x+1)\equiv0;
  \end{aligned}\\
  \begin{aligned}
    &x^2-x+5\equiv0\\
&\iff24x^2+22x+28\equiv0\\
&\iff12x^2+11x+14\equiv0\\
&\iff12x^2+34x+14\equiv0\\
&\iff(4x+2)(3x+7)\equiv0;
  \end{aligned}\qquad\qquad
  \begin{aligned}
    &x^2-x+5\equiv0\\
&\iff24x^2+22x+5\equiv0\\
&\iff(12x+5)(2x+1)\equiv0.
  \end{aligned}
\end{gather*}
But for such problems, it does not seem advisable to rely on one's
ingenuity to find factorizations.  How would one best solve a congruence
like $x^2-2987+2243\equiv0\pmod{2999}$?
\end{remark*}

\begin{problem}[4 points]
Explain briefly why exactly one element $n$ of the set $\{2661,2662\}$
has a primitive root.  Give two numbers such that at
least one of them is a primitive root of $n$.\hw{\ref{IX.6}}
\end{problem}

\begin{solution}
  The numbers with primitive roots are just $2$, $4$, odd prime
  powers, and doubles of odd prime powers.  Since $2661=3\cdot887$,
  and $3\ndivides887$, the number $2661$ has no primitive root.  However,
  $2662=2\cdot1331=3\cdot11\cdot121=2\cdot 11^3$, so this has a
  primitive root.

By the computation
\begin{align*}
  \begin{array}{|c *{5}{|r}|c|}\hline
  k&1&2& 3& 4& 5&(\operatorname{mod}10)\\\hline
2^k&2&4&-3&-6&-1&(\operatorname{mod}11)\\\hline
  \end{array}
\end{align*}
we have that $2$ is a primitive root of $11$.  Therefore $2$ or $2+11$
is a primitive root of $121$.  Therefore $2+121$ or $2+11$ is a primitive
root of $121$, hence of $1331$, hence of $2662$.
\end{solution}

\begin{remark*}
  This problem relies on the following propositions about odd primes
  $p$: 
  \begin{compactenum}
    \item
if $r$ is a primitive root of $p$, then $r$ or $r+p$ is a primitive
root of $p^2$;
\item
every primitive root of $p^2$ is a primitive root of every higher
power $p^{2+k}$;
\item
every \emph{odd} primitive root of $p^{\ell}$ is a primitive root of
$2\cdot p^{\ell}$.
  \end{compactenum}
One must also observe that being a primitive root is a property of the
\emph{congruence class} of a number, so if $r\equiv s\pmod n$, and $r$
is a primitive root of $p$, then so is~$s$.  
\end{remark*}

\section{Final Examination}

You may take 120 minutes.  
Several connected problems involve the Fermat prime~$257$.
As usual, answers must be reasonably justified.  


A table of powers of $3$ \emph{modulo} $257$ was provided
for use in several problems [see Table~\ref{tab:257}].
\begin{sidewaystable}
\centering
$\setlength{\arraycolsep}{2pt}
  \begin{array}{|c||*{16}{r|}}\hline
     k &1&2&3&4&5&6&7&8&9&10&11&12&13&14&15&16\\\hline\hline
 3^k &3&9&27&81&-14&-42&-126&-121&-106&-61&74&-35&-105&-58&83&-8\\\hline
 3^{16+k} &-24&-72&41&123&112&79&-20&-60&77&-26&-78&23&69&-50&107&64\\\hline
 3^{32+k} &-65&62&-71&44&-125&-118&-97&-34&-102&-49&110&73&-38&-114&-85&2\\\hline
 3^{48+k} &6&18&54&-95&-28&-84&5&15&45&-122&-109&-70&47&-116&-91&-16\\\hline
 3^{64+k} &-48&113&82&-11&-33&-99&-40&-120&-103&-52&101&46&-119&-100&-43&128\\\hline
 3^{80+k} &127&124&115&88&7&21&63&-68&53&-98&-37&-111&-76&29&87&4\\\hline
 3^{96+k} &12&36&108&67&-56&89&10&30&90&13&39&117&94&25&75&-32\\\hline
 3^{112+k} &-96&-31&-93&-22&-66&59&-80&17&51&-104&-55&92&19&57&-86&-1\\\hline
  \end{array}$
\caption{Powers of $3$ \emph{modulo} $257$}\label{tab:257}
\end{sidewaystable}

\begin{problem}
  For positive integers $n$, let $\omega(n)=\size{\{p\colon
  p\divides n\}}$, the number
  of primes dividing~$n$.
  \begin{compactenum}
    \item
Show that the function $n\mapsto2^{\omega(n)}$ is multiplicative.
\item
Define the M\"obius function $\mmu$ in terms of $\omega$.
\item
Show $\displaystyle\sum_{d\divides n}\size{\mmu(d)}=2^{\omega(n)}$ for
all positive integers $n$.
  \end{compactenum}
\end{problem}
Powers of $3$ \emph{modulo} $257$:

\begin{solution}
  \begin{compactenum}
    \item
If $\gcd(m,n)=1$, then $\omega(mn)=\omega(m)+\omega(n)$, so
\begin{equation*}
2^{\omega(mn)}=2^{\omega(m)+\omega(n)}=2^{\omega(m)}\cdot
2^{\omega(n)}.
\end{equation*}
\item
$\mmu(n)=
  \begin{cases}
    0,&\text{ if $p^2\divides n$ for some $p$;}\\
(-1)^{\omega(n)},&\text{ otherwise.}
  \end{cases}$
\item
As $\mmu$ is multiplicative, so are $\size{\mmu}$ and
$n\mapsto\sum_{d\divides n}\size{\mmu(d)}$.  Hence it is enough to
establish the equation when $n$ is a prime power.  We have
\begin{equation*}
  \sum_{d\divides p^s}\size{\mmu(d)}=\sum_{k=0}^s\size{\mmu(p^k)}
=\size{\mmu(1)}+\size{\mmu(p)}=1+1=2=2^1=2^{\omega(p^s)}.
\end{equation*}
  \end{compactenum}
\end{solution}

  \begin{problem}
    Fill out the following table of Legendre symbols:
    \begin{equation*}
      \begin{array}{|c*{9}{|r}|}\hline
	a&1&2&3&5&7&11&13&17&19\\\hline
\left(\displaystyle\frac a{257}\right)&&&&&&&&&\\\hline
      \end{array}
    \end{equation*}
  \end{problem}

  \begin{solution}
By the table of powers, $3$ must be a primitive root of $257$.  Hence
$(a/257)=1$ if and only if $a$ is an even power of $3$ \emph{modulo}
$257$.  In particular, $(-1/257)=1$, so $(a/257)=(-a/257)$.  So the
table of powers yields the answers:
\begin{equation*}
      \begin{array}{|c*{9}{|r}|}\hline
	a&1&2&3&5&7&11&13&17&19\\\hline
\left(\displaystyle\frac a{257}\right)&1&1&-1&-1&-1&1&1&1&-1\\\hline
      \end{array}
    \end{equation*}    
  \end{solution}

  \begin{remark*}
    Many people preferred to find these Legendre symbols by means of
    the Law of Quadratic Reciprocity.  Possibly this method is faster than
    hunting for numbers in the table of powers; but it may also provide
    more opportunity for error.
  \end{remark*}

  \begin{problem}
In the following table, in the box below each number $a$, write the
least positive integer $n$ such that $\ord{257}n=a$. 
\begin{equation*}
  \begin{array}{*{9}{|r}|}\hline
    1&2&4&8&16&32&64&128&256\\\hline
     & & & &  &  &  &   &    \\\hline
  \end{array}
\end{equation*}
  \end{problem}

  \begin{solution}
    If $r$ is a primitive root of $257$, then
    $\ord{257}{r^{256/a}}=a$.  The primitive roots of $257$ are $3^s$,
    where $s$ is odd.  So below $a$ we want the least $n$ such that
    $n\equiv3^{(256/a)\cdot s}$ for some odd $s$. 
    (In searching the table of powers, since $3^{k+128}\equiv-3^k$, we can
    ignore signs, except when $a\leq2$.  For example, when $a=4$, then
    $3^{(256/a)\cdot s}=3^{64s}$, so $n$ can only be $\size{3^{64}}$.
    When $a=32$, then $3^{(256/a)\cdot s}=3^{8s}$, so $n$ will be the
    absolute value of an entry in the column of powers that is headed
    by $8$.) 
\begin{equation*}
  \begin{array}{*{9}{|r}|}\hline
    1&  2& 4&8&16&32&64&128&256\\\hline
    1&256&16&4& 2&15&11&  9&  3\\\hline
  \end{array}
\end{equation*}
  \end{solution}

  \begin{remark*}
Another way to approach the problem is to note that
\begin{equation*}
    \ord{257}{3^k}=\frac{256}{\gcd(256,k)}.
\end{equation*}
Then one must look among those powers $3^k$ such that
$\gcd(256,k)=256/a$.  \emph{Some} explanation is necessary, though it
need not be so elaborate as what I gave above.

    Some people apparently misread the problem as asking for the
    orders of the given numbers.  Others provided numbers that had the
    desired orders; but they weren't the \emph{least positive} such numbers.
  \end{remark*}

  \begin{problem}
    Solve $x^2+36x+229\equiv0\pmod{257}$.
  \end{problem}

  \begin{solution}
Complete the square:
    $(36/2)^2=(2\cdot 9)^2=4\cdot 81=324$, and $324-229=95$, so (using
    the table of powers)
    \begin{align*}
      x^2+36x+229\equiv0
&\iff(x+18)^2\equiv95\equiv3^{128+52}\equiv3^{180}\equiv(3^{90})^2\\
&\iff x+18\equiv\pm3^{90}\equiv\mp98\\
&\iff x\equiv-116,80\\
&\iff x\equiv 141,80\pmod{257}.
    \end{align*}
  \end{solution}

  \begin{remark*}
    There were a few unsuccessful attempts to factorize the polynomial
    directly.  See my remark on Problem 7 of Exam 3.
  \end{remark*}

  \begin{problem}
    Solve $197^x\equiv137\pmod{257}$.
  \end{problem}

  \begin{solution}
From the table of powers of $3$, we can obtain logarithms:
    \begin{align*}
      197^x\equiv137\pmod{257}
&\iff(-60)^x\equiv-120\pmod{257}\\
&\iff x\log_3(-60)\equiv\log_3(-120)\pmod{256}\\
&\iff x\cdot24\equiv72\pmod{256}\\
&\iff x\cdot8\equiv24\pmod{256}\\
&\iff x\equiv3\pmod{32}\\
&\iff x\equiv 3,35,67,99,131,163,195,227\pmod{256}.
    \end{align*}
  \end{solution}

  \begin{remark*}
    A number of people overlooked the change of modulus when passing
    from $x\cdot 8\equiv24$ to $x\equiv 3$.  One need not use
    logarithms explicitly; one can observe instead
    $197\equiv-60\equiv3^{24}$ and
    $137\equiv-120\equiv3^{72}\pmod{256}$, so that
    \begin{align*}
      197^x\equiv137\pmod{257}
&\iff3^{24x}\equiv3^{72}\pmod{257}\\      
&\iff24x\equiv72\pmod{256},
    \end{align*}
and then proceed as above.
  \end{remark*}

\begin{problem}
Solve $127x+55y=4$.
\end{problem}

\begin{solution}
  Use the Euclidean algorithm:
  \begin{equation*}
    \begin{aligned}[t]
      127&=55\cdot2+17,\\
       55&=17\cdot3+4,\\
       17&= 4\cdot 4+1,
    \end{aligned}\qquad
    \begin{aligned}[t]
      17&=127-55\cdot 2,\\
 4&=55-(127-55\cdot2)\cdot3=55\cdot7-127\cdot3,\\
1&=17-4\cdot4=127-55\cdot2-(55\cdot7-127\cdot3)\cdot4\\
&=127\cdot13-55\cdot30.
    \end{aligned}
  \end{equation*}
Hence $4=127\cdot52-55\cdot 120$, and $\gcd(127,55)=1$, so the
original equation has the general 
solution 
\begin{equation*}
(52,-120)+(55,-127)\cdot t.
\end{equation*}
\end{solution}

\begin{remark*}
Some people omitted
  to find the general solution.
  In carrying out the Euclidean algorithm here, one can save a step,
  as some people did, by
  noting that, once we find $4=55\cdot 7-127\cdot3$, we need not find
  $1$ as a linear combination of $127$ and $55$; we can pass
  immediately to the general solution $(7,-3)+(55,-127)\cdot t$.
\end{remark*}

\begin{problem}
  Solve $x^2\equiv59\pmod{85}$.
\end{problem}

\begin{solution}
Since $85=5\cdot 17$, we first solve $x^2\equiv59$ \emph{modulo} $5$
and $17$ separately:
\begin{equation*}
  \begin{aligned}[t]
 &   x^2\equiv59\pmod5\\
&\iff x^2\equiv4\pmod5\\
&\iff x\equiv\pm2\pmod5;
  \end{aligned}\qquad
  \begin{aligned}[t]
& x^2\equiv59\pmod{17}\\
&\iff x^2\equiv8\pmod{17}\\
&\iff x^2\equiv25\pmod{17}\\
&\iff x\equiv\pm5\pmod{17}.
  \end{aligned}
\end{equation*}
Now there are four systems to solve:
\begin{gather*}
  \left.
\begin{aligned}
    x&\equiv\pm2\pmod5\\
x&\equiv\pm5\pmod{17}
  \end{aligned}
\right\}
\iff x\equiv\pm22\pmod{85},\\
\left.
\begin{aligned}
    x&\equiv\pm2\pmod5\\
x&\equiv\mp5\pmod{17}  
\end{aligned}
\right\}
\iff x\equiv\pm12\pmod{85}.
\end{gather*}
(I solved these by trial.)
So the original congruence is solved by
\begin{equation*}
  x\equiv\pm22,\pm12\pmod{85},
\end{equation*}
or $x\equiv12,22,63,73\pmod{85}$.
\end{solution}

\begin{remark*}
  One may, as some people did, use the algorithm associated with the
  Chinese Remainder Theorem here.  Even if we do not use the
  algorithm, we rely on it to know that the solution we find to each
  pair of congruences is the \emph{only} solution.  Some used a
  theoretical formation of the solution, noting for example that 
$\left\{\begin{aligned}
    x&\equiv2\pmod5\\
x&\equiv5\pmod{17}
  \end{aligned}
\right\}$ has the solution $x\equiv2\cdot17^{\ephi(5)}+5\cdot
5^{\ephi(17)}\pmod{85}$; but this is not \emph{useful} (the number is
not between $0$ and $85$, or between $-85/2$ and $85/2$).
\end{remark*}

\chapter{2010--1 examinations}\label{ch:exams-2}

\section{In-term examination}

\begin{problem}
Let $\upomega=\{0,1,2,\dots\}$.  All variables in this problem range over
$\upomega$.  Given $a$ and $b$ such that $a\neq0$, we define 
\begin{equation*}
\rem{b,a}=r,
\end{equation*}
if $b=ax+r$ for some $x$, and $r<a$.
\begin{enumerate}
\item
Prove $\rem{a+b,n}=\rem{\rem{a,n}+\rem{b,n},n}$.
\item
Prove $\rem{ab,n}=\rem{\rem{a,n}\cdot\rem{b,n},n}$.
\end{enumerate}
\end{problem}

\begin{solution}
\begin{asparaenum}
\item
For $\rem{c,n}$, write $c'$.  Then for some $x$, $y$, and $z$ in
$\upomega$, we have
\begin{align*}
  a&=nx+a',&
b&=ny+b',&
a'+b'&=nz+(a'+b')',
\end{align*}
hence $a+b=n(x+y+z)+(a'+b')'$.
Since $(a'+b')'<n$, 
we have
\begin{equation*}
(a+b)'=(a'+b')'
\end{equation*}
as desired.
\item
With the same notation, for some $w$ in $\upomega$ we have
\begin{equation*}
  a'\cdot b'=nw+(a'\cdot b')',
\end{equation*}
so for some $u$ in $\upomega$, we have
$ab=nu+a'\cdot b'=n(w+u)+(a'\cdot b')'$,
and therefore (since $(a'\cdot b')'<n$) we have 
\begin{equation*}
(ab)'=(a'\cdot b')'
\end{equation*}
as desired.
\end{asparaenum}
\end{solution}

\begin{remark}
Books VII, VIII, and IX of Euclid's \emph{Elements} develop some of
the theory of what we would call the positive integers.  If we allow also
a zero, but not negative numbers, then we could define
\begin{equation*}
  a\equiv b\pmod n\iff \rem{a,n}=\rem{b,n}.
\end{equation*}
This problem then could be used to establish the basic facts about
congruence. 
\end{remark}

\begin{remark}
A number of students used the arrow ``$\Rightarrow$'' in their
proofs.  Such usage is a bad habit, albeit a common one, even among
teachers.  Indeed, I learned this bad habit from somebody who was
otherwise one of my best teachers.  Later I unlearned the habit.

In logic, the
expression $A\Rightarrow B$ means
\begin{quote}
If $A$ is true, then $B$ is
true.
\end{quote}
One rarely wants to say this in proofs.  Rather, one wants to say
things like
\begin{quote}
$A$ is true, and therefore $B$ is true.
\end{quote}
If this is what you want to say, then you should just say it in words.

In the expression ``$A\Rightarrow B$'', the arrow is a
verb, usually read as ``implies''.  When somebody writes the arrow in
a proof, the intended meaning seems usually to be that of
``\emph{which} implies'' or ``\emph{and this} implies''.  But the
arrow should not be loaded up with these extra meanings.

One student used the arrow in place of the equals sign
``$=$''.  This usage must definitely be avoided.

Another practice that should be avoided is drawing arrows to direct
the reader's eye.  It should be possible to read a proof left to
right, top to bottom, in the usual fashion.  If you need to refer to
something that came before, then just say so.  

It is true that, when I
grade papers, I may use arrows.  This is in part because, when you see
your paper, I am there to explain what I meant by the arrow, if this
is necessary.  But what \emph{you} write on exam should make sense
without need for additional explanation by you.  

If I ask you to prove
a claim, I already know the claim is true.  The point is not to
convince me that the claim is true, or even to convince me that
\emph{you} know the claim is true.  The point is to write a proof of
the claim.  The point is to write the sort of thing that is found in
research articles and books of mathematics, often labelled with the
word \emph{Proof.}
\end{remark}

\begin{problem}
Find integers $k$ and $\ell$, both greater than $1$, such that, for
all positive integers~$n$, 
\begin{equation*}
k\divides 1965^{10n}+\ell.
\end{equation*}
\end{problem}

\begin{solution}
  Since $1965^{10n}$ is odd, we can let \fbox{$\ell=3$, $k=2$.}
\end{solution}

\begin{remark}
This problem is based on Exercise~\ref{xca:7}.
  As it is stated, the problem has many solutions.  
  \begin{compactenum}[(i)]
    \item
The solution given here
  is a special case of letting
 $k$ be any number such that $1965\equiv 1\pmod k$, and
  then letting $\ell=2k-1$ (or $k-1$ if $k>2$).  
\item
We could also let $\ell$ be
  a factor of $1965$, and then let $k$ be a factor of $\ell$.  
\item
Finally, since $11\ndivides 1965$, we have by Fermat
  $1965^{10}\equiv1\pmod{11}$, so we could let $k=11$ and $\ell=10$.
  \end{compactenum}
\end{remark}

\begin{problem}
Find two positive integers $a$ and $b$ such that, for all integers $m$
and $n$, the integer $am-bn$ is a solution of the congruences 
\begin{align*}
x&\equiv m\pmod{999},&
x\equiv n\pmod{1001}.
\end{align*}
\end{problem}

\begin{solution}
A solution of the congruences takes the form
\begin{equation*}
  x\equiv m\cdot 1001s+n\cdot 999t\pmod{999\cdot 1001},
\end{equation*}
where $1001s\equiv1\pmod{999}$ and $999t\equiv
1\pmod{1001}$.  So we want
\begin{align*}
  2s&\equiv 1,&s&\equiv 500\pmod{999},&
-2t&\equiv1,&t&\equiv500\pmod{1001}.
\end{align*}
Then the solution to the original congruences is
\begin{equation*}
  x\equiv m\cdot 1001\cdot 500+n\cdot 999\cdot 500
\equiv 1001\cdot 500m-999\cdot 501n\pmod{999\cdot 1001}.
\end{equation*}
So we can let
\fbox{$a=1001\cdot500$, $b=999\cdot 501$.}
\end{solution}

  \begin{remark}
This is just a Chinese Remainder Theorem problem with letters instead
of numbers.    
  \end{remark}

\begin{problem}
Letting  $n=\sum_{j=1}^{408}j$, find an integer $k$ such that $0\leq
k<409$ and 
\begin{equation*}
408!\equiv k\pmod n.
\end{equation*}
\end{problem}

\begin{solution}
We have $n=409\cdot 408/2$; also $409$ is prime, so by Wilson's
Theorem $408!\equiv-1\pmod{409}$.  Then $408!\equiv 408$ \emph{modulo}
both $409$ and $408$, hence \emph{modulo} any divisor of the
least common multiple of these.  But $n$ is such a divisor.  Thus we
can let \fbox{$k=408$.}
\end{solution}

\begin{remark}
This problem is based on Exercise %49(a)
\ref{xca:p-1}.  A number of
people argued as follows.
\begin{quote}
Since $408!\equiv-1\pod{409}$, we must
have $k\equiv-1\pod{409}$.  Since it is required that $0\leq k<409$,
it must be that $k=408$.
\end{quote}
But this argument does \emph{not} prove $408!\equiv408\pod n$.  Maybe
I made a mistake, and there is \emph{no} $k$ meeting the stated
conditions. 
\end{remark}

\begin{problem}
With justification, find an integer $n$, greater than $1$, such that,
for all integers $a$, 
\begin{equation*}
a^n\equiv a\pmod{1155}.
\end{equation*}
\end{problem}

\begin{solution}
  We have $1155=3\cdot 5\cdot 7\cdot 11$, and
  $\gcd(3-1,5-1,7-1,11-1)=\gcd(2,4,6,10)=60$.  Then we can let
  \fbox{$n=61$.}  Indeed, by Fermat,
  \begin{compactitem}
    \item
If $3\ndivides a$, then $a^2\equiv1\pod 3$, so $a^{60}\equiv1\pod3$.
    \item
If $5\ndivides a$, then $a^4\equiv1\pod 5$, so $a^{60}\equiv1\pod5$.
    \item
If $7\ndivides a$, then $a^6\equiv1\pod 7$, so $a^{60}\equiv1\pod7$.
    \item
If $11\ndivides a$, then $a^{10}\equiv1\pod{11}$, so $a^{60}\equiv1\pod{11}$.
  \end{compactitem}
Therefore, for all $a$, we have $a^{61}\equiv a$ \emph{modulo} any of
$3$, $5$, $7$, and $11$, hence \emph{modulo} their least common
multiple, which is $1155$.
\end{solution}

\begin{remark}
  This problem is related to Exercise %43
\ref{xca:13} and our discussion of
  absolute pseudoprimes.
\end{remark}

\begin{problem}
Let $\N=\{1,2,3,\dots\}$.
Suppose all we know about this set is:
\begin{compactenum}[(i)]
\item
proofs by induction are possible;
\item
addition can be defined on $\N$, and it satisfies
\begin{align*}
x+y&=y+x,&x+(y+z)&=(x+y)+z;
\end{align*}
\item
multiplication can be defined by
\begin{align*}
x\cdot 1&=x,&x\cdot(y+1)&=x\cdot y+x.
\end{align*}
\end{compactenum}
Prove
\begin{equation*}
x\cdot y=y\cdot x.
\end{equation*}
\end{problem}

\begin{solution}
We use induction on $y$.  As the base step, we show $x\cdot 1=1\cdot
x$ for all $x$.  We do \emph{this} by induction:  Trivially, $1\cdot1=1\cdot 1$.
Suppose, as an inductive hypothesis, $x\cdot1=1\cdot x$ for some $x$.  Then
\begin{align*}
1\cdot(x+1)&=1\cdot x+1&&\text{[by definition of multiplication]}\\
&=x\cdot 1+1&&\text{[by inductive hypothesis]}\\
&=x+1&&\text{[by definition of multiplication]}\\
&=(x+1)\cdot 1.&&\text{[by definition of multiplication]}
\end{align*}
By induction then, $x\cdot1=1\cdot x$.

Next we assume $x\cdot y=y\cdot x$ for all $x$, for some $y$, and we prove
$x\cdot(y+1)=(y+1)\cdot x$.  We do \emph{this} by induction on $x$.
By what we have already shown, $1\cdot(y+1)=(y+1)\cdot1$.  Suppose, as
an inductive hypothesis, $x\cdot(y+1)=(y+1)\cdot x$ for some $x$.
Then
\begin{align*}
  (x+1)\cdot(y+1)
&=(x+1)\cdot y+x+1&&\text{[by definition of multiplication]}\\
&=y\cdot(x+1)+x+1&&\text{[by the first inductive hypothesis]}\\
&=y\cdot x+y+x+1&&\text{[by definition of multiplication]}\\
&=x\cdot y+x+y+1&&\text{[by the first inductive hypothesis]}\\
&=x\cdot(y+1)+y+1&&\text{[by definition of multiplication]}\\
&=(y+1)\cdot x+y+1&&\text{[by the second inductive hypothesis]}\\
&=(y+1)\cdot(x+1).&&\text{[by definition of multiplication]}
\end{align*}
This completes the proof that $x\cdot(y+1)=(y+1)\cdot x$ for all $x$.
\emph{This} completes the proof that $x\cdot y=y\cdot x$ for all $x$
and $y$.
\end{solution}

\begin{remark}
  This is part of Exercise \ref{xca:A}.  I tried to write out a ``first
  generation'' proof: one you might write without thinking of how to
  break it into parts.  A proof that is easier to follow is perhaps the
  ``second generation'' proof that goes as follows (see Lemma A.3 and Theorem 
  A.3): First show
  \begin{equation}\label{eqn:x1}
  x\cdot1=1\cdot x
  \end{equation}
by induction on $x$, then show
  \begin{equation}\label{eqn:y+1}
    (y+1)\cdot x=y\cdot x+x
  \end{equation}
by induction on $x$,
  and finally show $x\cdot y=y\cdot x$ by induction on $x$.  In fact,
  almost all students
  just \emph{assumed} that~\eqref{eqn:x1} and~\eqref{eqn:y+1} were
  known; but they were \emph{not} among the propositions that the
  problem allowed you to use.
\end{remark}

\section{In-term examination}

\begin{problem}
  Exactly one of $1458$ and $1536$ has a primitive root.  Which one,
  and why?  Find a primitive root of the number that has one.
\end{problem}

\begin{solution}
$1458=2\cdot729=2\cdot 3^6$ and
$1536=3\cdot 512=3\cdot 2^9$.

The numbers with primitive roots are just $2$, $4$, $p^k$, and $2\cdot
p^k$, where $p$ is an \emph{odd} prime. 

Therefore $1458$, but not $1536$, has a primitive root.

$\upphi(9)=6$, and
\begin{equation*}
\begin{array}{*8{|r}|}\hline
  k&1&2&3&4&5&6&\\\hline
5^k&5&-2&-1&4&2&1&\bmod 9\\\hline
\end{array}
\end{equation*}
so $5$ is a primitive root of $9$.

Then $5$ is a primitive root of $3^6$.

Since $5$ is odd, it is a primitive root of $1458$.
\end{solution}

\begin{remark}
\begin{asparaenum}[1.]
\item
A number of people computed $\upphi(1458)$ and $\upphi(1536)$, but
this is of no practical use in this problem. 
\item
Some people pointed out that if $a$ is a primitive root of $n$, then
$a^{\upphi(n)}\equiv1\pmod n$.  This is logically correct, but
useless, since by Euler's Theorem we have
$a^{\upphi(n)}\equiv1\pmod n$ whenever $\gcd(a,n)=1$ (not just when
$a$ is a primitive root). 
\item
Our sequence of theorems about primitive roots of composite numbers is
the following.  Throughout, $p$ is an odd prime. 
\begin{compactenum}[(i)]
\item
If $r$ is a primitive root of $p$, then $r$ or $r+p$ is a primitive
root of $p^2$. 
\item
If $r$ is a primitive root of $p^2$, then $r$ is a primitive root of
$p^s$ whenever $s\geqslant2$. 
\item
If $r$  is a primitive root of $p^s$ (where $s\geqslant2$), then $r$
or $r+p^s$ (whichever is odd) is a primitive root of $2p^s$. 
\end{compactenum}
Some people misremembered this sequence, or wrongly combined two of
its theorems.  For example, some wrote `If $r$ is a primitive root of
$p$, then $r$ or $r+p^s$ (whichever is odd) is a primitive root of
$2p^s$.'  This assertion is false.  It would be correct to say for
example, `If $r$ is a primitive root of $p^2$, then $r$ or $r+p^2$
(whichever is odd) is a primitive root of $2p^s$.'  Using this, one
might observe that $2$ is a primitive root of $9$, and therefore $11$
is a primitive root of $1458$. 
\end{asparaenum}
\end{remark}

\begin{problem}
Remembering that $p$ is always prime,
  define the arithmetic function $\upomega$ by
  \begin{equation*}
 \upomega(n)=\sum_{p\divides n}1.
  \end{equation*}
  \begin{enumerate}
  \item
  Define $\upmu$, preferably using $\upomega$.
  \item 
Prove that, if $m$ and $n$ are co-prime, then
$\upomega(mn)=\upomega(m)+\upomega(n)$. 
\item
Prove that
\begin{equation*}
  \sum_{d\divides n}\uptau(d)\cdot\upmu(d)=(-1)^{\upomega(n)}.
\end{equation*}
\item
Find a simple description of the function $f$ given by
\begin{equation*}
f(n)=\sum_{d\divides n}\upomega(d)\cdot\upmu\Bigl(\frac nd\Bigr).
\end{equation*}
  \end{enumerate}
\end{problem}

\begin{solution}
\begin{asparaenum}
\item
$\mu(n)=\begin{cases}
	0,&\text{ if }p^2\divides n \text{ for some }p,\\
	(-1)^{\upomega(n)},&\text{ if }p^2\divides n \text{ for no }p.
\end{cases}$.
\item
Assume $m$ and $n$ are co-prime.  If $p\divides mn$, then
\begin{equation*}
p\divides m\iff p\ndivides n.
\end{equation*}
Therefore
\begin{equation*}
\upomega(mn)=\sum_{p\divides mn}1=\sum_{p\divides m}1+\sum_{p\divides n}1 =\upomega(m)+\upomega(n).
\end{equation*}
\item
Each side of the equation is multiplicative, and
\begin{equation*}
\sum_{d\divides p^k}\uptau(d)\cdot\upmu(d)=\uptau(1)\cdot\upmu(1)+\uptau(p)\cdot\upmu(p)=1-2=(-1)^{\upomega(p^k)}.
\end{equation*}
\item
By M\"obius inversion,
\begin{equation*}
\upomega(n)=\sum_{d\divides n}f(d).
\end{equation*}
Since also $\upomega(n)=\sum_{p\divides n}1$, we have
\begin{equation*}
f(n)=\begin{cases}
	1,&\text{ if $n$ is prime},\\
	0,&\text{ if $n$ is not prime.}
\end{cases}
\end{equation*}
\end{asparaenum}
\end{solution}

\begin{remark}
\begin{asparaenum}[1.]
\item
In my solution to part a, the condition `$p^2\divides n$ for no $p$'
is equivalent to `$p^2\ndivides n$ for all $p$'.  Similarly in part
d. 
\item
For part a, some people wrote (as part of their answer)
`$\upmu(n)=(-1)^s$ if $n=p_1\dotsm p_s$'.  Strictly, one must specify that
the $p_i$ are all distinct.  The best way that I know to do this is to
say $p_1<\cdots<p_s$. 
\item
As an alternative solution to part b, one can write (as some people
did) that, since $m$ and $n$ are co-prime, we have 
\begin{align*}
m&=p_1{}^{m(1)}\dotsm p_s{}^{m(s)},&
n&=q_1{}^{n(1)}\dotsm q_t{}^{n(t)},
\end{align*}
where the exponents are positive, $p_1<\cdots<p_s$, $q_1<\cdots<q_t$,
and $p_i\neq q_j$ in each case, and therefore 
\begin{equation*}
\upomega(mn)=s+t=\upomega(m)+\upomega(n).
\end{equation*}
This may be a clearer argument than the one I wrote above.  I don't
know a good way to make the argument just with the $\Sigma$-notation.  
Some people wrote
\begin{equation*}
 \text`\upomega(mn)=\sum_{pq\divides mn}1\text', 
 \end{equation*}
 which doesn't make sense.  (If it means anything, it means
 $\upomega(mn)$ is the number of factors $d$ that $mn$ has, where $d$
 is the product of two primes, possibly not distinct.  This is not
 what $\upomega(mn)$ is.) 
 Others wrote 
 \begin{equation*}
 \text`\upomega(mn)=\sum_{p\divides m}\sum_{q\divides n}1\text'; 
\end{equation*}
 this is meaningful, but false, since it makes $\upomega(mn)$ equal to
 the \emph{product} $\upomega(m)\cdot\upomega(n)$. 
 \item
 In part c, it doesn't hurt to say \emph{why} the two sides are
 multiplicative.  The left-hand side is multiplicative because the
 product of two multiplicative functions is multiplicative (we didn't
 prove this, but it's fairly obvious), and if $g$ is multiplicative,
 so is $n\mapsto\sum_{d\divides n}g(d)$ (we did prove this).  The
 right-hand side is multiplicative by part b. 
 \item
 In notation introduced in class, the function $f$ in part d is given
 by $f=\upomega*\mu$, and therefore $\upomega=f*1$ by M\"obius
 inversion.  It may not be immediately obvious that $f$ \emph{must} be
 as in the solution above.  But if $f$ \emph{is} that function, then
 indeed $\upomega=f*1$, and therefore $f=\upomega*\upmu$, as
 required.  So $f$ must be as given in the solution.
\end{asparaenum}
\end{remark}

\begin{problem}
  Find the least positive $x$ such that
  \begin{equation*}
    11^{5117}x\equiv57\pmod{600}.
  \end{equation*}
\end{problem}

\begin{solution}
$600=2^3\cdot3\cdot5^2$, so $\upphi(600)=4\cdot2\cdot20=160$.
We compute
\fbox{\begin{math}
%  Code from TUGboat Vol. 18 (1997), No. 2 
\newdimen\digitwidth
\settowidth\digitwidth{0}
\def~{\hspace{\digitwidth}}
\def\divrule#1#2{%
   \noalign{\moveright#1\digitwidth%
   \vbox{\hrule width#2\digitwidth}}}
160\,
\begin{array}[b]{@{}r@{}}
   31\\\hline
\big)
\begin{array}[t]{@{}l@{}}
  5117\\
  480\\\divrule03
  ~317\\
  ~160\\\divrule13
  ~157
\end{array}
\end{array}
\end{math}}.  Hence
\begin{equation*}
5117\equiv157\equiv-3\pmod{160}.
\end{equation*}
Therefore
\begin{align*}
&\phantom{{}\iff{}}11^{1557}x\equiv5\pmod{600}\\
&\iff11^{-3}x\equiv5\pmod{600}\\
&\iff x\equiv5\cdot11^3\pmod{600}.
\end{align*}
But
\begin{gather*}
11^3=121\cdot11=1331\equiv131\pmod{600},\\
5\cdot131=655\equiv55\pmod{600},
\end{gather*}
so the least positive solution is \fbox{$55$}.
\end{solution}

\begin{remark}
Not too many problems here.  I'm guessing this is the sort of problem
that the \emph{dershane} prepares one for.  According to the Wikipedia
article `Long division', my notation for long division is what used in
Anglophone countries; the notation I see on papers, Francophone.  But
the symbolism $b\mathrel)a$ (used in the former notation) for $a/b$ is
traced to Michael Stifel of the University of Jena in Germany in 1544
(see the Wikipedia article `Division (mathematics)'). 
\end{remark}

\begin{problem}
  \begin{enumerate}
  \item
Since $2$ is a primitive root of $29$, the function $x\mapsto\log_2x$
from $\Zmodu[29]$ to $\Zmod[28]$ is defined.  Considering this as a
function from $\{-14,\dots,-1,1,\dots14\}$ to $\{-14,\dots,14\}$,
fill out the table below.  
\begin{equation*}
\makebox[0pt]{\begin{math}\renewcommand{\arraystretch}{2}
  \begin{array}{|r||*{14}{p{3.8mm}|}}\hline
        m & \hfill$1$ & \hfill$2$ & \hfill$3$ & \hfill$4$ & \hfill$5$
        & \hfill$6$ & \hfill$7$ & \hfill$8$ & \hfill$9$ & \hfill$10$ &
        \hfill$11$ & \hfill$12$ & \hfill$13$ & \hfill$14$\\\hline\hline
\log_2  m & & & & & & & & & &  &  &  &  &  \\\hline
\log_2(-m)& & & & & & & & & &  &  &  &  &  \\\hline
  \end{array}
\end{math}}
\end{equation*}
\item
With respect to the modulus $29$, exactly
one of the two congruences
\begin{align*}
  x^{400}&\equiv13,&x^{400}&\equiv-13
\end{align*}
has a solution.  Find all of its solutions (\emph{modulo} $29$), and
explain why the other congruence has no solutions.
  \end{enumerate}
\end{problem}

\begin{solution}
\begin{asparaenum}
\item\mbox{}
\begin{equation*}
\makebox[0pt]{
\begin{math}%\renewcommand{\arraystretch}{2}
  \begin{array}{|r||*{14}{r|}}\hline
        m & 1&  2& 3&  4& 5& 6& 7&  8& 9&10&11&12& 13&14\\\hline\hline
\log_2  m & 0&  1& 5&  2&-6& 6&12&  3&10&-5&-3& 7&-10&13\\\hline
\log_2(-m)&14&-13&-9&-12& 8&-8&-2&-11&-4& 9&11&-7&  4&-1\\\hline
  \end{array}
\end{math}}
\end{equation*}
\item
For the first congruence, we have
\begin{gather*}
x^{400}\equiv13\pmod{29}\\
\iff 400\log x\equiv-10\pmod{28}\\
\iff200\log x\equiv-5\pmod{14};
\end{gather*}
 the congruence has no solution since $\gcd(200,14)=2$, and $2\ndivides-5$.
For the second congruence:
\begin{gather*}
x^{400}\equiv-13\pmod{29}\\
\iff 400\log x\equiv4\pmod{28}\\
\iff100\log x\equiv1\pmod{7}\\
\iff2\log x\equiv1\pmod7\\
\iff\log x\equiv4\pmod 7\\
\iff\log x\equiv4,11,-10,-3\pmod{28}\\
\iff x\equiv-13,-11,13,11\pmod{29}.
\end{gather*} 
\end{asparaenum}
\end{solution}

\begin{remark}
The quickest way I know to fill out the table is, keeping in mind
\begin{equation*}
\log_2m\equiv k\bmod28\iff2^k\equiv m\bmod29,
\end{equation*}
to start out as follows,
\begin{equation*}
\makebox[0pt]{
\begin{math}%\renewcommand{\arraystretch}{2}
  \begin{array}{|r||*{14}{r|}}\hline
        m & 1&  2& 3&  4& 5& 6& 7&  8& 9&10&11&12& 13&14\\\hline\hline
\log_2  m & 0&  1&  &  2&  &  &  &  3&  &  &  &  &   &  \\\hline
\log_2(-m)&  &   &  &   &  &  &  &   &  &  &  &  &  4&  \\\hline
  \end{array}
\end{math}}
\end{equation*}
continuing to get
\begin{equation*}
\makebox[0pt]{
\begin{math}%\renewcommand{\arraystretch}{2}
  \begin{array}{|r||*{14}{r|}}\hline
        m & 1&  2& 3&  4& 5& 6& 7&  8& 9&10&11&12& 13&14\\\hline\hline
\log_2  m & 0&  1& 5&  2&  & 6&12&  3&10&  &  & 7&   &13\\\hline
\log_2(-m)&14&   &  &   & 8&  &  &   &  & 9&11&  &  4&  \\\hline
  \end{array}
\end{math}}
\end{equation*}
then filling in the remaining spaces by using
\begin{equation*}
\log m-\log(-m)\equiv\log(-1)\equiv\pm14\pmod{28}.
\end{equation*}
Some people may have done something like this, but they put the logarithms into the set $\{0,\dots,27\}$ rather than $\{-14,\dots,14\}$ as requested (this set could have been $\{-13,\dots,14\}$.  Other people gave negative logarithms, but they were off by $1$, as if the modulus had been taken as $29$ rather than $28$.  In solving the congruences, there were various confusions about modulus.
\end{remark}

\section{Final examination}


\begin{problem}
Find all solutions of the congruence
\begin{equation*}
x^{2821}\equiv x\pmod{2821}.
\end{equation*}
\end{problem}

\begin{solution}
Every integer would be a solution if $2821$ were a prime or a
Carmichael number.  It factorizes as $7\cdot403$, hence as
$7\cdot13\cdot31$, which is squarefree.  Also
$2820=10\cdot2\cdot141=2^2\cdot3\cdot5\cdot47$, so it is divisible by
$6$, $12$, and $30$.  Therefore $2821$ is a Carmichael number, and \fbox{all
integers} solve the given congruence. 
\end{solution}

\begin{problem}
Find all solutions to the congruence $x^2\equiv23\pmod{133}$.
\end{problem}

\begin{solution}
$133=7\cdot19$, so we solve simultaneously
\begin{align*}
x^2&\equiv23\pmod{7},&x^2&\equiv23\pmod{19}.
\end{align*}
For the first, $x^2\equiv2\equiv9$, so $x\equiv\pm3\pod7$; for the
second, $x^2\equiv4$, so $x\equiv\pm2\pod{19}$.  Now we have some
Chinese remainder problems:  First, 
\begin{align*}
x&\equiv\pm3\pmod7,&x&\equiv\pm2\pmod{19},
\end{align*}
that is,
$x\equiv\pm(3\cdot19\cdot3+2\cdot7\cdot-8)\equiv\pm59\pod{133}$, since
$19\equiv-2\pod7$ and $-2\cdot3\equiv1\pod7$, while
$7\cdot-8\equiv1\pod{19}$.  Second, 
\begin{align*}
x&\equiv\pm3\pmod7,&x&\equiv\mp2\pmod{19},
\end{align*}
that is,
$x\equiv\pm(3\cdot19\cdot3-2\cdot7\cdot-8)\equiv\pm283\equiv\pm17\pod{133}$.
The solutions to the original problem are therefore 
\fbox{$x\equiv\pm59,\pm17\pmod{133}$}. 
\end{solution}

\begin{problem}
Is the following congruence soluble?  Explain.  (It is given that
$2999$ is prime.)
\begin{equation*}
x^2-2987x+2243\equiv 0\pmod{2999}.
\end{equation*}
\end{problem}

\begin{solution}
By completing the square, the congruence is equivalently
\begin{gather*}
x^2+12x\equiv756,\\
(x+6)^2\equiv792.
\end{gather*}
Also, $792=2^3\cdot3^2\cdot11$, so
\begin{align*}
\ls{792}{2999}
&=\ls2{2999}\ls{11}{2999}&&\\
&=\ls{11}{2999}&&\text{[since $2999\equiv-1\pod8$]}\\
&=-\ls{2999}{11}&&\text{[since $11\equiv3\equiv2999\pod4$]}\\
&=-\ls{-4}{11}&&\\
&=-\ls{-1}{11}&&\\
&=1;&&\text{[since $11\equiv3\pod4$]}
\end{align*}
therefore there must be a solution.
\end{solution}

\begin{problem}\mbox{}
\begin{enumerate}
\item
Find an arithmetic function that is \emph{not} multiplicative.
\item
Prove that, for all positive integers $n$,
\begin{equation*}
\sum_{d\divides n}\sum_{e\divides n/d}\upphi(e)=\sum_{d\divides n}d.
\end{equation*}
\end{enumerate}
\end{problem}

\begin{solution}
\begin{enumerate}
\item
$n\mapsto2$.
\item
By a theorem of Gauss,
\begin{equation*}
\sum_{d\divides n}\sum_{e\divides n/d}\upphi(e)
=\sum_{d\divides n}n/d
=\sum_{d\divides n}d.
\end{equation*}
\end{enumerate}
\end{solution}

\begin{remark}
Various approaches are possible.  One may, for example, write the
desired equation as $1*\upphi*1=1*\operatorname{id}$, and this follows
from Gauss's theorem, expressed as $1*\upphi=\operatorname{id}$.  If
one does not remember Gauss's Theorem, one may let
$f(n)=\sum_{d\divides n}\upphi(d)$, so that
\begin{equation*}
  \sum_{d\divides n}\sum_{e\divides n/d}\upphi(e)=\sum_{d\divides
    n}f(n/d)
=\sum_{d\divides n}f(d).
\end{equation*}
Then it is enough to prove $f(n)=n$; but each side of this equation is
am multiplicative function of $n$, and 
$f(p^k)
=\sum_{j=0}^k\upphi(p^j)
=1+\sum_{j=1}^k(p^j-p^{j-1})=p^k$.
\end{remark}

\begin{problem}
Describe, \emph{as well as possible,} the set of primes $q$ such that
$2$ is a primitive root of $q$ \emph{and} $q=2^n\cdot p+1$ for some
prime $p$.  (In particular, first find the possibilities for $n$, and
then $p$.) 
\end{problem}

\begin{solution}
If $n=0$, then $p$ can only be $2$, and then $q=3$, which is in the
desired set.

Now suppose $q$ is as desired, but
not $3$, so $n\geqslant1$.  A primitive root cannot be
a square, so we must have $(2/q)=-1$, that is, $q\equiv\pm3\pod8$, and
therefore $n\leq2$. 

If $n=1$, then for the same reason, we must have $2p+1\equiv3,5\pod8$,
equivalently, 
$2p\equiv2,4\pod8$, that is, $p\equiv1,2\pod4$.  If $p\equiv2\pod4$,
then $p=2$, so $q=5$; of this, $2$ is a primitive root, so $5$ is in
the desired set.

Suppose conversely $p\equiv1\pod4$, so $q\geq11$ and $q\equiv3\pod8$.  By
Euler's Criterion, $-1=(2/q)\equiv 2^p\pod q$, so 
$\operatorname{ord}_q(2)\neq p$.  But this order can only be $1$, $2$,
$p$ or $q-1$, and it is not $1$ or $2$ (since $q\geqslant11$), so it
must be $q-1$.  Therefore $2$ is a primitive root of a prime number
$2p+1$ if and only if $p\equiv1\pod4$. 
 
Now suppose $n=2$.  Then $(2/q)=-1$ if and only if $4p\equiv2,4\pod8$,
that is, $p\equiv1\pod2$, which is always the case (since $p$ is odd).
So we have $\operatorname{ord}_q(2)\nmid 2p$.  Also the order is not
$4$ when $p=3$ or when $p\geqslant5$---that is, ever.  Therefore, $2$
is a primitive root of every prime number $4p+1$. 

In sum, the desired set consists of:
\begin{compactitem}
\item 
$3$;
\item
primes $2p+1$, where $p\equiv1\pmod 4$;
\item
primes $4p+1$.
\end{compactitem}
\end{solution}

%\bibliographystyle{plain}
%\bibliography{../../Dropbox/Public/references}
%\bibliography{../references}

\def\rasp{\leavevmode\raise.45ex\hbox{$\rhook$}} \def\cprime{$'$}
  \def\cprime{$'$} \def\cprime{$'$} \def\cprime{$'$}
\begin{thebibliography}{10}

\bibitem{MR1283874}
W.~R. Alford, Andrew Granville, and Carl Pomerance.
\newblock There are infinitely many {C}armichael numbers.
\newblock {\em Ann. of Math. (2)}, 139(3):703--722, 1994.

\bibitem{Aristo-Phy-Apost}
Hippocrates~G. Apostle.
\newblock {\em Aristotle's Physics}.
\newblock The Peripatetic Press, Grinnell, Iowa, 1980.
\newblock Translated with Commentaries and Glossary.

\bibitem{MR2093668}
Archimedes.
\newblock {\em The works of {A}rchimedes. {V}ol. {I}}.
\newblock Cambridge University Press, Cambridge, 2004.
\newblock The two books on the sphere and the cylinder, Translated into
  English, together with Eutocius' commentaries, with commentary, and critical
  edition of the diagrams by Reviel Netz.

\bibitem{Arnold}
V.~I. Arnol{\cprime}d.
\newblock On the teaching of mathematics.
\newblock {\em Russian Mathematical Surveys}, 53(1):229--234, 1998.

\bibitem{MR0234791}
Carl~B. Boyer.
\newblock {\em A history of mathematics}.
\newblock John Wiley \& Sons Inc., New York, 1968.

\bibitem{Burali-Forti}
Cesare Burali-Forti.
\newblock A question on transfinite numbers (1897).
\newblock In Jean van Heijenoort, editor, {\em From Frege to G{\"o}del}, pages
  104--12. Harvard University Press, 1976.

\bibitem{Burton}
David~M. Burton.
\newblock {\em Elementary Number Theory}.
\newblock McGraw-Hill, Boston, sixth edition, 2007.

\bibitem{MR1558896}
R.~D. Carmichael.
\newblock Note on a new number theory function.
\newblock {\em Bull. Amer. Math. Soc.}, 16(5):232--238, 1910.

\bibitem{MR0159773}
Richard Dedekind.
\newblock {\em Essays on the theory of numbers. {I}: {C}ontinuity and
  irrational numbers. {II}: {T}he nature and meaning of numbers}.
\newblock authorized translation by Wooster Woodruff Beman. Dover Publications
  Inc., New York, 1963.

\bibitem{Dickson}
Leonard~Eugene Dickson.
\newblock {\em History of the Theory of Numbers}, volume~1.
\newblock Chelsea, New York, 1952.

\bibitem{Erdos}
P.~Erd{\H o}s.
\newblock Beweis eines {S}atzes von {T}schebyschef (in {G}erman).
\newblock {\em Acta Litt. Sci. Szeged}, 5:194--198, 1932.
\newblock Available at \url{http://www.renyi.hu/~p_erdos/1932-01.pdf} (as of
  December 3, 2010).

\bibitem{MR17:814b}
Euclid.
\newblock {\em The thirteen books of {E}uclid's {E}lements translated from the
  text of {H}eiberg. {V}ol. {I}: {I}ntroduction and {B}ooks {I}, {I}{I}. {V}ol.
  {I}{I}: {B}ooks {I}{I}{I}--{I}{X}. {V}ol. {I}{I}{I}: {B}ooks
  {X}--{X}{I}{I}{I} and {A}ppendix}.
\newblock Dover Publications Inc., New York, 1956.
\newblock Translated with introduction and commentary by Thomas L. Heath, 2nd
  ed.

\bibitem{MR1932864}
Euclid.
\newblock {\em Euclid's {E}lements}.
\newblock Green Lion Press, Santa Fe, NM, 2002.
\newblock All thirteen books complete in one volume, the Thomas L. Heath
  translation, edited by Dana Densmore.

\bibitem{MEU2}
H.~W. Fowler.
\newblock {\em A Dictionary of Modern {E}nglish Usage}.
\newblock Oxford University Press, second edition, 1982.
\newblock revised and edited by Ernest Gowers.

\bibitem{MEU}
H.~W. Fowler.
\newblock {\em A Dictionary of Modern {E}nglish Usage}.
\newblock Wordsworth Editions, Ware, Hertfordshire, UK, 1994.
\newblock reprint of the original 1926 edition.

\bibitem{Gauss}
Carl~Friedrich Gauss.
\newblock {\em Disquisitiones Arithmeticae}.
\newblock Springer-Verlag, New York, 1986.
\newblock Translated into English by Arthur A. Clarke, revised by William C.
  Waterhouse.

\bibitem{GPY}
D.~A. Goldston, J.~Pintz, and C.~Y. Y{\i}ld{\i}r{\i}m.
\newblock \url{http://arxiv.org}, 2005.
\newblock arXiv:math/0508185v1 [math.NT].

\bibitem{MR2147526}
Timothy Gowers.
\newblock {\em Mathematics}.
\newblock Oxford University Press, Oxford, 2002.
\newblock A very short introduction.

\bibitem{MR2467561}
Timothy Gowers, June Barrow-Green, and Imre Leader, editors.
\newblock {\em The {P}rinceton companion to mathematics}.
\newblock Princeton University Press, Princeton, NJ, 2008.

\bibitem{Green--Tao}
Ben Green and Terence Tao.
\newblock The primes contain arbitrarily long arithmetic progressions.
\newblock \url{http://arxiv.org}, 2004.
\newblock arXiv:math/0404188v6 [math.NT].

\bibitem{MR568909}
G.~H. Hardy and E.~M. Wright.
\newblock {\em An introduction to the theory of numbers}.
\newblock The Clarendon Press Oxford University Press, New York, fifth edition,
  1979.

\bibitem{MR654679}
Thomas Heath.
\newblock {\em A history of {G}reek mathematics. {V}ol. {I}}.
\newblock Dover Publications Inc., New York, 1981.
\newblock From Thales to Euclid, Corrected reprint of the 1921 original.

\bibitem{Ivory}
James Ivory.
\newblock Demonstration of a theorem respecting prime numbers.
\newblock In Thomas Leybourn, editor, {\em New Series of the Mathematical
  Repository}, volume~I, chapter~II, pages 6--8. W. Glendinning, London, 1806.

\bibitem{Katz}
Victor~J. Katz, editor.
\newblock {\em The Mathematics of {E}gypt, {M}esopotamia, {C}hina, {I}ndia, and
  {I}slam: A Sourcebook}.
\newblock Princeton University Press, Princeton and Oxford, 2007.

\bibitem{MR0092794}
Edmund Landau.
\newblock {\em Elementary number theory}.
\newblock Chelsea Publishing Co., New York, N.Y., 1958.
\newblock Translated by J. E. Goodman.

\bibitem{MR12:397m}
Edmund Landau.
\newblock {\em Foundations of Analysis. {T}he Arithmetic of Whole, Rational,
  Irrational and Complex Numbers}.
\newblock Chelsea Publishing Company, New York, N.Y., third edition, 1966.
\newblock translated by F. Steinhardt; first edition 1951; first German
  publication, 1929.

\bibitem{Mazur-Th-pub}
Barry Mazur.
\newblock How did {T}heaetetus prove his theorem?
\newblock In P.~Kalkavage and E.~Salem, editors, {\em The Envisoned Life:
  {E}ssays in honor of {E}va {B}rann}. Paul Dry Books, 2007.
\newblock \url{http://www.math.harvard.edu/~mazur/preprints/Eva.pdf}, accessed
  September 20, 2012.

\bibitem{Nicomachus}
{Nicomachus of Gerasa}.
\newblock {\em Introduction to Arithmetic}, volume XVI of {\em University of
  Michigan Studies, Humanistic Series}.
\newblock University of Michigan Press, Ann Arbor, 1938.
\newblock First printing, 1926.

\bibitem{Peano}
Giuseppe Peano.
\newblock The principles of arithmetic, presented by a new method (1889).
\newblock In Jean van Heijenoort, editor, {\em From {F}rege to {G}{\"o}del},
  pages 83--97. Harvard University Press, 1976.

\bibitem{Ramanujan}
Srinivasa Ramanujan.
\newblock A proof of {B}ertrand's postulate.
\newblock {\em Journal of the Indian Mathematical Society}, XI:181--2, 1919.
\newblock Available at
  \url{http://www.imsc.res.in/~rao/ramanujan/CamUnivCpapers/Cpaper24/page1.htm}
  (as of December 3, 2010).

\bibitem{Russell-letter}
Bertrand Russell.
\newblock Letter to {F}rege (1902).
\newblock In Jean van Heijenoort, editor, {\em From Frege to G{\"o}del}, pages
  124--5. Harvard University Press, 1976.

\bibitem{MR2038833}
Lucio Russo.
\newblock {\em The forgotten revolution}.
\newblock Springer-Verlag, Berlin, 2004.
\newblock How science was born in 300 BC and why it had to be reborn,
  Translated from the 1996 Italian original by Silvio Levy.

\bibitem{Saidak}
Filip Saidak.
\newblock A new proof of {E}uclid's theorem.
\newblock {\em The American Mathematical Monthly}, 113(10):937--8, Dec. 2006.

\bibitem{MR858706}
D.~J. Struik, editor.
\newblock {\em A source book in mathematics, 1200--1800}.
\newblock Princeton Paperbacks. Princeton University Press, Princeton, NJ,
  1986.
\newblock Reprint of the 1969 edition.

\bibitem{Theon}
{Th{\'e}on de Smyrne}.
\newblock {\em Exposition des connaissances math{\'e}matiques utiles pour la
  lecture de {P}laton}.
\newblock Hachette, Paris, 1892.
\newblock Greek text, with French translation by J. Dupuis.

\bibitem{MR13:419a}
Ivor Thomas, editor.
\newblock {\em Selections illustrating the history of {G}reek mathematics.
  {V}ol. {I}. {F}rom {T}hales to {E}uclid}.
\newblock Harvard University Press, Cambridge, Mass., 1951.
\newblock With an English translation by the editor.

\bibitem{MR13:419b}
Ivor Thomas, editor.
\newblock {\em Selections illustrating the history of {G}reek mathematics.
  {V}ol. {II}. {F}rom {A}ristarchus to {P}appus}.
\newblock Harvard University Press, Cambridge, Mass, 1951.
\newblock With an English translation by the editor.

\bibitem{MR0209111}
Jean van Heijenoort.
\newblock {\em From {F}rege to {G}\"odel. {A} source book in mathematical
  logic, 1879--1931}.
\newblock Harvard University Press, Cambridge, Mass., 1967.

\bibitem{von-Neumann}
John von Neumann.
\newblock On the introduction of transfinite numbers (1923).
\newblock In Jean van Heijenoort, editor, {\em From {F}rege to {G}{\"o}del},
  pages 346--354. Harvard University Press, 1976.

\end{thebibliography}


{\sloppy
\printindex
}

\end{document}

