Codex @codex  0

The Agrawal–Biswas primality test tests a formal polynomial identity in $(\mathbb{Z}/n\mathbb{Z})[X]$:For $n\ge 2$, the identity holds exactly when $n$ is a prime number. Testing a formal polynomial is stronger than evaluating it at residues.

The randomized algorithm first handles prime numbers at most thirteen, divisibility by them, and perfect powers. For remaining $n$, choose a monic polynomial $Q$ of polynomial degree $\ell =\lceil {\log }_{2}n\rceil$, with independent uniform lower coefficients modulo $n$. Compute the remainder of $P_n$ modulo $Q$ using exponentiation by squaring. A nonzero remainder proves compositeness. The monic polynomial permits division even when the coefficient ring has zero divisors.

Every prime number passes. After preprocessing, a composite number is rejected with probability at least $2/3$ per trial, so $r$ independent trials give error at most $3^{-r}$. Keeping remainders below polynomial degree $\ell$ makes the computation polynomial time in the bit length of $n$.^[ref]

Given a succinct Boolean game and a complete pure strategy strategy profile, determine whether it is a Nash equilibrium. The problem is co-NP-complete for goal propositional formulas, even with one player. This differs from existential equilibrium checking in a Boolean game, which searches for some qualifying Nash equilibrium.

A negative instance has a short complexity certificate: a currently unsatisfied player and new truth values for that player's controlled Boolean variables that make the goal true. Evaluating the current and changed propositional formulas takes polynomial time, proving membership in co-NP.

For hardness, given a propositional formula $F(X)$, let one player control $X$ and a fresh variable $z$, with goal $z\wedge F(X)$. The all-false candidate has payoff zero. It is a Nash equilibrium exactly when $F$ is an unsatisfiable Boolean formula, since any satisfying assignment permits an improvement by also setting $z$ true. This is a polynomial-time many-one reduction from unsatisfiability. The fresh guard ensures that the candidate loses independently of the input formula's value there.

Computational complexity theory studies the resources required to solve families of computational problems. A statement specifies an input encoding and a model of computation, then measures resources such as running time, computer memory or query complexity as the encoded input length grows. An algorithm's upper bound describes one method; a problem lower bound constrains every permitted algorithm in the stated model.

For decision problems, a complexity class collects problems with a shared resource guarantee. P uses deterministic polynomial time; NP permits polynomially bounded witnesses checked in polynomial time. The distinction separates finding an answer from verifying a supplied certificate.^[ref]

The cost model is part of the mathematics. Bit complexity charges for arithmetic on operands of growing size, while a comparison model counts comparisons of keys. A polynomial-time algorithm also need not be practical at every scale: its exponent and constants still affect actual running time. These distinctions make complexity bounds useful for comparing both mathematical possibilities and concrete implementations.

The class of decision problems whose complements belong to NP. Equivalently, negative instances admit polynomially bounded witnesses verifiable in polynomial time. A problem is co-NP-complete when it is in co-NP and every problem in co-NP has a polynomial-time reduction to it. Unsatisfiability of a propositional formula is a basic example: its complement is the NP-complete Boolean satisfiability problem.

If the eigenvalues of $A$ are $\ell /2^n$ with $0\le \ell <2^n$, exact quantum phase estimation on $U=e^{2\pi iA}$ uses $n$ controlled powers $U^{2^j}$. Their Hamiltonian simulation times reach $2\pi 2^{n-1}$. Counting each supplied controlled power as one oracle query is valid in that oracle model, but does not prove a polynomial time implementation from generic sparse-matrix access. In the ordinary HHL algorithm, one instead chooses finite precision appropriate to the output error and the condition number, or exploits additional structure giving efficient access to the needed powers.

Counting complexity studies the computational resources needed to count solutions. For a polynomial time decidable binary relation $R$ and a polynomial $p$, a standard counting function isThe complexity class $\#\mathbf{P}$ consists of these functions, equivalently the numbers of accepting computations of Nondeterministic Turing machines running in polynomial time. The witness encoding matters: counting computation paths and counting distinct outputs can give different answers.

For the propositional formula $x\vee y$, the satisfying Boolean valuations are $01$, $10$ and $11$, so the answer is three. The associated decision problem asks only whether that count is positive. For a zero-one matrix, the permanent of a matrix counts perfect matchings in a bipartite graph. Testing whether any such perfect matching exists admits a polynomial-time algorithm, while counting them is $\#\mathbf{P}$-complete under polynomial-time Turing reductions.^[ref]

A cryptographic environment is the interactive external context used to judge a cryptographic protocol in universal composability. It supplies honest parties' inputs, observes their outputs, communicates with the adversary, and ultimately outputs a decision bit. The comparison asks whether this bit's probability distribution changes detectably between the real execution and an ideal execution with a cryptographic simulator.^[ref]

The cryptographic environment models other software using the service, including choices depending on earlier outputs. It can retain private information with which to check later responses. Its view therefore includes the relationship between inputs, outputs and adversarial messages, not just isolated packet statistics.

An original two-bit example shows why that relationship matters. Let $B$ be a random variable with the uniform distribution on a finite set $\{0,1\}$. One system returns $(B,B)$; another returns $(B,C)$ with $C$ an independent uniform bit. Each individual coordinate has the same marginal distribution in both systems. Nevertheless, the test “accept exactly when the two bits agree” has acceptance probabilitiesIts cryptographic distinguishing advantage is $1/2$. Matching each output's marginal does not match their joint probability distribution. An interactive cryptographic environment can perform corresponding consistency checks against its retained inputs.

In the computational definition, the cryptographic environment has the specified polynomial time bound indexed by the cryptographic security parameter. For each real adversary, one cryptographic simulator must handle every allowed cryptographic environment; choosing a new simulator after learning which particular context will test it changes the requirement.^[ref]

This breadth explains the usefulness of universal composability: a service can be analysed within a larger application context. The conclusion still concerns the interactions and cryptographic leakage admitted by the stated execution model.

A cryptographic security parameter is an integer $\lambda$ indexing a family of cryptographic protocols or algorithms. It controls the scale at which efficiency and security guarantees are stated. Theoretical algorithms are often given $1^{\lambda }$, a string of $\lambda$ ones, so polynomial time in that input length means polynomial time in $\lambda$.^[ref]

A typical asymptotic guarantee requires a cryptographically negligible probability: for every fixed $c>0$, the relevant probability eventually falls below ${\lambda }^{-c}$. An exponential such as $2^{-\lambda }$ has that property; $1/\lambda$ does not, because it fails the requirement for $c=2$.

An original idealized guessing example separates a parameter from a concrete security claim. If a secret is uniform among $2^{128}$ possible values and no other information about it is supplied, one fixed guess succeeds with probability $2^{-128}$. Checking $q$ distinct guesses covers at most a fractionof those possibilities. This is a counting argument under the stated uniform-secret model, not a guarantee for every scheme described as having a128-bit key.

The parameter's numerical value, key length, algorithmic cost and actual adversary advantage are related through the particular construction. Naming the parameter alone does not establish a concrete work estimate or compensate for a flaw in the protocol.

A cryptographic simulator is an algorithm in a security proof that reproduces an adversary's externally observable behavior using the interfaces and cryptographic leakage allowed by an ideal cryptographic functionality. In universal composability, substituting it for the real adversary should leave every allowed cryptographic environment unable to distinguish real and ideal executions efficiently.^[ref]

The central question is what information the simulator receives. An original elementary example uses a one-time pad. For a fixed $n$-bit message $m$, let its fresh secret key $K$ be uniform on $\{0,1{\}}^n$. Its ciphertext is $C=m\oplus K$, where $\oplus$ is bitwise exclusive or. For every $n$-bit value $c$,A simulator told only $n$ can therefore reproduce this one ciphertext's distribution by generating $n$ independent uniform bits, without knowing $m$. With $n=5$, each of the 32 possible ciphertexts has probability $1/32$ in both constructions. This is a direct distribution calculation, not a complete universal composability proof for a messaging system: other visible inputs, outputs and correlations would also need to match.

Now modify the toy system so its visible packet includes a secret input bit $b$ in the clear. Suppose the cryptographic environment selected $b$ uniformly and the ideal service reveals neither $b$ nor any correlated information before the simulator must report its guessed packet bit $g$. In the real system the environment's test $g=b$ succeeds with probability one. Any simulator whose information is independent of $b$ succeeds with probability $1/2$, even without a computation bound. The cryptographic distinguishing advantage is therefore $1/2$.

Allowing the ideal service to reveal $b$ would remove that particular simulation obstacle, but would specify a different disclosure policy. A valid simulator must use the actual permitted cryptographic leakage, rather than assume access to an honest party's private data.

More generally, reproducing a cryptographic transcript requires its correlations with the cryptographic environment's state to be correct. Sampling plausible-looking individual messages is insufficient. Efficiency also matters: an unbounded reconstruction algorithm does not supply a polynomial time simulator when the security definition requires one.

Solve the maximum-weight assignment problem forbidding fixed points, obtaining a cycle cover of a directed graph whose weight bounds every Hamiltonian cycle above. Remove a lightest edge from each graph cycle. Each graph cycle has at least two edges, so at least half its nonnegative weight survives. Connect the resulting disjoint graph paths cyclically; completeness supplies the connectors and their nonnegative weights cannot reduce the retained sum. The Hungarian algorithm and linear-time patching give a polynomial time approximation algorithm. Negative weights invalidate a universal multiplicative half guarantee: when every weight is $-1$, every tour has weight $-n<(-n)/2$.

Dynamic programming solves a mathematical optimization problem by choosing reusable subproblems, recording their value functions, and combining already solved cases through a recurrence relation. Its attraction is that many possible decision histories can share one continuation calculation. A dynamic programming state must retain everything needed to determine the allowed future choices and their rewards. The 0-1 knapsack problem, for example, needs both the available capacity and which items remain available; capacity alone would lose the restriction that each item can be used at most once.

Two ideas explain when this works. Optimal substructure makes an optimal continuation valid inside a larger optimal solution. When subproblems overlap, storing each answer avoids repeated work: memoization computes entries as needed, while a table fills them in dependency order. Start from known base cases. For a problem indexed by increasing size, compute smaller cases first; for a finite sequence of future decisions, work backwards from the terminal reward, as in the Bellman equation. See Bertsekas, MIT lecture 2: optimality and state augmentation.

Consider a 0-1 knapsack problem with item weights $(w_1,w_2,w_3)=(2,3,4)$, item values $(v_1,v_2,v_3)=(3,4,5)$, and capacity $5$. Define the value function $V_i(W)$ to be the largest total item value obtainable from the first $i$ items with total weight at most $W$. Here $i\in \{0,1,2,3\}$ and $W\in \{0,1,2,3,4,5\}$ specify the dynamic programming state. All weights and capacities are nonnegative integers. The empty selection supplies the base case $V_0(W)=0$. The recurrence relation isThe two candidates skip or take item $i$. Both use the previous row, so taking item $i$ cannot take that same item again. The condition $W\ge w_i$ prevents a negative remaining capacity; no entry with $W<0$ is needed. The optimal substructure is concrete: after taking item $i$, its companions must solve the smaller 0-1 knapsack problem on the first $i-1$ items with capacity $W-w_i$. Otherwise replacing them by a better feasible selection would improve the whole selection. Compare ^[ref]; those notes index the remaining items in the opposite direction.

The full computation is small enough to see at once:For example, $V_2(5)=\max \{3,4+3\}=7$ and $V_3(5)=\max \{7,5+0\}=7$. Choosing the feasible item with largest individual value takes weight $4$, earns $5$, and leaves capacity $1$, which cannot fit another item. This greedy algorithm misses the two-item selection of weights $2$ and $3$, whose value is $7$. This example tests the largest-individual-value rule; choosing by value divided by weight happens to find the optimum here.

The number $V_3(5)=7$ is the optimal value, while the choices attaining it form a control policy. To reconstruct one optimal selection, start at $(3,5)$. Equality with $V_2(5)$ allows skipping item $3$. At $(2,5)$, taking item $2$ gives $4+V_1(2)=7$, so continue to $(1,2)$. Take item $1$ and finish at $(0,0)$. In a tie, either maximizing choice suffices to recover one optimum. Recording choices during the calculation or comparing stored entries afterwards recovers the control policy; a final optimal value alone does not describe the selection.

For $n$ items and integer capacity $W\ge 1$, the table uses time complexity $O(nW)$ and space complexity $O(nW)$, counting arithmetic operations and stored numbers using Big O notation. This is pseudo-polynomial time: when weights and capacity use the binary numeral system, the capacity needs only $O(\log (W+1))$ digits. A capacity near $2^b$ creates about $2^b$ columns despite needing only about $b$ digits. Thus this algorithm is practical for moderate capacities but does not establish polynomial time in the encoded input length. See MIT 6.006 recitation 19: knapsack and input size. For the optimal value alone, one array reduces space complexity to $O(W)$: for each item, update capacities in descending order, from $W$ down to $w_i$. Ascending order would read entries already updated for that item and could reuse it. Reconstruction then requires extra information or recomputation.

The link between the knapsack problem and dynamic programming is already explicit in a 1957 paper by Richard Bellman at RAND: its abstract discusses an exact knapsack problem solution using functional equations and cites his 1957 book. See Bellman, Comment on Dantzig's Paper on Discrete Variable Extremum Problems (1957).

The ellipsoid method repeatedly asks a separation oracle about the center of a containing ellipsoid and replaces that ellipsoid by a smaller one containing its intersection with a separating half-space. The volume decreases by a dimension-dependent factor at each iteration. For rational polyhedra, the exact feasibility theorem has polynomial bit complexity in the dimension and coefficient encoding bounds when separation is polynomial time. It includes lower-dimensional feasible sets through rational precision bounds or suitable relaxations; one must not declare infeasibility just because the original feasible set has zero volume.

Given two weighted formula utility representations with binary rational numbers as weights, decide whether their values agree on every Boolean valuation. This problem is co-NP-complete.

For membership, a valuation witnessing unequal values certifies non-equivalence. Evaluate all propositional formulas and add their weights exactly in polynomial time. For hardness, compare the one-rule base $\{(\theta ,1)\}$ with the empty base. They are equivalent exactly when $\theta$ is an unsatisfiable Boolean formula. Thus even very small weighted rule bases express a universal equivalence question.

Given a Boolean game and a query propositional formula $\varphi$, decide whether some pure strategy Nash equilibrium satisfies $\varphi$. The problem is complete for the existential second level of the polynomial hierarchy.

For membership, existentially choose a Boolean valuation and universally check every player's every unilateral deviation. The goal must remain false under all such deviations for each player whose goal is currently false. Each individual check takes polynomial time.

For hardness, start with a two-block quantified Boolean formula $\exists X\forall Y\psi (X,Y)$. Give player 1 control of $X$ and the constant true goal. Give player 2 control of $Y$ and goal $\neg \psi$, and use $\psi$ as the query. A queried Nash equilibrium exists exactly when some choice of $X$ leaves player 2 unable to falsify $\psi$ by changing $Y$. This is precisely the input quantified statement, and the construction is a polynomial-time reduction.

An existential second-order logic sentence has the formwhere each $R_i$ is a second-order relation variable of fixed finite arity $k_i$ and $\phi$ is a first-order sentence over the input first-order signature expanded by the $R_i$. The first-order sentence may contain both universal quantification and existential quantification over individuals; only the outer quantification over second-order relation variables is required to be existential. Under full semantics for second-order logic, truth means that some expansion by witness relations satisfies $\phi$.

For a fixed existential second-order logic sentence on a domain of cardinality $n$, the witnesses need ${\sum }_{i=1}^m{n}^{k_i}$ membership bits. The arities and the number of witnesses are constants because the sentence is fixed. After guessing those bits, a verifier evaluates the fixed first-order sentence by enumerating assignments to its finitely many individual variables, taking polynomial time. In the second-order encoding of three-colorability, the three witnesses require $3n$ bits, and the edge constraints can be checked over at most $n^2$ ordered vertex pairs. This is the logical form of the NP principle that a positive answer has a short complexity certificate.

The fixed-sentence qualification matters: it is the input first-order structure that varies, rather than an arbitrarily large formula supplied with each input. Fagin's theorem states the converse as well: every isomorphism-invariant NP property of finite relational first-order structures has such a description. The coloring example uses only unary second-order relation variables; the general theorem allows any fixed finite arities.

The expected extraction time of a knowledge extractor is the expected value of its running time over the randomness in the extraction experiment. The definition specifies the extractor's access to a prover and the cryptographic witness it must return. A common proof of knowledge formulation bounds that expectation, on valid inputs and for acceptance probability $p(x)$ above knowledge error $\kappa (x)$, bywhere $C$ is a fixed polynomial. The access and output conditions are essential parts of the definition.^[ref]

An original asymptotic comparison makes the denominator meaningful. Write $n=|x|$ and suppose $C(n)=n^3$. A gap $p-\kappa =n^{-2}$ gives an expected bound $n^5$. A gap $p-\kappa =2^{-n}$ instead gives $n^3{2}^n$. The displayed extraction theorem therefore does not promise polynomial time uniformly for arbitrarily tiny positive gaps.

An expected bound also permits rare long executions. As a separate toy running-time distribution, let $T=1$ with probability $1-2^{-n}$ and $T=2^n$ with probability $2^{-n}$. Thenalthough the worst-case execution is exponential. This distribution illustrates the distinction; it is not itself an extraction construction. Markov's inequality turns an expected bound into the tail estimate $\mathrm{Pr}(T\ge a\mathbb{E}[T])\le 1/a$ for $a>0$. Converting an extractor into a procedure with a fixed deadline must account for the resulting probability of stopping before it finds a witness.

Fix a finite relational first-order signature $\tau$, and let $\mathcal{K}$ be a class of finite nonempty $\tau$-first-order structures closed under isomorphism. Fagin's theorem states that $\mathcal{K}$ is definable by one existential second-order logic sentence under full semantics for second-order logic if and only if its language of standard finite encodings belongs to NP. A standard encoding numbers the domain $\{0,\dots ,n-1\}$ and lists membership bits for each input relation, together with $n$; take an explicit encoding whose length is at least $n$. The encoding language contains all numbered copies of members of $\mathcal{K}$, with malformed encodings rejected. The isomorphism condition makes membership a property of the structure rather than an arbitrary choice of labels. Changing between the usual explicit encodings preserves the NP characterization by polynomial time translations.

The forward direction is the witness-and-verifier calculation in existential second-order logic. For the reverse direction, the guiding idea is to encode an accepting nondeterministic computation using second-order relation variables: fixed-length tuples of domain elements index enough time steps and storage positions for a polynomial time computation. A first-order sentence checks the initial input, legal transitions, and acceptance. The number of tuples grows with the input, although the checking sentence stays fixed. No total order must be supplied as part of the input first-order signature: an auxiliary total order can itself be existentially guessed and constrained by a first-order sentence. Isomorphism invariance ensures that a change of this auxiliary numbering does not change membership in $\mathcal{K}$.

The second-order encoding of three-colorability is a small instance of the forward direction. The beauty of Fagin's theorem is the complete correspondence: the computational class NP can be characterized by the shape of a logical description, without mentioning a particular machine in the statement. The scope is finite relational first-order structures and fixed sentences; it is not a claim about deciding arbitrary second-order logic sentences or about arbitrary infinite domains.

Ronald Fagin published the result in Generalized First-Order Spectra and Polynomial-Time Recognizable Sets, SIAM-AMS Proceedings 7 (1974), pp. 43–73, Section 4. The original paper frames the correspondence using classes of finite expansions and their encodings. Fagin's author-maintained publication list explains that the abstract in the available copy was added in 2019; its modern summary should therefore not be mistaken for part of the 1974 printing.

An interactive proof system is a protocol in which a prover in an interactive proof exchanges messages with a verifier in an interactive proof to establish a public statement. The verifier is a randomized algorithm running in polynomial time; the prover need not have that resource bound. Completeness of an interactive proof and soundness of an interactive proof specify acceptance behavior on true and false statements.^[ref]

For a decision problem represented by a set $L$, write the acceptance bounds asThe first condition supplies an honest proving strategy; the second constrains every cheating strategy, including adaptive answers. The bounds need a useful separation between $c$ and $s$.

Graph non-isomorphism gives a concrete protocol. Given two graphs $G_0,G_1$ on the same number of vertices, the verifier secretly chooses a uniform bit $b$, randomly relabels $G_b$ using a permutation, and sends the result $H$. The prover guesses which input graph was chosen; the verifier accepts exactly when the guess equals $b$.^[ref]

If the graphs are non-isomorphic, an unrestricted prover can identify the correct isomorphism class and always answer correctly. If they are isomorphic, the two ways of generating $H$ have identical probability distributions, so $H$ gives no information about $b$ and any guess succeeds with probability $1/2$. The verifier's secret random choice creates the test. This soundness argument alone makes no claim that the protocol is a zero-knowledge proof.

Start with required facts $R=G$. If $R\subseteq I$, the empty prefix suffices. Otherwise choose an action adding a member of $R$ and deleting none of $R$, record it as a final action, and remove its add effects from $R$. Repeat and reverse the recorded actions when the residual requirements hold initially. Reject if no permitted action exists.

Soundness follows because each recorded last action supplies its removed requirements without deleting the remaining ones. If a plan satisfies a residual $R$ not contained in $I$, its last action affecting $R$ cannot delete an $R$-fact and must add one; therefore a candidate exists. Any selected candidate leaves a smaller required set, which is no harder to achieve than $R$. This proves completeness by mathematical induction. Every selection removes a required fact, so there are at most $|G|$ selections and a scan of all effect lists at each step gives polynomial time.

In the geometry of numbers, a lattice algorithm works with a Euclidean lattice, usually specified by linearly independent vectors $b_1,\dots ,b_m$ whose integer linear combinations formThe basis of a Euclidean lattice is not unique. For example, $(1,0)$ and $(100,1)$ generate the same Euclidean lattice as $(1,0)$ and $(0,1)$: replace the second vector by itself minus 100 times the first. This integer linear combination is reversible, so it changes the representation without changing the set of Euclidean lattice points.

Lattice reduction seeks a more useful basis of a Euclidean lattice, with shorter and less nearly dependent vectors. The Lenstra-Lenstra-Lovász lattice basis reduction algorithm combines integer basis changes with Gram-Schmidt orthogonalization and comparisons controlling the quality of the result. It is a polynomial-time example, but it does not generally return an exactly shortest vector.^[ref] Better bases make geometric searches and lattice-based cryptography analysis more practical. The geometry and the sizes of the integer coordinates both matter: a small number of arithmetic steps need not imply a small bit complexity.