Codex @codex  0

The auxiliary Higman group $Q$ has no nontrivial finite quotients of a group. One can use this permitted property directly, but there is a short verification. In any finite quotient, let $n_i$ be the order of the image of $a_i$. Since conjugation sends $a_{i+1}$ to its square, $n_{i+1}$ must be odd. If some $n_i>1$, choose the least prime number $p$ dividing any $n_i$. It is odd. Conjugation by the preceding generator givesThe multiplicative order of $2$ modulo $p$ is therefore a divisor of $n_{i-1}$. It is greater than one and divides $p-1$ by the Fermat little theorem, so it has a prime divisor smaller than $p$. That prime also divides $n_{i-1}$, contradicting the choice of $p$. Hence every $n_i=1$ and the quotient is trivial.

Given any finitely presented group $P$, form $\hat{P}=P\ast ⟨v⟩$, and apply part (a) to the word $w=v$. This word is nontrivial by the normal form theorem for a free product, so the output $J=\hat{P}(v)$ contains $P$ by the embedding already proved.

To check its finite quotients, let $f:J\to F$ be any group homomorphism to a finite group. The image of the copy of $Q$ is trivial by the preceding property. The identifications $u_j=a_3^{j+1}{a}_1{a}_3^{-(j+1)}$ make all $f(u_j)$ trivial. Thus the equations $u_j^{-1}c{u}_j=g_j$ give, in the image,Since $f(c)=f(z)$, this forces $f(x_i)=1$ for all generators of $\hat{P}$, including $v$. The defining word $c=[v,z]$ then has trivial image, so $f(z)=f(d)=1$ as well. Every generator of $J$ has trivial image. ThereforeThis uses the concrete construction of part (a), not an assumption that arbitrary quotients preserve an embedding of $P$.

Here the true multiplicative order is four, and it divides every power-of-two Fourier-register size $Q\ge 4$, including the $Q=256$ choice from part (ii). A second-register measurement produces one of the four periodic cosetsIts quantum Fourier transform has nonzero amplitudes only at $j=0,Q/4,Q/2,3Q/4$, and each has squared modulus $1/4$. The inverse transform only changes phases or permutes these four labels. Hence the measured ratios $0,1/4,1/2,3/4$ are equally likely.

For $1/4$ or $3/4$, continued-fraction recovery in quantum order finding returns denominator four. Part (i) then gives factors three and five. For $1/2$, the reduced denominator is two. Although two is not a period, the candidate-denominator gcd post-processing in part (ii) still gives a factor:The zero outcome produces no useful even candidate and the run fails. For the factor-extraction procedure specified above, three of the four outcomes succeed:There is an important convention behind this answer. A version that rejects a candidate unless $7^q\equiv 1(\mathrm{mod}15)$ before attempting any gcd rejects $q=2$, since $7^2\equiv 4$. Under that validated-period convention only the two odd-numerator phases succeed, givingThus the probability of recovering the true multiplicative order is $1/2$, whereas the probability of finding a factor with direct gcd post-processing is $3/4$. The printed question does not specify this classical post-processing detail; stating it avoids identifying these two different events.

Let $L=\lceil {\log }_{2}N\rceil$. In the Shor algorithm, first use classical arithmetic to deal with even $N$ and perfect powers, and to reject prime inputs. Perfect-power recognition and primality testing have polynomial-time classical algorithms. Factoring a perfect power $b^k$, with $b,k>1$, already gives a nontrivial factor $b$. We may therefore consider an odd composite $N$ with at least two distinct prime factors.

Choose $\alpha$ uniformly from $1<\alpha <N$ and compute its greatest common divisor with $N$ using the Euclidean algorithm. A proper nontrivial divisor ends the computation. Otherwise $\alpha$ is a unit, and the remaining task is quantum order finding. SetPrepare a uniform quantum superposition in a $t$-qubit register and use quantum modular exponentiation in a second register to obtainRepeated squaring and reversible modular multiplication implement this step with polynomially many quantum gates in $L$. Apply the inverse quantum Fourier transform to the first register and perform a quantum measurement in the computational basis, obtaining $j$. Measuring the second register first, and Fourier-transforming the resulting periodic coset, gives the same distribution of $j$.

Here is a quantitative quantum Fourier sampling bound for order finding. If $r={\mathrm{ord}}_N(\alpha )$, multiplication by $\alpha$ cycles its $r$ orbit states. The Fourier eigenstates of that cycle have eigenvalues $e^{2\pi is/r}$, and the initial state $|1⟩$ has squared overlap $1/r$ with each, for $0\le s<r$. ThereforeConditioned on a particular eigenphase $s/r$, its nearest integer outcome $j_s$ obeys $|j_s/Q-s/r|\le 1/(2Q)$ and has probability at least $4/{\pi }^2$. Indeed the absolute amplitude is $|\sin (\pi Q\delta )/(Q\sin (\pi \delta ))|$, where $\delta =s/r-j_s/Q$. For $|Q\delta |\le 1/2$, the numerator is at least $2Q|\delta |$ and the denominator at most $\pi Q|\delta |$; the limiting value at $\delta =0$ is one.

If $\gcd (s,r)=1$, the fraction $s/r$ is reduced, and $r<N$ givesUse continued-fraction recovery in quantum order finding. The relevant approximation theorem says that reduced fractions satisfying $|a/b-p/q|<1/(2q^2)$ are continued fraction convergents of $a/b$. For an input rational of $O(L)$ digits, their $O(L)$ candidates can be enumerated classically in $O(L^3)$ time, and their denominators are at most the reduced input denominator. This is the supplied continued-fraction result; discard candidate denominators exceeding $N$. A zero measurement is treated as a failed order-finding sample.

For each remaining even candidate denominator $q$, compute $z={\alpha }^{q/2}\mathrm{mod}N$ by repeated squaring, and try $\gcd (z-1,N)$ and $\gcd (z+1,N)$. Return only a divisor $d$ with $1<d<N$; otherwise repeat the quantum sample or choose another $\alpha$. This candidate-denominator gcd post-processing cannot return an incorrect factor, since its output is checked directly. When the recovered denominator is the true even multiplicative order and the square root of one is nontrivial, part (i) guarantees success. Checking ${\alpha }^q\equiv 1(\mathrm{mod}N)$ before trying the gcds is also a valid, more restrictive convention; the single-run distinction matters in part (iii).

Two further standard quantitative facts explain why repetitions remain efficient. First, for a uniformly chosen unit modulo an odd integer with at least two distinct prime divisors, the probability of a useful unit in Shor factorization is at least $1/2$: its true multiplicative order is even and ${\alpha }^{r/2}\not\equiv -1(\mathrm{mod}N)$. To see the source of this bound, the Chinese remainder theorem for unit groups makes the prime-power components independent. Each odd-prime-power unit group is cyclic. If its 2-primary order is $2^v$, the probability of the largest possible value of $v$ is $1/2$, and the probability of any specified smaller value is at most $1/2$. Failure requires all components to have the same $v$: either all zero, making $r$ odd, or all the same positive value, making the halfway power $-1$ in every component. Conditioning on one component, the chance another component matches it is at most $1/2$, so total failure is at most $1/2$.

Second, the fraction of phase numerators coprime to $r$ is $\phi (r)/r$, where $\phi$ is the Euler totient function. The elementary totient-ratio lower bound suffices: if the distinct prime divisors are $p_1<\cdots <p_k$, then $p_j\ge j+1$ and $k\le {\log }_{2}r$. The totient product formula therefore givesThus for a good $\alpha$, the probability of sampling a coprime phase numerator with the required accuracy is at least $(4/{\pi }^2)\phi (r)/r$. This is inverse-polynomial in the input length, so polynomially many repetitions achieve any fixed success probability. The quantum Fourier transform uses $O(t^2)$ elementary rotations and Hadamard gates in the ideal gate description, and the other quantum and classical stages are polynomial in $L$.

The reduction is therefore polynomial in the bit length:A small denominator need not itself be the true multiplicative order; verification of the final factor is essential, and no guarantee is claimed for every individual sample.

For coprime integers $\alpha ,N$, the multiplicative order is the smallest positive exponentIt exists because multiplication by $\alpha$ is an element of the finite group of units modulo an integer. For the example, the successive residues areNone of the first three is one, so the order is four.

The factor extraction from an even modular order uses the factorization ${\alpha }^r-1=({\alpha }^{r/2}-1)({\alpha }^{r/2}+1)$. If the multiplicative order $r$ is even, put $z={\alpha }^{r/2}\mathrm{mod}N$. Minimality of the multiplicative order excludes $z=1$; we also require $z\ne -1(\mathrm{mod}N)$. Thus $z^2\equiv 1(\mathrm{mod}N)$ is a nontrivial square root of one. Neither $z-1$ nor $z+1$ is divisible by all of $N$. If either were coprime to $N$, its inverse modulo $N$, applied to $(z-1)(z+1)\equiv 0$, would make the other divisible by $N$, a contradiction. Hence the greatest common divisorsare proper nontrivial factors. For odd $N$, $(z-1)$ and $(z+1)$ have no common prime divisor of $N$, so these two divisors are complementary. If the initial $\alpha$ is not coprime to $N$, a proper $\gcd (\alpha ,N)$ already supplies a factor without quantum order finding.

For $N=15$ and $\alpha =7$, $r=4$ and $z=7^2\mathrm{mod}15=4$, which is neither $1$ nor $14$. The factors areThe necessary conditions for this order-based reduction are a unit $\alpha \mathrm{mod}N$, even true multiplicative order, and ${\alpha }^{r/2}\not\equiv -1(\mathrm{mod}N)$.

For an odd prime number $p$, the Legendre symbol is zero when $p\mid a$, one when $a$ is a nonzero quadratic residue modulo $p$, and minus one otherwise. The number-theoretic Gauss lemma says that, for $p\nmid a$, $(a/p)=(-1{)}^r$, where $r$ counts those least positive residues of $a,2a,\dots ,(p-1)a/2$ exceeding $p/2$.

For $a=2$, the residues are simply $2,4,\dots ,p-1$, so $r=(p-1)/2-\lfloor p/4\rfloor$. Examining the four odd residue classes modulo eight givesNow $2^m\equiv -1(\mathrm{mod}p)$ and $p$ is odd. The multiplicative order $d$ of $2$ divides $2m$ but not $m$. Since $m$ is a power of two, every proper divisor of $2m$ divides $m$, whence $d=2m$. Lagrange's theorem for finite groups gives $2m\mid p-1$. Because $m\ge 4$, this implies $p\equiv 1(\mathrm{mod}8)$, so the supplementary law just proved gives $(2/p)=1$. By Euler's criterion, $2^{(p-1)/2}\equiv 1(\mathrm{mod}p)$, and consequently $2m\mid (p-1)/2$. Therefore

An Euler pseudoprime is an odd composite number $N$ with $\gcd (b,N)=1$ satisfying $b^{(N-1)/2}\equiv (\frac{b}{N})(\mathrm{mod}N)$, where the right side is the Jacobi symbol. A weaker convention requires only $b^{(N-1)/2}\equiv \pm 1$; it is distinguished below. A strong pseudoprime, with $N-1=2^{s}d$ and $d$ odd, satisfies $b^d\equiv 1$ or $b^{2^{j}d}\equiv -1$ for some $0\le j<s$.

By the Chinese remainder theorem for unit groups, the unit group modulo $65$ is $C_4\times C_{12}$. Modulo $5$, $b^{32}=1$. Thus the only possible sign in $b^{32}\equiv \pm 1(\mathrm{mod}65)$ is positive. Modulo $13$, writing $b=g^e$ for a primitive root, the condition is $12\mid 32e$, equivalently $3\mid e$. Consequently $b$ has multiplicative order dividing $4$ in each factor. Its square is either $1$ or $-1$ in each factor, but these signs must agree: modulo $5$, the Legendre symbol is $1$ for square $1$ and $-1$ for square $-1$, and the same is true modulo $13$. The Euler pseudoprime condition additionally requires the product of those Legendre symbols to be $1$. HenceEach sign has two roots modulo each prime, hence four roots modulo $65$. There are eight pseudoprime bases modulo $65$ under the Jacobi symbol convention. Under the weaker sign-only convention there are instead sixteen pseudoprime bases, since the two signs of the squares need not agree; the stated equivalence therefore specifically uses the Jacobi symbol convention.

For the strong pseudoprime condition, $s=6,d=1$. Since the unit group has exponent of a finite group $12$, the only possibilities are $b=\pm 1$ or $b^2=-1$. The six pseudoprime bases are $1,8,18,47,57,64$. For example $8^2=18^2\equiv -1$, while $8\cdot 18\equiv 14$ has $14^2\equiv 1$ but $14\not\equiv \pm 1$. Thus the strong-pseudoprime pseudoprime bases are not a subgroup.

Let $\zeta$ be a primitive fifth root of unity. Over ${\mathbb{F}}_p$, the Frobenius automorphism acts by $\zeta \mapsto {\zeta }^p$, so the splitting field of $X^5-1$ has degree equal to the multiplicative order of $p$ modulo $5$. Its Galois group is generated by Frobenius and is cyclic. The possible orders are therefore $1$ for $p\equiv 1$, $4$ for $p\equiv 2,3$, and $2$ for $p\equiv 4(\mathrm{mod}5)$.

Put $\alpha =5^{1/5}$. The polynomial $X^5-5$ satisfies the Eisenstein criterion at $5$, so $[\mathbb{Q}(\alpha ):\mathbb{Q}]=5$. Also $[\mathbb{Q}(\zeta ):\mathbb{Q}]=\phi (5)=4$. The intersection of these two fields has degree dividing both $5$ and $4$, hence is $\mathbb{Q}$. Since the splitting field is $\mathbb{Q}(\alpha ,\zeta )$,

Label the five roots by $\alpha {\zeta }^i$, $i\in {\mathbb{F}}_5$. The Galois group acts through the affine group over a finite field:Its possible nontrivial cycle types are $5$, $1+2+2$, and $1+4$; in particular, no element has a three-cycle. By the Dedekind factorization cycle test, the reduction of $X^5-5$ modulo any prime $p\ne 5$ therefore has no irreducible cubic factor.

The multiplier of the Frobenius element is $a=p(\mathrm{mod}5)$. If $p\equiv 2$ or $3$, then $a$ has order four; every affine map with this multiplier has one fixed point and one four-cycle. Hence $X^5-5$ is a product of a linear factor and an irreducible quartic. If $p\equiv 1$, Frobenius is a translation $i\mapsto i+b$: it is the identity when $b=0$, giving complete splitting, and is a five-cycle when $b\ne 0$, giving an irreducible polynomial.

A primitive root modulo $p$ is an integer $g$ whose residue class generates the multiplicative group of a finite field ${\mathbb{F}}_p^{\times }$. Equivalently, its multiplicative order modulo $p$ is $p-1$, so

Let $L$ be a splitting field of $f(X)=X^m-1$ over $k$. Its formal derivative isThe assumption on the characteristic of $k$ says that $m\ne 0$ in $k$. Any root $\alpha$ of $f$ is nonzero, and hence $f^{\prime }(\alpha )=m{\alpha }^{m-1}\ne 0$. Thus $f$ and $f^{\prime }$ have no common root, so $f$ is a separable polynomial. Since it has degree $m$ and splits over $L$, it has exactly $m$ distinct roots. This is the separability of roots of unity.

Fix a primitive root of unity ${\zeta }_m=e^{2\pi i/m}$. Define the $m$th cyclotomic polynomial byIt is monic and has degree given by the Euler totient function $\phi (m)$. Partitioning all $m$th roots of unity according to their exact multiplicative order gives the cyclotomic factorizationWe now prove by mathematical induction that ${\Phi }_m\in \mathbb{Z}[X]$. The base case is ${\Phi }_1=X-1$. If the result holds for every proper divisor $d$ of $m$, thenis monic and belongs to $\mathbb{Z}[X]$. Polynomial division of $X^m-1$ by the monic integer polynomial $G$ produces a quotient and remainder in $\mathbb{Z}[X]$. The factorization over $\mathbb{C}$ says that the remainder is zero and the quotient is ${\Phi }_m$, proving the claim.

It remains to prove irreducibility of cyclotomic polynomials. Let $f\in \mathbb{Z}[X]$ be a monic irreducible polynomial dividing ${\Phi }_m$, let $\epsilon$ be a root of $f$, and write ${\Phi }_m=fg$. We claim that ${\epsilon }^p$ is a root of $f$ for every prime number $p\nmid m$. Otherwise ${\epsilon }^p$ is a root of $g$, so $\epsilon$ is a root of $g(X^p)$. Since $f$ is the minimal polynomial of $\epsilon$ over $\mathbb{Q}$, Gauss lemma for polynomials givesAfter reduction of an integer polynomial modulo a prime, the Frobenius endomorphism givesChoose an irreducible factor $h$ of the nonconstant monic polynomial $\bar{f}$. Then $h\mid \bar{g}$, so $h^2\mid \bar{f}\bar{g}={\bar{\Phi }}_m$. The cyclotomic factorization would then make $h^2$ divide $X^m-1$ over ${\mathbb{F}}_p$. This is impossible because its derivative $m{X}^{m-1}$ is coprime to it when $p\nmid m$.

Thus $f({\epsilon }^p)=0$ for every prime $p\nmid m$. Iterating this fact over a prime factorization shows that $f({\epsilon }^a)=0$ whenever $(a,m)=1$. These are all $\phi (m)$ primitive $m$th roots, soBecause $f$ divides ${\Phi }_m$, equality holds and $f={\Phi }_m$. Hence every cyclotomic polynomial is irreducible over $\mathbb{Q}$.

Finally, direct multiplication givesAlsoApplying the cyclotomic factorization to the two factors on the right givesand thereforeSince $X^2-X+1={\Phi }_6(X)$, cancellation yieldsThe thirtieth cyclotomic polynomial is irreducible over $\mathbb{Q}$ by the theorem just proved, so $F$ is irreducible.

The multiplicative order of $\alpha$ modulo $N$ is the least positive integer $r$ such thatIt exists because $\alpha$ and $N$ are coprime integers.

Suppose that $r$ is even andThe minimality of $r$ also gives ${\alpha }^{r/2}\not\equiv 1(\mathrm{mod}N)$. Sincethe factor extraction from an even modular order yieldsas a nontrivial factor of $N$; equivalently one may also compute $\gcd ({\alpha }^{r/2}+1,N)$. Thus the required conditions are that $r$ be even and that ${\alpha }^{r/2}\not\equiv -1(\mathrm{mod}N)$.

Choose a power of two $M$ withSince the multiplicative order $r$ is less than $N$, this guarantees $M\ge r^2$. Prepare two quantum registers in the stateand use quantum modular exponentiation to obtain

Measure the second register. The order as the exact period of modular exponentiation implies that, conditional on the measured value, the first register is a normalized truncated periodic cosetwhere $K$ is the largest integer for which $x_0+(K-1)r<M$.

Apply the quantum Fourier transform ${\mathrm{QFT}}_M$ to the first register and measure it, obtaining $c$. The supplied Fourier-transform theorem states that, with probability of order $1/\log \log r$, $c$ is an integer nearest to $jM/r$ for some $j$ coprime to $r$. On that event,The supplied continued-fraction theorem, applied through continued-fraction recovery in quantum order finding, therefore recovers the reduced fraction $j/r$ from $c/M$. Because $j$ and $r$ are coprime, its denominator is the exact order $r$. The candidate is checked classically by verifying ${\alpha }^r\equiv 1(\mathrm{mod}N)$.

The quantum Fourier transform, quantum modular exponentiation, continued-fraction algorithm, and final modular check all take polynomial time in $\log N$. Since $r<N$, the successful event has probability of order $1/\log \log N$, as required.

Euler's criterion states that for an odd prime number $p$ and $p\nmid a$,where the right-hand side is the Legendre symbol.

Let $g$ be a primitive root modulo $p$. Its multiplicative order is $p-1$, so $g^{(p-1)/2}\ne 1$. This power has square $g^{p-1}=1$, and the only roots of $X^2-1$ modulo the odd prime $p$ are $\pm 1$. ThereforeEuler's criterion now gives $(g/p)=-1$, so every primitive root is a quadratic nonresidue.

Now let $p=2^{2^k}+1$ be a Fermat prime, with $k\ge 1$. The number of primitive roots modulo $p$ isThere are also exactly $(p-1)/2$ quadratic nonresidues. Since every primitive root is a nonresidue, these equally large sets coincide. Thus every quadratic nonresidue modulo $p$ is a primitive root, as summarized by Quadratic nonresidues modulo a Fermat prime.

Finally, $p\equiv 1(\mathrm{mod}4)$ and $p\equiv 2(\mathrm{mod}3)$. Quadratic reciprocity therefore givesHence $3$ is a quadratic nonresidue modulo $p$, and consequently

For coprime integers $a,N$ with $N>1$, the multiplicative order of $a$ modulo $N$ is

The Fermat-Euler theorem givesso the multiplicative order $r={\mathrm{ord}}_N(a)$ exists. For every integer $k$,Thus the modular exponential is periodic with period $r$. If $t>0$ were a smaller period, then $f(t)=f(0)$ would give $a^t\equiv 1(\mathrm{mod}N)$, contradicting the minimality of $r$. Hence $r$ is its least positive period.