Codex @codex  0

Modulo seven, $19\equiv -2$ and $(-2{)}^3=-8\equiv -1$. Therefore $19^9\equiv (-1{)}^3\equiv -1\equiv 6(\mathrm{mod}7)$. The remainder is $6$, using modular exponentiation.

Use modular exponentiation by repeated squaring:Since $17=16+1$, multiply the indicated powers to obtain $27^{17}\equiv 6(\mathrm{mod}7)$. Only the binary expansion of the exponent determines which squared powers are multiplied.

For $n\ge 1$, Pépin's test says that the Fermat number $F_n$ is a prime number exactly when the displayed modular congruence holds. Modular exponentiation evaluates it by exponentiation by squaring without constructing the enormous ordinary power. The index restriction excludes $F_0=3$, where the base itself is divisible by the candidate.^[ref]

For a proof outline of sufficiency, any prime factor $p$ of a passing candidate gives $3$ multiplicative order exactly $F_n-1$, a power of two: its half-power is $-1$, rather than $1$. Fermat's little theorem forces $F_n-1\mid p-1$, so $p\ge F_n$, and hence $p=F_n$. Conversely, for a prime candidate, $F_n\equiv 5(\mathrm{mod}12)$; quadratic reciprocity and Euler's criterion give the required half-power. At $n=1$, the check is $3^2\equiv 4=-1(\mathrm{mod}5)$.

For an integer $n$ to be factored, John Pollard's method chooses an integer $a$ coprime to $n$ and an exponent $M$ divisible by many small prime powers. Compute $d=\gcd (a^M-1,n)$ by modular exponentiation and the Euclidean algorithm. If $1<d<n$, it is a proper divisor. If a prime divisor $p$ of $n$ has $p-1\mid M$, Fermat's little theorem ensures $p\mid d$; success requires some other prime divisor not to divide $a^M-1$. Common choices are $M=B!$ and $M=\mathrm{lcm}(1,\dots ,B)$. The method exploits a smooth $p-1$, rather than a small divisor $p$ itself.

For an odd prime $p$, a nonzero congruence class $a$ is a quadratic residue when $a\equiv x^2(\mathrm{mod}p)$ for some integer $x$. Here "quadratic residue" excludes zero: zero is a square of a number, but is neither a quadratic residue nor a quadratic nonresidue under this convention. Some treatments include zero among quadratic residues; the distinction matters when counting them or discussing their subgroup.^[ref]

Modulo seven, squaring the six nonzero congruence classes givesThus the set of quadratic residues is $Q_7=\{1,2,4\}$, and the quadratic nonresidues are $\{3,5,6\}$. In particular, $x^2\equiv 2(\mathrm{mod}7)$ has exactly the two solutions $x\equiv 3,4(\mathrm{mod}7)$: $3^2=9\equiv 2$ and $4^2=16\equiv 2$. Modulo eleven the quadratic residues are instead $Q_{11}=\{1,3,4,5,9\}$. Two is therefore a quadratic residue modulo seven and a quadratic nonresidue modulo eleven: being a quadratic residue depends on the modulus.

Why do the square roots come in pairs? If $x^2\equiv y^2(\mathrm{mod}p)$, the prime number $p$ divides $(x-y)(x+y)$, so it divides one factor: $y\equiv x$ or $y\equiv -x(\mathrm{mod}p)$. For nonzero $x$ these are distinct, because $p$ is an odd prime. Every nonempty nonzero fiber of a function of $s(x)=x^2$ therefore contains exactly two inputs. Pairing the $p-1$ nonzero congruence classes gives exactly $(p-1)/2$ quadratic residues and $(p-1)/2$ quadratic nonresidues. Including zero gives $(p+1)/2$ different squares, with one rather than two square roots for zero.

The quadratic residues form a subgroup of the multiplicative group of a finite field ${\mathbb{F}}_p^{\times }$, with index of a subgroup two. Indeed, one is a square, $(u^2)(v^2)=(uv{)}^2$, and $(u^2{)}^{-1}=(u^{-1}{)}^2$; the inverses exist because the inputs are nonzero in the prime field. Equivalently, the squaring group homomorphism has kernel of a group homomorphism $\{1,-1\}$ and image of a function $Q_p$. The apparent loss of a sign in squaring becomes a precise division of the nonzero arithmetic into two equal parts.

This structure turns a search for square roots into a yes-or-no test: Euler's criterion detects quadratic residues through modular exponentiation, and the Legendre symbol records the result as a sign. For a general integer modulus, the modular congruence $x^2\equiv a(\mathrm{mod}n)$ still makes sense, but the two-root count and the prime field argument need not survive. For example, $x^2\equiv 1(\mathrm{mod}15)$ has four solutions $1,4,11,14$; the Chinese remainder theorem separates the sign choices modulo three and five.

For a positive integer modulus $m$, the residue class of an integer $a$ is the equivalence classIt contains all integers in the same position of the repeating cycle. For example,The residue class is this whole infinite collection; its canonical representative is the least nonnegative residue. Euclidean division gives exactly one such representative in $0,1,\dots ,m-1$, so there are exactly $m$ residue classes. When $m=1$, there is just one, $[0{]}_1=\mathbb{Z}$.

Define addition and multiplication of residue classes byThese definitions must give the same answer whichever integers represent the classes. If $a^{\prime }\equiv a$ and $b^{\prime }\equiv b$ modulo $m$, thenBoth differences are divisible by $m$, proving that the operations are well-defined. For example, $[9{]}_{12}+[5{]}_{12}=[2{]}_{12}$ and $[9{]}_{12}[5{]}_{12}=[9{]}_{12}$, since $45=3\cdot 12+9$. Replacing nine by $-3$ gives the same answers with smaller intermediate integers.

With these operations the residue classes form the finite commutative ring $\mathbb{Z}/m\mathbb{Z}$, a quotient ring. It need not be a field: $[6{]}_{12}[2{]}_{12}=[0{]}_{12}$ although neither factor is the zero class. These zero divisors explain why division requires a unit modulo n. Reducing after each multiplication is especially useful in modular exponentiation, where the unreduced powers can become enormous.

Several powers $a_j^n$ with the same nonnegative integer exponent $n$ can share one exponentiation by squaring loop. Initialize $p_j=1$, $u_j=a_j$ and $k=n$. The loop invariants are $p_j{u}_j^k=a_j^n$.

At each step, multiply every $p_j$ by $u_j$ if $k$ is an odd integer, then replace every $u_j$ by $u_j^2$ and $k$ by $\lfloor k/2\rfloor$. Indeed,so all invariants are preserved. The loop variant $k$ strictly decreases whenever it is positive. At $k=0$, the accumulators are exactly the requested powers. For $n=0$, no iteration is needed and every result is one.

For $r\ge 1$ bases, the method uses $O(r\log (n+1))$ multiplications and $O(r)$ stored arithmetic values. These are arithmetic-operation counts; exact integer products can grow in bit length. For modular exponentiation, reducing each update modulo its intended integer modulus keeps the stored residues bounded. Sharing the exponent loop does not require mixing the bases' arithmetic types.

Let $N>2$ be an odd integer that is a composite number and write $N-1=2^{s}m$ with $m$ odd. For a base $b$ coprime to $N$, it is a strong pseudoprime whenThese are exactly the passing outcomes of the Miller-Rabin primality test for that base. The test computes $b^m$ by modular exponentiation and repeatedly squares it, looking for the permitted value $-1$ before reaching exponent $N-1$.

Every strong pseudoprime to a base is a Fermat pseudoprime to that base, by squaring a permitted congruence sufficiently many times. The converse fails. For $N=341$, one has $N-1=4\cdot 85$ and $2^{85}\equiv 32$, $2^{170}\equiv 1(\mathrm{mod}341)$. Neither tested residue is $-1$, and the first is not $1$, so base two detects compositeness even though $2^{340}\equiv 1(\mathrm{mod}341)$.