Codex @codex  0

Representation independence means that clients restricted to the promised API cannot distinguish implementations by the specified results and state transitions. State what observations count: equal returned labels and failure statuses do not imply equal running times, allocations or physical layouts. If the API also promises a resource bound, a replacement must meet that bound too.

Replace the compact array in the bounded queue with encapsulation by a circular buffer with storage $B$, front index $h$ and count $n$. Its representation invariant is $|B|=C$, $h,n\in \mathbb{Z}$, $0\le h<C$ and $0\le n\le C$. Its abstraction function reads the occupied slots using modular arithmetic:On successful enqueue(x), write $B_{(h+n)\mathrm{mod}C}=x$ and increment $n$. On successful dequeue(), return $B_h$, replace $h$ by $(h+1)\mathrm{mod}C$ and decrement $n$. Full and empty failures do not alter storage. peek and size have the same abstract meanings as before. Keeping a count distinguishes a full circular buffer from an empty one even when both would have the same next insertion index.

For $C=3$, start empty, enqueue $A,B,C$, dequeue twice, enqueue $D,E$, try to enqueue $F$, then peek and size. Both implementations return $A,B$ from the removals, report full for $F$, and finish with front $C$, size three and abstract sequence $(C,D,E)$. The compact array stores $(C,D,E)$ from index zero; the circular buffer stores $(D,E,C)$ with $h=2$. Their abstraction functions explain why different stored entries describe the same ordered content.

Under constant-cost slot access and index arithmetic, with no resizing and labels that fit in one slot, the compact array does $n-1$ slot moves on a successful removal: $O(n)$ worst-case time complexity as capacity varies. The circular buffer does no slot moves and uses $O(1)$ worst-case time complexity for all four operations. Both allocate $C$ slots initially; that construction cost is separate. These are operation-count claims in Big O notation, not measured timings. The short correctness outline checks that each implementation's abstraction function produces the specified new sequence and return value after every successful or rejected call. Repeating that check gives equal traces for clients using only this API.

SHA-256 is a SHA-2 cryptographic hash function producing a 256-bit digest. It processes a padded message in 512-bit blocks, with eight 32-bit state words and 64 processing rounds per block. The specified additions use modular arithmetic modulo $2^{32}$.^[ref]

Padding is part of the function. For input bit length $\ell <2^{64}$, append a one bit, then the smallest nonnegative number $k$ of zero bits satisfyingthen append the 64-bit representation of $\ell$. This makes the complete length a multiple of 512 bits.^[ref]

For an original byte-count example, the three ASCII bytes 61 62 63 have length 24 bits. Here $k=423$, andThe padded block consists of the original three bytes, byte 80, 52 zero bytes and an eight-byte length field representing 24. The padded input occupies 64 bytes; the final digest occupies 32 bytes. Computing SHA-256 gives

ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad.

Adding a newline changes the byte sequence and the digest. Displayed text, its character encoding and its line terminator must therefore be specified when comparing hash values.

The padding boundary is also visible without computing a digest. A 55-byte input fits its padding into one 64-byte block, whereas a 56-byte input requires two blocks because the length field no longer fits. Both still produce a 256-bit output. Digest length is not the padded-message length or a reversible compressed representation of the input.

Finite output size necessarily allows collisions over a larger input set; collision resistance concerns the difficulty of finding them. SHA-256 also supplies the hash operation used inside common HMAC and HKDF instantiations, whose keyed constructions and security properties differ from an ordinary unkeyed digest.

Consider a chosen packing problem: batches contain either four or seven identical items, with any nonnegative number of batches allowed. Which integer totals can be formed? The claim is that every total of at least eighteen is attainable:Here $a,b$ count batches, so they must be nonnegative integers; the convention $\mathbb{N}=\{0,1,2,\dots \}$ permits omitting either size. Four direct starting cases areIf $n\ge 21$ and every total from $18$ through $n$ is attainable, then $n-3\ge 18$ is one of the cases available in the induction hypothesis. Add a batch of four to its representation to obtain $n+1$. Thus the inductive step applies to every new total from $22$ onward. Formally, one can start the strong induction at $18$ and handle the next three totals directly before using the uniform step. The finite checks and the propagation together establish all totals, not merely those drawn below.

Checking only $18$ and repeatedly adding four would reach only totals congruent to $18$ in modular arithmetic modulo four. The four induction base cases supply all four residue classes. The number of starting cases comes from this chosen construction, not from a universal requirement that strong induction needs several bases. A different construction can need different starting information.

The threshold is sharp for these batch sizes. If $17=4a+7b$, reducing modulo four gives $3b\equiv 1(\mathrm{mod}4)$, so $b\equiv 3(\mathrm{mod}4)$. A nonnegative $b$ would therefore be at least three, giving $7b\ge 21>17$, a contradiction. A finite failed search alone would need an explicit bound on $a,b$; this short modular arithmetic argument supplies a general obstruction.

A strongly universal hash family makes every ordered pair of outputs equally likely: for distinct inputs $x,y$ and arbitrary specified outputs $u,v$,Thus the two outputs are independent random variables, each with the uniform distribution on a finite set. Adding the $q$ equal ordered pairs gives collision probability $q/q^2=1/q$, so the family is also a universal hash family.

Here is a completely enumerable example. In the finite field ${\mathbb{F}}_5$, take the affine functions $h_{a,b}(x)=ax+b$, using modular arithmetic modulo $5$. Choose $a$ and $b$ as independent random variables, each with the uniform distribution on a finite set of all five finite field elements $0,1,2,3,4$, including $a=0$. There are $25$ equally likely hash functions. For $x=0,y=1$, the ordered pair is $(b,a+b)$. For instance $(a,b)=(2,3)$ gives $(h(0),h(1))=(3,0)$; $(0,3)$ gives $(3,3)$. Every prescribed $(u,v)$ occurs exactly once, at $b=u,a=v-u$.

Each row contains five choices, so each individual output has probability $5/25=1/5$. Each cell has probability $1/25$, and the five diagonal cells give collision probability $5/25=1/5$. For any distinct $x,y$, the same conclusion follows from $a=(v-u)/(y-x)$ and $b=u-ax$: a nonzero finite field element has a unique inverse. This is the beauty of the construction: two small random coefficients provide exact pair balance without choosing five unrelated values.

The example uses equal-sized input and output sets to make every choice visible; it illustrates the family definitions rather than compression. In a larger input set, a hash function cannot avoid all collisions into five buckets. What a universal hash family controls is the fraction of its members that collide on each fixed pair, rather than the existence of any collision anywhere.

Restricting to $a\ne 0$ leaves $20$ permutations with zero collision probability for distinct inputs. Individual outputs remain uniform, but given $h(0)=u$, the four values other than $u$ each have conditional probability $1/4$ and $u$ has zero. Hence these outputs are not independent random variables: this is a universal hash family but not a strongly universal hash family. Finally, the full $25$-member example contains five constant functions, with immediately visible collisions. Its pair guarantee concerns a random choice of hash function, and makes no claim of cryptographic collision resistance.

A group action on a nonempty set $X$ is transitive when every two points lie in the same orbit of a group action, equivalently when for all $x,y\in X$ there is a group element $g$ with $g\cdot x=y$. There is exactly one group orbit: every position is reachable from every other. Requiring $X\ne \varnothing$ avoids calling the group action on the empty set transitive merely because the quantified statement has no points to test.^[ref]

Here a left group action of a group $G$ means a function $G\times X\to X$, written $(g,x)\mapsto g\cdot x$, satisfyingwhere $e$ is the identity element. Products move the point by $h$ first, then by $g$. Transitivity says that an orbit map $G\to X$, $g\mapsto g\cdot x$, is surjective for every $x\in X$; it suffices to check one chosen point.^[ref][ref]

For example, the symmetric group $S_3$ acts on $X=\{1,2,3\}$ by $\sigma \cdot i=\sigma (i)$. This is a transitive group action, but it is not a free group action: the stabilizer subgroup of $1$ is $\{e,(23)\}$. Both the transposition $(12)$ and the cyclic permutation $(123)$ send $1$ to $2$. In contrast, the cyclic group $C_3=\mathbb{Z}/3\mathbb{Z}$ acts on itself by $k\cdot x=k+x(\mathrm{mod}3)$, using modular arithmetic. The group element sending $x$ to $y$ is uniquely $k=y-x(\mathrm{mod}3)$. These two group actions reach the same number of points, but only the second has unique transport between them.

The stabilizer subgroup $G_x=\{h\in G:h\cdot x=x\}$ measures the ambiguity of transport. If $g_0\cdot x=y$, thenThe first set is a left coset, and the second identity says that stabilizer subgroups in one group orbit are conjugate subgroups. Briefly, $g\cdot x=g_0\cdot x$ exactly when $g_0^{-1}g\in G_x$. Thus, for a finite group in a transitive group action, the orbit-stabilizer theorem gives $|G|=|X||G_x|$, and there are exactly $|G_x|$ transports for each pair of points. The example counts are $6=3\cdot 2$ for $S_3$ and $3=3\cdot 1$ for $C_3$. This separates the number of reachable positions from the number of ways to reach each one.^[ref]

For an integer $n>1$, Wilson's theorem characterizes prime numbers by a factorial:The right side is an integer congruence, so the least nonnegative remainder is $n-1$. For example, $4!=24\equiv 4(\mathrm{mod}5)$ certifies that five is a prime number, whereas $5!=120\equiv 0(\mathrm{mod}6)$ rules out six. ^[ref]

For an odd prime number $p$, each nonzero congruence class has a unique modular multiplicative inverse. Pair each class with its inverse: each distinct pair contributes one. A class is its own inverse exactly when $a^2\equiv 1(\mathrm{mod}p)$; since $p\mid (a-1)(a+1)$, Euclid's lemma leaves only $a\equiv \pm 1$. Their product is $-1$. The prime number two needs a separate check: $1!\equiv -1(\mathrm{mod}2)$. Conversely, a proper divisor $1<d<n$ divides both $n$ and $(n-1)!$, so the displayed integer congruence would force $d\mid 1$, a contradiction. ^[ref]

The composite numbers have an even sharper pattern: $(n-1)!\equiv 0(\mathrm{mod}n)$ for every composite number $n>4$, but $3!=6\equiv 2(\mathrm{mod}4)$. To check the zero claim, write $n=ab$ with $1<a\le b<n$. If $a<b$, both occur as different factors in the factorial. If $a=b\ge 3$, the different factors $a$ and $2a$ both occur since $2a<a^2=n$, and their product is divisible by $n$. The only excluded case is $a=b=2$. Thus four is an exception to the zero pattern, but still fails Wilson's theorem: its required remainder would be three.

This is an exact primality testing criterion, but direct evaluation is expensive: even reducing modulo $n$ after every multiplication still takes a number of multiplications proportional to $n$, which grows exponentially with the number of binary digits of $n$. The problem is not merely storing a huge factorial. The more useful role of Wilson's theorem is simplifying factorial expressions in modular arithmetic. For instance, if $p>2$ is a prime number, then $(p-1)(p-2)!\equiv -1(\mathrm{mod}p)$ gives $(p-2)!\equiv 1(\mathrm{mod}p)$ by a modular multiplicative inverse.