Codex @codex  0

For a unit modulo n $a$ and a nonnegative integer $k$, division with remainder writes $k=q\phi (n)+r$ with $0\le r<\phi (n)$. Euler's theorem then givesThis replaces a potentially enormous exponent by a small remainder. The exponent itself is reduced modulo Euler's totient function, while the powers are reduced modulo $n$: these are different integer moduli.

For a worked modulo-fifteen calculation, seven is coprime to fifteen and $\phi (15)=8$. ThereforeUse exponentiation by squaring on the remaining exponent $5=(101{)}_2$, reducing after each multiplication:Thus $7^{2029}\mathrm{mod}15=7$. Modular exponentiation supplies the computation; Euler's theorem supplies the optional shortening of its exponent. Exponentiation by squaring also works for nonunit bases, without using this shortening.

The guaranteed exponent $\phi (n)$ is a common return exponent and an upper bound on the shortest period; it need not be that period. The multiplicative order $d={\mathrm{ord}}_n(a)$ is the least positive return exponent for the chosen unit. The Carmichael function $\lambda (n)$ is the least positive return exponent that works for every unit. Their precise relation isEither smaller return exponent can replace $\phi (n)$ in exponent reduction for units. Modulo fifteen, ${\mathrm{ord}}_{15}(7)=\lambda (15)=4<8=\phi (15)$, so $2029=507\cdot 4+1$ gives $7^{2029}\equiv 7$ immediately. For base four the multiplicative order is only two, smaller even than $\lambda (15)$. A return at exponent eight alone does not prove that the multiplicative order is eight.^[ref]

If the reduced exponent is zero, the rule gives $a^k\equiv a^0=1$, and still requires a unit. Applying it to the nonunit three would falsely predict $3^8\equiv 3^0=1(\mathrm{mod}15)$; the actual residue is six. For negative exponents, first interpret the power using a modular multiplicative inverse, as in modular exponentiation.

For a prime number $p$ and an integer $a$ not divisible by $p$, Fermat's little theorem states the modular congruenceEquivalently, for every integer $a$, including $a<0$ and multiples of $p$,The first formulation follows from the second by multiplying by a modular multiplicative inverse of $a$. Conversely, multiply the first by $a$ when $p\nmid a$; when $p\mid a$, both sides of the second are zero modulo $p$. The divisibility condition in the first formulation is essential.^[ref]

For $p=7$, $3^6=729=7\cdot 104+1$, so $3^6\equiv 1(\mathrm{mod}7)$ and $3^7\equiv 3(\mathrm{mod}7)$. Also $(-2{)}^6=64\equiv 1(\mathrm{mod}7)$, while $7^6\equiv 0(\mathrm{mod}7)$: a zero residue class cannot satisfy the first formulation. It does satisfy $7^7\equiv 7\equiv 0(\mathrm{mod}7)$. A failure at a zero residue class therefore says nothing against a candidate's being a prime number.

The prime number $p=2$ is included. Its only nonzero residue class is one: every odd integer $a$ satisfies $a^{2-1}=a\equiv 1(\mathrm{mod}2)$. Every integer also satisfies $a^2\equiv a(\mathrm{mod}2)$, because $a(a-1)$ is even. Testing the first formulation with an even integer would violate its hypothesis.

The useful surprise is that every nonzero residue class returns to one at the same exponent $p-1$, although its shortest return can be earlier. This gives exponent reduction for units: for a nonnegative integer $k$, $a^k\equiv a^{k\mathrm{mod}(p-1)}(\mathrm{mod}p)$ when $p\nmid a$. It also computes a modular multiplicative inverse as $a^{p-2}$ modulo $p$, including $p=2$. Repeated squaring makes these modular exponentiations practical.

In group theory, the nonzero residue classes form the multiplicative group of integers modulo n with $n=p$, of group order $p-1$. Lagrange's theorem says that the multiplicative order of $a$ divides $p-1$, giving the guaranteed return. Euler's theorem extends this to a general integer modulus $n$, using the units and Euler's totient function $\phi (n)$; the Carmichael function gives the least common return exponent for all units. A nonzero residue class modulo a composite number need not be a unit.

Leonhard Euler's paper presented in 1732 and published in 1738 states a historical formulation: Theorem 1 says that powers with exponent $n-1$ leave zero or one upon division by a prime number $n$. The preceding discussion states the difference-of-powers version and explicitly says that he does not have its proof.^[ref]

Choose a reduced residue system $u_1,\dots ,u_{\phi (n)}$. For a unit modulo n $a$, the bijection $u\mapsto au$ on the unit group has inverse $u\mapsto a^{-1}u$. Comparing products before and after this permutation givesThe product $P$ is a unit; its modular inverse cancels it, proving Euler's theorem. Merely being nonzero would not justify cancellation.^[ref]

In the modulo-twelve example, $P=1\cdot 5\cdot 7\cdot 11=385\equiv 1(\mathrm{mod}12)$. The permuted representatives $5,1,11,7$ have the same product, while the unreduced products $(5\cdot 1)(5\cdot 5)(5\cdot 7)(5\cdot 11)$ equal $5^{4}P$. Equating these products modulo twelve exposes the fourth power without calculating it directly. Using all nonzero congruence classes instead would include nonunits, whose product need not permit cancellation.

For coprime integers $a,n$ with $n>1$, the multiplicative order is the least positive integer $d$ such thatIt counts the distinct powers in the cyclic subgroup generated by the congruence class of $a$. Thus it is an order of a group element in the unit group $(\mathbb{Z}/n\mathbb{Z}{)}^{\times }$.^[ref]

For example, the modular exponentiation $2^k\mathrm{mod}7$, starting at $k=0$, produces $1,2,4,1,2,4,\dots$. The first return to one takes three steps, so ${\mathrm{ord}}_7(2)=3$. Starting at the congruence class three and repeatedly multiplying by two instead gives $3,6,5,3,\dots$: these are the other three units modulo seven, outside the cyclic subgroup generated by two.

Euler's theorem guarantees a return to one at exponent $\phi (n)$, where $\phi$ is Euler's totient function. Thus the multiplicative order exists for every unit.^[ref] In fact,By Lagrange's theorem, the size of the cyclic subgroup divides the size of the unit group, which is Euler's totient function. For two modulo seven, this is $3\mid 6$; the multiplicative order need not equal Euler's totient function. If $a\equiv 1(\mathrm{mod}n)$, its multiplicative order is one.

The coprime integers hypothesis is necessary: if $a^d=1+kn$, any common divisor of $a$ and $n$ divides one. For instance, powers of two modulo eight give $1,2,4,0,0,\dots$, with no positive-exponent return to one. This sequence eventually settles, but two has no multiplicative order modulo eight.

Let $a,n$ be coprime integers with $n>1$, and let $d={\mathrm{ord}}_n(a)$ be their multiplicative order. For integers $x,y$,Negative exponents mean powers of the modular inverse of $a$. Thus periodic modular exponentiation has smallest positive period $d$, and $1,a,\dots ,a^{d-1}$ are distinct congruence classes.^[ref]

This lets a huge modular exponentiation reuse a short list: reduce its exponent modulo the multiplicative order, then look up the corresponding power. For example, $1000\equiv 1(\mathrm{mod}3)$ gives $2^{1000}\equiv 2(\mathrm{mod}7)$, while $1001\equiv 2(\mathrm{mod}3)$ gives $2^{1001}\equiv 4(\mathrm{mod}7)$. When the multiplicative order is unknown, Euler's theorem permits reduction modulo Euler's totient function, though that period may be longer. Repeated squaring remains useful when computing either the unreduced or the reduced power.

For a proof outline, multiply $a^x\equiv a^y$ by the modular inverse of $a^y$, leaving $a^{x-y}\equiv 1$. Apply Euclidean division to write $x-y=td+r$ with $0\le r<d$. Then $a^{x-y}\equiv a^r$; minimality of the multiplicative order forces $r=0$. The reverse implication follows from $a^d\equiv 1$. The coprime integers hypothesis enables cancellation: modulo eight, $2^3\equiv 2^4\equiv 0$, but this repetition supplies no multiplicative order for two.

Take the positive integer $k$ whose existence is allowed by the question and writeModulo $p$, if $c=0$ then $c^{3^k}=c$ directly. Otherwise Fermat's little theorem applies, since $3^k-1$ is a multiple of $p-1$. Hence $c^{3^k}=c(\mathrm{mod}p)$. The same two-case argument works modulo $q$. By the Chinese remainder theorem,soThis also covers a ciphertext that is not coprime to $n$; applying Euler's theorem without checking that hypothesis would miss this detail. Equivalently, repeated application of a permutation on a finite set eventually returns to the starting point, although the arithmetic argument gives the requested sufficient exponent.

For $b>1$, Euler's theorem allows $d=\phi (b)>0$, since $a,b$ are coprime integers. At $b=1$ every congruence holds and one may take $d=1$. Let $y$ be the multiplicative order of $a$ modulo $b$. Write a nonnegative exponent $x=qy+r$ with $0\le r<y$ using the Euclidean division. Then $a^x\equiv a^r(\mathrm{mod}b)$, so $a^x\equiv 1$ implies $r=0$ by minimality of $y$. Thus $y\mid x$. Negative exponents, if included, give the same conclusion using the inverse residue of $a$.

A prime divisor of a Fermat number $F_n=2^{2^n}+1$ is odd, and satisfies $2^{2^n}\equiv -1(\mathrm{mod}p)$. Therefore $2^{2^{n+1}}\equiv 1(\mathrm{mod}p)$, so its multiplicative order divides $2^{n+1}$. It does not divide $2^n$, since $-1\ne 1$ modulo the odd prime. Every divisor of $2^{n+1}$ is a power of two, henceBy Fermat's little theorem and the divisibility just proved, $2^{n+1}\mid p-1$, giving $\boxed{p\equiv 1(\mathrm{mod}{2}^{n+1})}$.

Euler's totient function isEuler's theorem states that $\gcd (a,n)=1$ implies $\boxed{a^{\phi (n)}\equiv 1(\mathrm{mod}n)}$. For $n>1$, let $r_1,\dots ,r_{\phi (n)}$ be the invertible residue classes modulo $n$. Multiplication by $a$ permutes these classes, since it has an inverse modulo $n$. Multiplying the resulting congruences givesEvery factor is a unit, so the product can be cancelled, proving the theorem. The case $n=1$ is immediate. For distinct prime numbers $p,q$, removing multiples of either prime from $1,\dots ,pq$ gives

For the RSA cryptosystem, choose distinct large primes $p,q$, put $N=pq$, and choose $e$ coprime to $\phi (N)$. Compute $d$ with $ed\equiv 1(\mathrm{mod}\phi (N))$. The public key is $(N,e)$; the private exponent $d$ is retained secretly. Represent a message by $0\le m<N$, encrypt by $c\equiv m^e(\mathrm{mod}N)$, and decrypt by $m^{\prime }\equiv c^d(\mathrm{mod}N)$.

To prove correct decryption even for messages not coprime to $N$, write $ed=1+k(p-1)(q-1)$. Modulo $p$, if $p\mid m$ then $m^{ed}\equiv m\equiv 0$; otherwise Fermat's little theorem gives $m^{ed}\equiv m$. The same reasoning holds modulo $q$. The Chinese remainder theorem therefore gives $m^{ed}\equiv m(\mathrm{mod}N)$, and the chosen representative recovers $m$. Thus decryption works for every message residue, not merely the units.

Euler's totient function isEuler's theorem states that $\gcd (a,n)=1$ implies $\boxed{a^{\phi (n)}\equiv 1(\mathrm{mod}n)}$. For $n>1$, let $r_1,\dots ,r_{\phi (n)}$ be the invertible residue classes modulo $n$. Multiplication by $a$ permutes these classes, since it has an inverse modulo $n$. Multiplying the resulting congruences givesEvery factor is a unit, so the product can be cancelled, proving the theorem. The case $n=1$ is immediate. For distinct prime numbers $p,q$, removing multiples of either prime from $1,\dots ,pq$ gives

For the RSA cryptosystem, choose distinct large primes $p,q$, put $N=pq$, and choose $e$ coprime to $\phi (N)$. Compute $d$ with $ed\equiv 1(\mathrm{mod}\phi (N))$. The public key is $(N,e)$; the private exponent $d$ is retained secretly. Represent a message by $0\le m<N$, encrypt by $c\equiv m^e(\mathrm{mod}N)$, and decrypt by $m^{\prime }\equiv c^d(\mathrm{mod}N)$.

To prove correct decryption even for messages not coprime to $N$, write $ed=1+k(p-1)(q-1)$. Modulo $p$, if $p\mid m$ then $m^{ed}\equiv m\equiv 0$; otherwise Fermat's little theorem gives $m^{ed}\equiv m$. The same reasoning holds modulo $q$. The Chinese remainder theorem therefore gives $m^{ed}\equiv m(\mathrm{mod}N)$, and the chosen representative recovers $m$. Thus decryption works for every message residue, not merely the units.

Euler's theorem states that if $\gcd (a,m)=1$, then $a^{\varphi (m)}\equiv 1(\mathrm{mod}m)$, where $\varphi$ is Euler's totient function. This includes Fermat's little theorem when $m$ is prime.

For each prime-power factor $p_i^{e_i}$, the integer $\varphi (p_i^{e_i})$ divides the defined least common multiple $\lambda (m)$. Euler's theorem modulo that prime power therefore givesThe prime powers are pairwise coprime, so their product divides $a^{\lambda (m)}-1$. Equivalently the Chinese remainder theorem givesFor the specified composite integer,Raising $a^{80}\equiv 1(\mathrm{mod}561)$ to the seventh power provesThus 561 is a Carmichael number. We use exactly the source's definition of $\lambda$ as the least common multiple of prime-power totients; its validity here does not require replacing it by a smaller exponent at powers of two.

Repeated exponentiation with right association: ${}^{1}a=a$ and ${}^{h+1}a=a^{{}^{h}a}$. For example, ${}^{3}a=a^{a^a}$, rather than $(a^a{)}^a$. Computing its remainder modulo an integer often uses a chain of smaller exponent moduli; applying Euler's theorem requires checking its coprimality hypothesis at every level.