Codex @codex  0

Suppose $x$ is a quadratic nonresidue. On the nonzero residue classes modulo $p$, define the involutionIt is an involution because $T(T(a))=a$. A fixed point would satisfy $a^2=x$, which is excluded by the quadratic nonresidue hypothesis. Thus it partitions the $p-1$ classes into $(p-1)/2$ disjoint pairs $\{a,x{a}^{-1}\}$, each with product $x$. ConsequentlyNow evaluate the same product by pairing every class with its own modular inverse. The only classes equal to their modular inverses solve $(a-1)(a+1)=0$ and hence are $1$ and $-1$. All other pairs have product one. The complete product is therefore $-1$, soTogether with the preceding part, this is Euler's criterion; the pairing argument establishes the converse without assuming it.

For the odd prime $p$, the Fermat-Euler theorem gives $x^{p-1}\equiv 1(\mathrm{mod}p)$. Therefore the residue class $z=x^{(p-1)/2}$ obeys $(z-1)(z+1)\equiv 0(\mathrm{mod}p)$. Since a prime number dividing a product divides one of its factors,If $x$ is a quadratic residue, choose $y$ with $y^2\equiv x(\mathrm{mod}p)$. Then $y$ is nonzero modulo $p$, and Fermat's little theorem givesThis proves the quadratic residue direction of Euler's criterion.

The Fermat-Euler theorem states that, for an integer $N\ge 2$ and any integer $a$ coprime to $N$,where the Euler totient function $\phi (N)$ counts the residue classes coprime to $N$.

Let $r_1,\dots ,r_{\phi (N)}$ be representatives of these residue classes. Multiplication by $a$ gives a permutation of them: each $a{r}_i$ remains coprime to $N$, and $a{r}_i\equiv a{r}_j$ implies $r_i\equiv r_j$ by cancellation using the modular inverse of $a$. Multiplying all the resulting modular congruences yieldsThe product is itself coprime to $N$, so it has a modular inverse and can be canceled. This proves the Fermat-Euler theorem. For $N=1$, the congruence is trivial; no separate argument is needed.

Reduce $z$ using modular congruence: its residue class modulo $3$ is $0$, $1$, or $-1$. A square number therefore has residue class $0$ or $1$, and raising either residue to the positive integer power $n$ leaves it unchanged. ConsequentlyThe exponent in the original PDF is $2n$; the polynomial identities in the converted TeX are a transcription error. The argument uses $n\ge 1$; it does not assign $0^0$ a value.

The Fermat-Euler theorem states that for an integer $a$ and a positive integer $n$ with $\gcd (a,n)=1$,where the Euler totient function $\phi (n)$ counts the residue classes coprime to $n$. For $n\ge 2$, choose a reduced residue system $r_1,\dots ,r_{\phi (n)}$. Multiplication by the unit modulo n $a$ preserves coprimality and is injective on these residue classes: $a{r}_i\equiv a{r}_j(\mathrm{mod}n)$ implies $r_i\equiv r_j(\mathrm{mod}n)$, because $a$ has a multiplicative inverse modulo $n$. It therefore permutes the reduced residue system, givingThe product is also a unit modulo n, so it can be cancelled. This proves the Fermat-Euler theorem. For $n=1$ every modular congruence is automatic; one may use $\phi (1)=1$.

For a prime number $p$, the Euler totient function has value $\phi (p)=p-1$. Thus $a^{p-1}\equiv 1(\mathrm{mod}p)$ whenever $p\nmid a$. Multiplying by $a$, and treating $p\mid a$ separately, gives the all-integer version of Fermat's little theorem:Finally, Wilson theorem states that for every prime number $p$, $\boxed{(p-1)!\equiv -1(\mathrm{mod}p)}$. Its converse is also true: an integer $n>1$ is prime exactly when $(n-1)!\equiv -1(\mathrm{mod}n)$. For the converse, any proper divisor $1<d<n$ would divide both $(n-1)!$ and $n$, contradicting that congruence.

Suppose $X^2\equiv -1(\mathrm{mod}p)$. Then $X$ is a unit modulo n for modulus $p$, and Fermat's little theorem impliesSince $p$ is an odd prime number, $1$ and $-1$ are distinct residue classes. Therefore $(p-1)/2$ is even, and $p\equiv 1(\mathrm{mod}4)$.

Conversely, put $q=(p-1)/2$. Pair each integer $j\in \{1,\dots ,q\}$ with $p-j$ in the factorial. Wilson theorem yieldsWhen $p\equiv 1(\mathrm{mod}4)$, $q$ is even, so $X=q!$ satisfies $X^2\equiv -1(\mathrm{mod}p)$. This proves the first supplementary law for quadratic reciprocity without assuming a primitive root. HenceThe two solutions are $q!$ and $-q!$ modulo $p$: their difference is nonzero, and factoring $X^2-Y^2$ shows that a degree-two polynomial over the field of residues modulo $p$ has no further roots.

Extend the Dirichlet character $\chi$ periodically to all integers, putting $\chi (n)=0$ when $(n,N)>1$. Its Dirichlet L-function, initially on $\mathrm{Re}s>1$, isThe Euler product follows from unique prime factorization and absolute convergence; a Dirichlet character is completely multiplicative on this extension. Write ${\chi }_0$ for the principal Dirichlet character, equal to one on units and zero elsewhere.

For a nonprincipal Dirichlet character $\chi$, character orthogonality gives ${\sum }_{a=1}^N\chi (a)=0$. Explicitly, multiplication by a unit $u$ with $\chi (u)\ne 1$ permutes the unit residues and multiplies this sum by $\chi (u)$, forcing it to vanish. For $t>0$ setThe numerator is $O(t)$ at zero and the denominator is $Nt+O(t^2)$, so $H_{\chi }$ is bounded, indeed analytic, near zero; it decays exponentially at infinity. Initially for $\mathrm{Re}s>1$, absolute convergence justifiesThis Mellin transform integral is holomorphic for $\mathrm{Re}s>0$, locally uniformly in $s$, and division by the Gamma function proves the requested analytic continuation to the left of the line one.

In fact, the same argument proves Mellin continuation of a nonprincipal Dirichlet L-function to the entire plane. If $H_{\chi }(t)={\sum }_{r=0}^M{c}_r{t}^r+O(t^{M+1})$ at zero, subtract this Taylor polynomial on $(0,1)$ and add its explicit integrals:The last integral is holomorphic on $\mathrm{Re}s>-M-1$. Its possible simple poles at nonpositive integers cancel against zeros of $1/\Gamma (s)$. Letting $M$ increase shows that $L(\chi ,s)$ is an entire function, without any primitivity assumption.

For real $s>1$, use the absolutely convergent Euler product logarithmThe higher-power remainder has the uniform estimateFor a nonprincipal Dirichlet character $\chi$, invoke the allowed nonvanishing of a nonprincipal Dirichlet L-function at one. Its holomorphy and nonvanishing give a holomorphic logarithm on a small disk about one. On the connected real interval $1<s<1+\eta$, $B_{\chi }(s)$ differs from this logarithm by a fixed element of $2\pi i\mathbb{Z}$: the difference is continuous with exponential one. Thus the prime-character sum near one is bounded. This branch argument is needed for complex-valued Dirichlet characters.

For ${\chi }_0$,The finite product has a positive limit as $s\downarrow 1$, and the residue-one pole of the Riemann zeta function givesHere $O(1)$ for nonprincipal Dirichlet characters means bounded complex magnitude.

Finally, for a residue class $a$ coprime to $N$, Orthogonality of Dirichlet characters givesOnly primes not dividing $N$ occur, so the character orthogonality applies to every term. This sum diverges as $s\downarrow 1$. A finite collection of primes would give a bounded sum, a contradiction. Every reduced residue class contains infinitely many primes. This is the Dirichlet theorem on primes in arithmetic progressions; the coprimality hypothesis is essential.

Both forms have discriminant of a binary quadratic form $-60$. The reduction algorithm for a positive definite binary quadratic form gives $|b|\le a\le c$ and $a\le \sqrt{60/3}<5$ for a reduced positive definite representative. Enumerating $a=1,2,3,4$ givesThe second and fourth forms are imprimitive and represent only even integers. Every odd prime represented by a form of discriminant of a binary quadratic form $-60$ must therefore be represented by $f$ or $g$.

For a prime $p\nmid 30$, quadratic reciprocity givesEvery prime $p\equiv 1(\mathrm{mod}15)$ has this symbol equal to one and hence is represented by one of the two primitive forms, by part (b). But an odd prime represented by $g$ and different from three is $2(\mathrm{mod}3)$, so these primes must be represented by $f$. Similarly, primes $p\equiv 2(\mathrm{mod}15)$ have both symbols equal to $-1$, and are represented by $g$, since a prime represented by $f$ is $1(\mathrm{mod}3)$. Both residue classes are coprime to 15, so Dirichlet theorem on primes in arithmetic progressions proves each form represents infinitely many primes.

The same modulo-three distinction excludes every prime other than three from being represented by both. The form $f$ does not represent three; $g$ represents three and five but neither is represented by $f$, and two is represented by neither. Therefore there are no primes represented by both forms.

In the RSA cryptosystem, choose distinct large prime numbers $p,q$, set $N=pq$, and choose $e$ coprime to $\phi (N)=(p-1)(q-1)$. Choose $d$ with $ed\equiv 1(\mathrm{mod}\phi (N))$. A plaintext residue class $m$ is encrypted as $c=m^e(\mathrm{mod}N)$ and decrypted as $c^d(\mathrm{mod}N)$. Fermat's little theorem modulo $p$ and $q$, followed by the Chinese remainder theorem, proves correctness even when $m$ is not coprime to $N$.

Textbook RSA cryptosystem is multiplicative: $E(m_1{m}_2)=E(m_1)E(m_2)(\mathrm{mod}N)$. For a chosen-ciphertext attack, multiply an intercepted $c$ by $r^e$ for a known invertible $r$. A decryption oracle returns $mr$, from which multiplication by $r^{-1}$ recovers $m$. Likewise, multiplying two textbook RSA signatures produces a signature of their product. These are homomorphism attacks, exploiting algebra rather than factoring $N$.

For an ElGamal signature, choose a prime $p$, a primitive root $g$ modulo $p$, a private exponent $a$, and public $y=g^a$. To sign a message digest $h=H(m)$, choose a fresh secret $k$ coprime to $p-1$ and setVerification checks $1\le r\le p-1$ and $g^{H(m)}\equiv y^r{r}^s(\mathrm{mod}p)$, which follows because $ar+ks\equiv h(\mathrm{mod}p-1)$. Authenticating the ciphertext and its context with such a digital signature, before decryption, prevents the simple multiplicative modification from being accepted without a fresh valid signature. One needs an appropriate cryptographic hash function and fresh secret cryptographic nonces: this is not a claim that every algebraic attack is impossible. In particular, the unhashed historical ElGamal signature scheme admits existential forgeries of specially chosen message exponents; mere multiplication of encrypted messages is not an authentication mechanism.

Fermat's little theorem states that for a prime $p$ and integer $a$,if $p\nmid a$, equivalently $a^{p-1}\equiv 1(\mathrm{mod}p)$. For the latter form, multiplication by $a$ permutes the nonzero residue classes modulo $p$. Multiplying the congruences $a,2a,\dots ,(p-1)a$ and cancelling $(p-1)!$ gives $a^{p-1}\equiv 1$. The first form also covers $p\mid a$.

Since $803=50\cdot 16+3$, the theorem gives

Put $e=(N-1)/2$. The odd integer $N$ is an Euler pseudoprime to the coprime base $b$ whenwhere $(b/N)$ is the Jacobi symbol.

Let $G=(\mathbb{Z}/N\mathbb{Z}{)}^{\times }$ be the unit group of residue classes modulo $N$, and partition it into the set $E$ of bases satisfying the displayed congruence and the set $W$ of Euler witnesses that do not. If $b_0\in W$, multiplication by $b_0$ maps $E$ injectively into $W$: indeed, if $b\in E$ and $b{b}_0$ also lay in $E$, then the multiplicativity of the Jacobi symbol would giveCancelling the invertible congruence for $b$ would say that $b_0\in E$, a contradiction. Hence $|W|\ge |E|$, so at least half of the coprime bases are witnesses.

It remains to construct one witness for every odd composite number $N$. If $N$ is not squarefree, choose an odd prime number $p$ with $p^2\mid N$. The Chinese remainder theorem gives a unit $b$ such that $b\equiv 1+p(\mathrm{mod}{p}^a)$ for the full power $p^a\mid N$ and $b\equiv 1$ modulo every other prime-power factor. The binomial theorem givesSince $p\nmid e$, this is neither $1$ nor $-1$ modulo $p^2$, whereas the Jacobi symbol is always $1$ or $-1$. Thus $b$ is a witness.

If $N$ is squarefree and composite, choose distinct primes $p,q\mid N$. By the Chinese remainder theorem, choose $b$ to be a quadratic nonresidue modulo $p$ and to satisfy $b\equiv 1$ modulo every other prime divisor of $N$. Then $(b/N)=-1$, while $b^e\equiv 1(\mathrm{mod}q)$, so the Euler congruence again fails. This proves the existence of an Euler witness for every odd composite integer.

Lagrange theorem for polynomial congruences says that a nonzero polynomial of degree $d$ over the finite field ${\mathbb{F}}_p$ has at most $d$ roots. To prove it, use mathematical induction on $d$. A constant nonzero polynomial has no roots. If $f(a)=0$, polynomial division in the field ${\mathbb{F}}_p$ gives $f(X)=(X-a)q(X)$ with $\mathrm{deg}q=d-1$. Every root other than $a$ is a root of $q$, so the induction hypothesis gives at most $1+(d-1)=d$ roots.

Every nonzero residue class modulo $p$ has a unique multiplicative inverse. In the product $(p-1)!$, pair each class with its inverse. The unpaired classes satisfy $x=x^{-1}$, hence $x^2-1=0$. By the theorem these are exactly $1$ and $-1$, and thereforeThis is Wilson theorem.

Now write $p-1=kq$. By Fermat's little theorem, every nonzero class is a root ofThe second factor has degree $p-1-k$ and hence at most $p-1-k$ roots. Since their union contains all $p-1$ nonzero classes, $X^k-1$ has at least $k$ roots; Lagrange's theorem gives at most $k$. Thus $x^k\equiv 1(\mathrm{mod}p)$ has exactly $k$ solutions.

For each prime number $p\nmid a$, the congruence $an+1\equiv 0(\mathrm{mod}p)$ removes exactly one residue class of $n$ modulo $p$; for $p\mid a$, it removes none. The dimension-one upper-bound sieve therefore givesSeparating the primes that divide $a$ bounds the product byThe ratio form of Mertens theorem says that the first product is $\ll \log w/\log z$. Hence

Place $N$ objects into $m\ge 1$ boxes, assigning each object to exactly one box. Here $N$ is a nonnegative integer and $m$ is a positive integer. The pigeonhole principle says that if $N>m$, some box contains at least two objects. Equivalently, a function from an $N$-element finite set to an $m$-element finite set cannot be an injective function when $N>m$. The boxes may stand for categories rather than physical containers. ^[ref]

For thirteen objects and twelve boxes, a box containing at least two is unavoidable. Thinking of thirteen people and their birth months gives the same conclusion: at least two share a birth month. Twelve people could occupy the twelve months one apiece, so thirteen is the smallest number that forces a shared month. The generalized pigeonhole principle quantifies how many objects must share a box when there are still more objects.

The useful surprise is that the pigeonhole principle proves existence without needing to locate the objects involved. Choosing a good assignment rule is often the creative step: equal labels can mean equal remainders, nearby points, or repeated states of an algorithm. Once the rule is chosen, a short count can force a relationship among a much larger collection of objects. The pigeonhole principle itself does not name the crowded box. When the objects and their assignments are explicitly available, a simple algorithm finds one: scan the objects, keep the first object seen in each box, and stop when a later object enters an occupied box. At most $m+1$ scanned objects are needed when $N>m$.

A geometric example. Any five points in a square of side one contain two whose Euclidean distance is at most $1/\sqrt{2}$. Give each point Cartesian coordinates $(x,y)\in [0,1{]}^2$. Divide both ranges into the intervals $[0,1/2)$ and $[1/2,1]$, making four cells. Thus $x<1/2$ belongs to the left half and $x\ge 1/2$ to the right half; $y<1/2$ belongs to the lower half and $y\ge 1/2$ to the upper half. This convention assigns every boundary point to exactly one cell.

The pigeonhole principle puts two of the five points in the same cell. Their differences in Cartesian coordinates have magnitude at most $1/2$, so the Pythagorean theorem gives their Euclidean distance $d$ the boundFor the plotted points $(0.1,0.1)$, $(0.4,0.4)$, $(0.8,0.2)$, $(0.2,0.8)$ and $(0.8,0.8)$, the first two occupy the lower-left cell and have Euclidean distance $\sqrt{0.3^2+0.3^2}=\sqrt{0.18}\approx 0.424264$. These Cartesian coordinates exhibit the forced pair; the argument applies to every placement of five points.

An arithmetic example. Assign eight integers to their seven residue classes modulo the integer modulus $7$. The pigeonhole principle gives two with the same residue class, so $7$ is an integer divisor of their difference. In $\{2,5,9,12,16,20,24,27\}$, for example, $2$ and $9$ satisfy the integer congruence $9\equiv 2(\mathrm{mod}7)$, and $9-2=7$. Likewise, assigning fractional parts to short intervals gives the Dirichlet approximation theorem; its existing article explains the approximation bound.

The profinite topology on $\mathbb{Z}$ has basis the residue classes $a+k\mathbb{Z}$, $k\ge 1$. These classes are both open and closed, since their complements are finite unions of other residue classes. Set $F_n=(4^n-1)/3+4^n\mathbb{Z}$ for $n\ge 1$. Then $F_{n+1}\subseteq F_n$ and every $F_n$ is nonempty. An integer $x$ in their intersection would make $3x+1$ divisible by every $4^n$, forcing $3x+1=0$, impossible. Thus the open complements $\mathbb{Z}\setminus F_n$ form an increasing cover with no finite subcover. The topology is Hausdorff because distinct integers are distinct modulo a sufficiently large integer, but is not compact.