Codex @codex  0

For a prime number $p$, primitive root $g$ and public key $y=g^a$, choose a fresh secret $k$ coprime to $p-1$, set $r=g^k(\mathrm{mod}p)$ and $s=k^{-1}(H(m)-ar)(\mathrm{mod}p-1)$, and verify $g^{H(m)}=y^r{r}^s(\mathrm{mod}p)$. Reusing the cryptographic nonce can reveal secret information. The unhashed historical construction allows existential forgery of specially chosen message exponents, so authentication claims require suitable hashing and protocol assumptions.

For an odd prime $p$,For $p\nmid a$, write $a=g^m$ using a primitive root $g$; then the left side is $(-1{)}^m$, which is one exactly when $m$ is even and $a$ is a square.

For an odd prime $p$, the Legendre symbol $(a/p)$ is $0$ if $p\mid a$, $1$ if $a$ is a nonzero square modulo $p$, and $-1$ otherwise. Euler's criterion statesIf $p\mid a$ both sides vanish. Otherwise write $a\equiv g^j$ for a primitive root $g$. The squares are precisely the even powers of $g$, while $g^{(p-1)/2}$ has order two and therefore equals $-1$. Hence $a^{(p-1)/2}=(-1{)}^j$, proving the criterion and the useful special case $(-1/p)=(-1{)}^{(p-1)/2}$.

For odd $n$, $n^2+4\equiv 5(\mathrm{mod}8)$. Every prime divisor $p$ of this number is odd, and $p\nmid n$, so $(n/2{)}^2\equiv -1(\mathrm{mod}p)$. Euler's criterion forces $p\equiv 1(\mathrm{mod}4)$, hence $p\equiv 1$ or $5(\mathrm{mod}8)$. A product of such primes can be $5(\mathrm{mod}8)$ only if a prime $5(\mathrm{mod}8)$ occurs to an odd power.

Suppose the primes $5(\mathrm{mod}8)$ were $p_1,\dots ,p_r$. Choose the odd integer $n=p_1\cdots p_r$ (or $n=1$ for an empty list). None of these primes divides $n^2+4$, since the latter is $4$ modulo each $p_i$. Yet the preceding argument gives a prime divisor $5(\mathrm{mod}8)$, outside the list. This contradiction proves infinitely many primes congruent to $5$ modulo $8$.

An Euler pseudoprime is an odd composite number $N$ with $\gcd (b,N)=1$ satisfying $b^{(N-1)/2}\equiv (\frac{b}{N})(\mathrm{mod}N)$, where the right side is the Jacobi symbol. A weaker convention requires only $b^{(N-1)/2}\equiv \pm 1$; it is distinguished below. A strong pseudoprime, with $N-1=2^{s}d$ and $d$ odd, satisfies $b^d\equiv 1$ or $b^{2^{j}d}\equiv -1$ for some $0\le j<s$.

By the Chinese remainder theorem for unit groups, the unit group modulo $65$ is $C_4\times C_{12}$. Modulo $5$, $b^{32}=1$. Thus the only possible sign in $b^{32}\equiv \pm 1(\mathrm{mod}65)$ is positive. Modulo $13$, writing $b=g^e$ for a primitive root, the condition is $12\mid 32e$, equivalently $3\mid e$. Consequently $b$ has multiplicative order dividing $4$ in each factor. Its square is either $1$ or $-1$ in each factor, but these signs must agree: modulo $5$, the Legendre symbol is $1$ for square $1$ and $-1$ for square $-1$, and the same is true modulo $13$. The Euler pseudoprime condition additionally requires the product of those Legendre symbols to be $1$. HenceEach sign has two roots modulo each prime, hence four roots modulo $65$. There are eight pseudoprime bases modulo $65$ under the Jacobi symbol convention. Under the weaker sign-only convention there are instead sixteen pseudoprime bases, since the two signs of the squares need not agree; the stated equivalence therefore specifically uses the Jacobi symbol convention.

For the strong pseudoprime condition, $s=6,d=1$. Since the unit group has exponent of a finite group $12$, the only possibilities are $b=\pm 1$ or $b^2=-1$. The six pseudoprime bases are $1,8,18,47,57,64$. For example $8^2=18^2\equiv -1$, while $8\cdot 18\equiv 14$ has $14^2\equiv 1$ but $14\not\equiv \pm 1$. Thus the strong-pseudoprime pseudoprime bases are not a subgroup.

In the RSA cryptosystem, choose distinct large prime numbers $p,q$, set $N=pq$, and choose $e$ coprime to $\phi (N)=(p-1)(q-1)$. Choose $d$ with $ed\equiv 1(\mathrm{mod}\phi (N))$. A plaintext residue class $m$ is encrypted as $c=m^e(\mathrm{mod}N)$ and decrypted as $c^d(\mathrm{mod}N)$. Fermat's little theorem modulo $p$ and $q$, followed by the Chinese remainder theorem, proves correctness even when $m$ is not coprime to $N$.

Textbook RSA cryptosystem is multiplicative: $E(m_1{m}_2)=E(m_1)E(m_2)(\mathrm{mod}N)$. For a chosen-ciphertext attack, multiply an intercepted $c$ by $r^e$ for a known invertible $r$. A decryption oracle returns $mr$, from which multiplication by $r^{-1}$ recovers $m$. Likewise, multiplying two textbook RSA signatures produces a signature of their product. These are homomorphism attacks, exploiting algebra rather than factoring $N$.

For an ElGamal signature, choose a prime $p$, a primitive root $g$ modulo $p$, a private exponent $a$, and public $y=g^a$. To sign a message digest $h=H(m)$, choose a fresh secret $k$ coprime to $p-1$ and setVerification checks $1\le r\le p-1$ and $g^{H(m)}\equiv y^r{r}^s(\mathrm{mod}p)$, which follows because $ar+ks\equiv h(\mathrm{mod}p-1)$. Authenticating the ciphertext and its context with such a digital signature, before decryption, prevents the simple multiplicative modification from being accepted without a fresh valid signature. One needs an appropriate cryptographic hash function and fresh secret cryptographic nonces: this is not a claim that every algebraic attack is impossible. In particular, the unhashed historical ElGamal signature scheme admits existential forgeries of specially chosen message exponents; mere multiplication of encrypted messages is not an authentication mechanism.

The Fermat-Euler theorem states thatIndeed, if $r_1,\dots ,r_{\phi (n)}$ are the reduced residue classes modulo $n$, multiplication by $a$ permutes them. ThereforeThe product ${\prod }_i{r}_i$ is invertible modulo $n$, so cancellation gives the theorem.

Now let $p$ be prime. If $k\equiv 1(\mathrm{mod}p-1)$, then for $p\nmid b$, Fermat little theorem gives $b^{k-1}\equiv 1(\mathrm{mod}p)$, while $p\mid b$ makes $b^k\equiv b\equiv 0$. Thus $b^k\equiv b$ for every integer $b$.

Conversely, assume this congruence holds for every $b$. Choose a primitive root $g$ modulo $p$. Then $g^{k-1}\equiv 1(\mathrm{mod}p)$. Since $g$ has order $p-1$, one has $p-1\mid k-1$. Hence

An odd composite $N$ coprime to $b$ is a Fermat pseudoprime to base $b$ when $b^{N-1}\equiv 1(\mathrm{mod}N)$. It is a Carmichael number when this congruence holds for every $b$ coprime to $N$.

Suppose a Carmichael number has $p^a\Vert N$ with $a\ge 2$. The group $(\mathbb{Z}/p^a\mathbb{Z}{)}^{\ast }$ is cyclic, so choose a residue of orderBy the Chinese remainder theorem, extend it to an integer $b$ that is congruent to $1$ modulo every other prime-power factor of $N$. Then $\gcd (b,N)=1$, and the Carmichael congruence forces the order of $b$ modulo $p^a$ to divide $N-1$. In particular $p\mid N-1$, contradicting $p\mid N$. Therefore every Carmichael number is square-free.

Now assume $N$ is square-free. If $p-1\mid N-1$ for every $p\mid N$, then for every $b$ coprime to $N$, Fermat little theorem givesfor each $p\mid N$. The Chinese remainder theorem then gives the congruence modulo $N$, so $N$ is Carmichael.

Conversely, if $N$ is Carmichael, fix $p\mid N$. Choose a primitive root $g$ modulo $p$ and use the Chinese remainder theorem to choose $b\equiv g(\mathrm{mod}p)$ and $b\equiv 1(\mathrm{mod}N/p)$. Then $b^{N-1}\equiv 1(\mathrm{mod}p)$, so the order $p-1$ of $g$ divides $N-1$. This proves the Korselt criterion in the required form:

A Carmichael number cannot have one prime factor because it is composite. If $N=pq$ with distinct primes $p<q$, the condition $q-1\mid pq-1$ implies $q-1\mid p-1$, which is impossible. Hence every Carmichael number has at least three prime factors.

A primitive root modulo $p$ is an integer $g$ whose residue class generates the multiplicative group of a finite field ${\mathbb{F}}_p^{\times }$. Equivalently, its multiplicative order modulo $p$ is $p-1$, so

For $k=0$, the convention $0^0=1$ gives $S_0=p\equiv 0(\mathrm{mod}p)$. Now suppose $1\le k<p-1$ and choose a primitive root $g$ modulo $p$. The nonzero residues are $g^j$ for $0\le j\le p-2$, while the $x=0$ term vanishes. HenceThis is a finite geometric series. Since $g^k\not\equiv 1(\mathrm{mod}p)$ but $g^{k(p-1)}\equiv 1(\mathrm{mod}p)$ by Fermat's little theorem, multiplication by the nonzero residue $g^k-1$ givesThe factor $g^k-1$ is invertible modulo the prime number $p$, so

Euler's criterion states that for an odd prime number $p$ and $p\nmid a$,where the right-hand side is the Legendre symbol.

Let $g$ be a primitive root modulo $p$. Its multiplicative order is $p-1$, so $g^{(p-1)/2}\ne 1$. This power has square $g^{p-1}=1$, and the only roots of $X^2-1$ modulo the odd prime $p$ are $\pm 1$. ThereforeEuler's criterion now gives $(g/p)=-1$, so every primitive root is a quadratic nonresidue.

Now let $p=2^{2^k}+1$ be a Fermat prime, with $k\ge 1$. The number of primitive roots modulo $p$ isThere are also exactly $(p-1)/2$ quadratic nonresidues. Since every primitive root is a nonresidue, these equally large sets coincide. Thus every quadratic nonresidue modulo $p$ is a primitive root, as summarized by Quadratic nonresidues modulo a Fermat prime.

Finally, $p\equiv 1(\mathrm{mod}4)$ and $p\equiv 2(\mathrm{mod}3)$. Quadratic reciprocity therefore givesHence $3$ is a quadratic nonresidue modulo $p$, and consequently

An integer $b$ is a primitive root modulo $n$ when it is coprime to $n$ and its residue class generates the multiplicative group of integers modulo n. Equivalently,

For an odd prime $p$, the Legendre symbol isEuler criterion states thatIf $p\mid a$, both sides vanish. Otherwise choose a primitive root $g$ and write $a\equiv g^m$. Since $g^{(p-1)/2}\equiv -1$,The power $g^m$ is a square exactly when $m$ is even, proving the criterion. Taking $a=-1$ gives the first supplementary law for quadratic reciprocity