GF(p)中高阶同余方程 x^ n = a (mod p)的平凡解

The Trivial Solution to the High Degree Congruence x n≡a(mod p) in (p)Shenghui SuSchool of Information EngineeringUniversity of Science & Technology BeijingBeijing 100083 P. R. Chinasheenway@AbstractThis paper gives the definition of the trivial solution to the high degree congruence x n≡a(mod p), presents one sufficient and necessary condition for the congruence to havesolutions, derives and proves one new judgment condition complementarily. Elaboratestwo methods for computing the trivial solution to the congruence in determinatepolynomial time, argues non-trivial solutions to the congruence can not be obtainedcyclically from the trivial solution, infers and demonstrates the two new methods forseeking the trivial solution. In summary, resolves the root existing problem and the trivialroot computing problem for x n≡a (mod p) with an arbitrary n. At last, points out thateven through a probabilistic polynomial time algorithm, seeking a specific non-trivialsolution is still infeasible when the number of the solutions is large enough.Keywords: High degree congruence, Cryptosystem, Trivial solution, Polynomial timealgorithm.1 IntroductionThe discrete logarithm problem and the root finding problem are two closely related problems in computational number theory.The discrete logarithm problem, shortly the DLP, is to seek an exponent n such that x n≡a (mod u), given the triple <x, a, u>. This problem is intractable because no polynomial time algorithm for it has been found yet [1]. The famous public-key cryptosystem ElGamal is built on this hardness [2].The root finding problem is to seek a root x such that x n≡a (mod u), given the triple <n, a, u>. This problem is slightly easier than the DLP since there are polynomial time algorithms for it, provided u is a prime power. However, when φ(u) is unknown, even seeking square roots is equivalent to the integer factorization hardness on which the security of RSA is based [3], where φ(u) is the Euler’s phi function which represents the number of those positive integers coprime to and less than u.When u is equal to a prime p (if p is a prime power, the discussion is similar), the polynomial time algorithms for solving x n≡a (mod p) may be partitioned into the probabilistic type [4] and the determinate type. The former is employed for any random solution to x n≡a (mod p), and the latter is employed only for the trivial solution to x n≡a (mod p) if it exists.[Definition 1] Under some special conditions, a solution to the high degree congruence x n≡a (mod p) can be found in determinate polynomial time. This solution may be written as a to a certain power modulo p, and hence, is called the trivial solution or the trivial root.Through this paper, unless otherwise specified, n≥ 3, p is an odd prime, and a≤p or pł a, that is, a is notexactly divisible by p. The sign ‘gcd’ denotes the greatest common divisor.In the paper, we present theorem 1, derive and prove corollary 1.1. They serve as the discriminants for solutions to the congruence x n≡a (mod p) to exist. We expound theorem 2 and 3, infer and prove corollary 3.1, 3.2, 3.3 and 3.4. By theorem 2, 3, corollary 3.3 and 3.4, we can find out the trivial solution to x n≡a (mod p) in determinate polynomial time.2 Sufficient and Necessary Conditions for the Congruence x n≡a (mod p) to Have SolutionsTo judge whether the congruence x n≡a (mod p) has solutions is much easier than to seek its solutions. [Theorem 1] If n | (p – 1), the sufficient and necessary condition for the congruence x n≡a (mod p) to have solutions isa (p – 1) / n≡ 1 (mod p),and the number of the solutions is n when they exist.The proof of theorem 1 is referred to subsection 1.6.8 of chapter 1 of [5].[Corollary 1.1] If nł (p – 1), let k = gcd(n, p –1), m = n / k and µ satisfy µm≡ 1 (mod (p –1) / k), then x n≡a (mod p) is equivalent tox k≡aµ (mod p),that is, the two congruences have the same set of solutions. Furthermore, the sufficient and necessary condition for either congruence to have solutions is a (p – 1) / k≡ 1 (mod p).Proof: The original congruence may be written as (x k)m≡a (mod p). Let µm = 1 + h (p – 1) / k, where h is a positive integer.Suppose that (x k)m≡a (mod p) and x k≡aµ (mod p) both have solutions, and the solution sets are respectively X1 and X2.∀x1∈X1, then (x1k)m≡a (mod p), and by the properties [6] of the group* p, we have(x1k)mµ≡aµ (mod p)(x1k)1 + h (p – 1) / k≡aµ (mod p)x1k≡aµ (mod p),which indicates that x1∈X2. Considering the arbitrariness of x1, X1 ⊆ X2. Note that by the Fermat’s little theorem [1], x1p – 1≡ 1 (mod p).Clearly, substituting x1k≡aµ (mod p) for x1k of (x1k)m≡a (mod p) yields aµm≡a (mod p).∀x2∈X2, then x2k≡aµ (mod p), and by the properties [6] of the group* p, we have(x2k)m≡aµm≡a (mod p), namely x2n≡a (mod p),which indicates that x2∈X1. Considering the arbitrariness of x2, X2 ⊆ X1.Therefore, X1 = X2. Since both the sets are finite, |X1| =|X2|.By theorem 1, the sufficient and necessary condition for the congruence x k≡aµ (mod p) have solutions is (aµ) (p – 1) / k≡ 1 (mod p), and the number of the solutions is k when they exist.Due to aµm≡a (mod p), there is aµm – 1≡ 1 (mod p).Let the order of a be d, then d | (µm – 1), i.e. µm – 1 = v d, where v is a positive integer.Presume that gcd(d, µ) = t≥ 2, and let d = t i and µ = t j. Substituting t i and t j for µ and d above yieldst j m – 1 = v t it (j m – v i) = 1.Because (j m – v i) is an integer and t≥ 2, the equation t (j m – v i) = 1 brings on a contradiction, which means that gcd(d, µ) = t < 2, namely gcd(d, µ) = 1.By the group theories [6], aµ and a have the same order, and thus d | ((p – 1) / k). That is, the sufficient and necessary condition for x k≡aµ (mod p) to have solutions may be expressed as a (p – 1) / k≡ 1 (mod p). Furthermore, |X1| =|X2| = k when the solutions exist, or |X1| =|X2| = 0 when there exists no solution.3 Seeking Polynomial Time Solutions to the Congruence x n≡a (mod p)[Theorem 2] [7] For the congruence x n≡a (mod p), if gcd(n, p – 1) = 1, every a has just one n-th root modulo p. Especially, let µ be the multiplicative inverse of n modulo p – 1, then aµ mod p is one n-th root to the congruence.It is known from corollary 1.1 that x n≡a (mod p) has just a solution when gcd(n, p –1) = 1.[Theorem 3] [7] For the congruence x n≡a (mod p), if n | (p – 1) and gcd(n, (p – 1) / n) = 1, then when a is one n-th power residue modulo p, aµ mod p is one n-th root, where µ is the multiplicative inverse of n modulo (p – 1) / n.The proofs of theorem 2 and 3 are similar, and thus only theorem 3 is proved below.In fact, what we need to do is only to verify (aµ)n≡a (mod p).If p | a, then there is a≡ 0 (mod p), and obviously (aµ)n≡a (mod p) holds.If pł a, according to µn≡ 1 (mod (p – 1) / n), there always exists a positive integer h such thatµn = 1 + h (p – 1) / n.Because a is known to have one n-th root x, a can be described as a≡x n (mod p). Then(aµ)n≡ ((x n)µ)n≡x nµn≡x n (1 + h (p – 1) / n )≡x n x h (p – 1)≡x n(x p – 1)h≡x n1h≡x n≡a (mod p).In the above deduction, the Fermat’s little theorem x p – 1≡ 1 (mod p) [1] is employed.Notice that theorem 3 cannot ensure that aµ mod p is exactly one n-th root of a─ thus it is necessary to verify at last whether aµ to the n-th power is equals to a or not, and furthermore, aµ is only the trivial root to x n≡a (mod p).From theorem 3, we can infer the following four important corollaries.[Corollary 3.1] For the congruence x n≡a (mod p), if n | (p – 1), gcd(n, (p – 1) / n) = 1, and let d be the order of the trivial solution aµ with µn≡ 1 (mod (p – 1) / n), then gcd(n, d) = 1 and d | ((p – 1) / n). Proof: Substituting aµ for x of x n≡a (mod p) yields (aµ)n≡a (mod p), namelyaµn – 1≡ 1 (mod p).Let ď be the order of a∈* p, then aď≡ 1 (mod p).Presume that gcd(n, ď ) = k≥ 2. Let n = i k and ď = j k, thenµn – 1 = hďµi k – 1 = h j k(µi – h j) k = 1.Because (µi – h j) is an integer and k≥ 2, the equation (µi – h j) k = 1 brings on a contradiction, which means that gcd(n, ď ) = k < 2, namely gcd(n, ď ) = 1.Additionally, due to gcd(µ, (p – 1) / n) = 1 and ď | (p – 1), gcd(µ, ď ) = 1. According to the group theory [6], the order d of aµ mod p is equal to the order ď of a, and so gcd(n, d) = 1. Further, considering d | (p – 1), we have d | ((p – 1) / n).[Corollary 3.2] For the congruence x n≡a (mod p), if n | (p – 1) and gcd(n, (p – 1) / n) = 1, then the congruence has only a trivial root, and any non-trivial root cannot be obtained cyclically from the trivial root aµ, where µ satisfies µn≡ 1 (mod (p – 1) / n).Proof: It is known from the proof of corollary 3.1 that a and aµ∈* p have the same order.We might as well let the order of a be d.Assume that another solution y can be written as a kµ mod p with k < d. Substituting it for x of the congruence yields(a k µ)n≡a (mod p)a kµn – 1≡ 1 (mod p),which indicates that kµn – 1 = ĥd, namely k (µn) – ĥd = 1.It is known from corollary 3.1 that gcd(µn, (p –1) / n) = 1 and d | ((p –1) / n), so gcd(µn, d) = 1.By the greatest common divisor theorem [5], there exists only one positive integer k < d which meets the equation k (µn) – ĥd = 1.Additionally, due to aµn – 1≡ 1 (mod p), µn – 1 =h d, i.e. µn – h d = 1 holds. Comparing the two difference equalities gives k = 1 and ĥ = h.Hence, there exists only the trivial root, and cycling the trivial root cannot generate any non-trivial root. [Corollary 3.3] For the congruence x n≡a (mod p), let k = gcd(n, p – 1) with 1 < k < n. If gcd(k, (p – 1) / k) = 1 and a is one n-th power residue modulo p, then aµη is the trivial root, where µ satisfies µ (n / k) ≡ 1 (mod (p – 1) / k) and η doesηk≡ 1 (mod (p – 1) / k).Proof: Let n = k m, then the congruence can be expressed as(x k)m≡a (mod p).Due to gcd(m, (p – 1) / k) = 1, it is known from corollary 1.1 that the congruencex k≡aµ (mod p),where µ satisfies µm≡ 1 (mod (p – 1) / k), and the congruence (x k)m≡a (mod p) have the same set and number of solutions.Since a is one n-th power residue modulo p, by corollary 1.1, aµ must be one k-th power residue. Further, by gcd(k, (p – 1) / k) = 1 and theorem 3, we can infer that the trivial root to the original congruence is aµη mod p, where η satisfies ηk≡ 1 (mod (p – 1) / k). Thus, corollary 3.3 holds.[Corollary 3.4] For the congruence x n≡a (mod p), if n2 | (p – 1) and gcd(n2, (p – 1) / n2) = 1, then when the trivial root exists in 1 / n probability, it is aµ n mod p, where µmeets µn 2≡ 1 (mod (p – 1) / n2). Proof: Assume that a is one n-th power residue modulo p.Due to x n≡a (mod p), raising either side of the congruence to the n-th power yieldsx n2≡a n (mod p).Let the solution sets of x n≡a (mod p) and x n2≡a n (mod p) be respectively X1 and X2, then |X1| = n, |X2| = n2. Because every solution satisfying the original congruence x n≡a (mod p) is sure to satisfy the new congruence x n2≡a n (mod p), we have X1 ⊂ X2.Additionally, thanks to gcd(n2, (p – 1) / n2) = 1, there exists µ which satisfies µn2≡ 1 (mod (p – 1) / n2). By theorem 3, aµ n mod p is the trivial root to the new congruence.Further, we can verify whether aµ n mod p is the trivial root to x n≡a (mod p) or not.If is, the condition a (p – 1) / n2≡ 1 (mod p) holds affirmatively. That is, a belongs to the sub-group of order (p –1) / n2. Naturally, a also belongs to the sub-group of order (p –1) / n. Therefore, the probability that aµn is the trivial root to x n≡a (mod p) is((p – 1) / n2) / ((p – 1) / n) = n / n2 = 1 / n.If not, then x n≡a (mod p) has only non-trivial roots, or no solution at all when a is not a true residue.4 ConclusionsFor the congruence x n≡a (mod p) with the true residue a, if gcd(n, p – 1) = 1, it has only a solution, namely the trivial solution. If n | (p – 1) and gcd(n, (p – 1) / n) = 1, it has the trivial solution and non-trivial solutions. If n | (p – 1) and gcd(n, (p – 1) / n) > 1, it has likely only non-trivial solutions. By theorem 2, 3, corollary 3.3 and 3.4, we can figure out the trivial solution in determinate polynomial time. Through the algorithm in section 1.6 of [4], we can seek random non-trivial solutions in probabilistic polynomial time. However, to seek a specific non-trivial solution is still infeasible in polynomial time when the number of the solutions is large enough.We can not obtain the non-trivial solutions from the trivial solution, that is, a non-trivial solution can not be expressed with the trivial solution.Let g be a generator, then gφ(p)≡ 1 (mod p), and all the elements of * p may be described as g1, g2, …, gφ(p). Further, let a≡gτ (a) (mod p), and x≡gτ (x) (mod p), then all the solutions to x n≡a (mod p) can be written as x≡gτ (x) + k (p – 1) / gcd(p – 1, n) (mod p), where k = 0, 1, …, (n – 1) [5]. However, to compute τ(a) is the DLP, that is, to seek the general expression of the solutions to x n≡a (mod p) is intractable.References[1] A. J. Menezes, P. van Oorschot, and S. Vanstone, Handbook of Applied Cryptography, London: CRC Press, 1997,ch.2.[2] T. ElGamal, “A Public-key Cryptosystem and a Signature Scheme Based on Discrete Logarithms,” IEEETransactions on Information Theory, v. 31, n. 4, 1985, pp. 469-472.[3] R. L. Rivest, A. Shamir and L. M. Adleman, “A Method for Obtaining Digital Signatures and Public-keyCryptosystems,” Communications of the ACM, 21(2), 1978, pp.120-126.[4] Henri Cohen, A Course in Computational Algebraic Number Theory, Berlin: Springer-Verlag, 2000, ch. 1, 3.[5] Song Y. Yan, Number Theory for Computing, 2nd ed., Berlin: Springer-Verlag, 2002, ch. 1.[6] Thomas W. Hungerford, Algebra, New York: Springer-Verlag, 2004, ch. 1–3.[7] Paul Garrett, Making, Breaking Codes: An Introduction to Cryptology, New Jersey: Prentice-Hall, 2001, ch. 12.About AuthorShenghui Su, professor and doctorand, obtained bachelor and master degrees respectively from National University of Defence Technology and Peking University, and now is engaged in researches on cryptographic algorithms, information securities and decision support systems.。