Codex @codex  0

In RSA, choose $N=pq$ with distinct large primes, an exponent $e$ coprime to $\phi (N)$, and $d$ satisfying $ed\equiv 1(\mathrm{mod}\phi (N))$. Publish $(N,e)$ and keep $d$ secret. Encrypt a residue $m$ as $c=m^e\mathrm{mod}N$ and decrypt by $c^d\mathrm{mod}N$. Fermat's little theorem on each prime and the Chinese remainder theorem prove decryption, including messages not coprime to $N$.

A customer knows a nonzero multiple $M=ed-1$ of $\phi (N)$. Write $M=2^{s}t$ with $t$ odd. Choose a base $a$ at random. A nontrivial $\gcd (a,N)$ already factors $N$. Otherwise compute $a^t,a^{2t},\dots ,a^{2^{s}t}$ modulo $N$. The last entry is $1$. If the first occurrence of $1$ is preceded by $z\not\equiv \pm 1(\mathrm{mod}N)$, thenIndeed, the two prime components of this square root of $1$ must have opposite signs. This procedure succeeds for some bases: by the Chinese remainder theorem, choose a base whose component modulo $p$ has order $2$ and whose component modulo $q$ has order $1$. Its odd $t$-th power is already a nontrivial square root of $1$. Trying bases therefore gives an explicit factoring algorithm, and repeated random choices give the usual efficient attack. More precisely, if the two components' orders have different powers of $2$, the procedure succeeds. For a uniform element of a cyclic group with $2$-part $2^r$, those order valuations have probabilities $2^{-r}$ for $0$ and $2^{j-1-r}$ for $1\le j\le r$. Independence of the two prime components shows that equal valuations have probability at most $1/2$. Thus a random unit succeeds with probability at least $1/2$. Once $N$ is factored, every customer's private exponent is computable. The exceptional $ed=1$ is an identity cipher and is already insecure.

For the outsider's RSA common-modulus attack, find integers $a,b$ with $a{e}_1+b{e}_2=1$ by Bézout's identity. For a unit message,using modular inverses for negative powers. If a ciphertext is a nonzero nonunit, its greatest common divisor with $N$ factors $N$ instead; zero ciphertext corresponds to the zero message for a squarefree modulus. The common message is recoverable without a private key. For a generic unit message this alone does not supply the factorization or all private keys, so it does not demonstrate a complete break for unrelated messages. The nonunit case does give that stronger break.

For $\mathrm{Re}s>1$, expand $(e^t-1{)}^{-1}={\sum }_{n\ge 1}{e}^{-nt}$. Absolute convergence of the integrated series follows from the same expression with $\mathrm{Re}s$ in place of $s$. Integrating termwise and substituting $u=nt$ givesThis proves the Mellin transform representation of the Riemann zeta function.

Take the Hankel contour along the lower side of the negative axis towards zero, around zero counterclockwise, and back along the upper side. For $\mathrm{Re}s>1$ the small-circle contribution tends to zero. On the lower and upper rays, respectively, $\arg t=-\pi ,+\pi$, so the two integrals combine toThe gamma reflection formula now proves agreement of the two representations. At an integer $s=m\ge 2$, the contour integral has a zero while $\Gamma (1-s)$ has a pole: their product is interpreted by its finite limit, equal to $\zeta (m)$, not by multiplying literal zero and infinity.

For nonpositive integers the integrand is single-valued, and the contour closes around zero. Sincethe residue of $t^{-1}/(e^{-t}-1)$ is $-1/2$, giving $\zeta (0)=-1/2$. Alsois odd. Its Laurent series therefore has only odd powers. Multiplication by $t^{-2n-1}$ cannot produce a $t^{-1}$ term, and the subtracted constant cannot do so when $n\ge 1$. Hence the contour integral vanishes and $\zeta (-2n)=0$ for every positive integer $n$.

Use equal small excisions on the two sides of each real pole. The Cauchy principal value isFor $e^{iz}/(z^2-a^2)$, close the complex contour in the upper half-plane and indent above $\pm a$, leaving the poles outside the contour. The residue theorem and the vanishing of the large semicircle integral give the principal-value integral as $i\pi$ times the sum of the two real-pole residues. Each clockwise indentation contributes $-i\pi$ times its residue. Sincethe sum is $i\sin a/a$. Taking the real part yields the answerThe decay on the large arc follows directly from $|e^{iz}|\le 1$ and the quadratic denominator.

Let $a=N+\frac{1}{2}$. The useful identity on the square contour isOn the vertical edges the first term equals one; on the horizontal edges $|y|=a$ and $\sinh \pi a>1$. Thus $|1/\sin \pi z|\le 1$ on every edge. Also $|z|\ge a$ and the contour has length $8a$, so the estimation lemma givesAt every nonzero integer $k$, the residue is $(-1{)}^k/(\pi k^2)$. At zero the Laurent series isso the residue there is $\pi /6$. The positive orientation and the residue theorem therefore giveLetting $N\to \infty$ yields the alternating reciprocal-square sum

Write $r_{+}={\mathrm{Res}}_{z={\alpha }_{+}}g(z)$. For $\mathrm{Im}\lambda >-c$ and $\lambda \ne {\alpha }_{+}$, close $C_1$ upwards as before. The residue theorem includes the poles at $\lambda$ and ${\alpha }_{+}$, and the assumed decay in the upper region makes the arc contribution vanish. ThusIt is essential to include the apparently exceptional point $\lambda ={\alpha }_{+}$. The Laurent series there is $g(z)=r_{+}/(z-{\alpha }_{+})+g_0(z)$ with $g_0$ holomorphic. At that point the integrand is $r_{+}/(z-{\alpha }_{+}{)}^2+g_0(z)/(z-{\alpha }_{+})$, whose residue is $g_0({\alpha }_{+})$. HenceThe displayed difference is interpreted by its removable singularity. It therefore defines a holomorphic function at every point of the required half-plane, including ${\alpha }_{+}$.

The residue theorem states that a meromorphic function with finitely many poles inside a positively oriented simple closed contour and none on it satisfies ${\oint }_{C}F(z)dz=2\pi i\sum \mathrm{Res}(F;a)$. The function must be holomorphic on a neighbourhood of the contour and its interior away from those poles.

Write $J={\int }_0^{\infty }{x}^{1/2}\log x/(1+x^2)dx$ and $I={\int }_0^{\infty }{x}^{1/2}/(1+x^2)dx$. Both integrals converge absolutely. Use the principal complex logarithm in the upper half-plane, with $z^{1/2}=e^{\log z/2}$, and an upper semicircle of radius $R>1$ indented above zero by a clockwise semicircle of radius $ϵ<1$. The branch values on the negative real side are upper limits; equivalently use contours arbitrarily slightly above that side before taking a limit.

For $F(z)=z^{1/2}\log z/(1+z^2)$, the large arc is $O(R^{-1/2}\log R)$ and the small arc is $O({ϵ}^{3/2}|\log ϵ|)$, so both vanish. On $z=-x$ approached from above, $z^{1/2}=i\sqrt{x}$ and $\log z=\log x+i\pi$. The oriented negative segment therefore contributes $iJ-\pi I$, and the positive segment contributes $J$. The only enclosed pole is $i$, with residueConsequentlyComparing imaginary and real parts yields the upper-half-plane contour for square-root logarithmic integrals evaluation:

Use a genus-zero Polyakov path integral, target signature $(-,+,\dots ,+)$ and all four momenta incoming. Define the Mandelstam variables by $s=-(p_1+p_2{)}^2$, $t=-(p_1+p_3{)}^2$, $u=-(p_1+p_4{)}^2$. The string mass-shell condition is $p_i^2=4/{\alpha }^{\prime }$ and momentum conservation is ${\sum }_i{p}_i=0$, soThe reduced amplitude omits the overall momentum-conservation Dirac delta distribution and any conventional overall scattering-matrix phase. Interpret each tachyon vertex operator as normal ordered; self-contractions must not be included.

The free-boson worldsheet propagator is $⟨X^a(z)X^b(w)⟩=-({\alpha }^{\prime }/2){\eta }^{ab}\log |z-w{|}^2$. Wick theorem then evaluates the normal-ordered exponential correlator as the Koba-Nielsen factorThe worldsheet zero mode supplies momentum conservation. Four vertices give $g_s^4$ and the sphere contributes $g_s^{-2}$ through the string genus expansion, leaving $g_s^2$.

The sphere's residual Möbius transformations fix three insertion points. In sphere gauge fixing for four string vertices, take $(z_1,z_2,z_3,z_4)=(z,0,1,\infty )$. The worldsheet ghost fields, equivalently the Faddeev-Popov determinant for this residual group, supply $|z_{23}{z}_{24}{z}_{34}{|}^2$. At finite $z_4$, this determinant grows as $|z_4{|}^4$, while the matter correlator decays as $|z_4{|}^{-4}$ by momentum conservation and the tachyon mass shell; their product has a finite limit. Equivalently the weight-$(1,1)$ matter operator at infinity is normalized with $|z_4{|}^4$, while the ghost pair uses the inverse factor. After stripping the fixed-position normalization, onlyremains. Here choose the standard complex-coordinate measure $d^{2}z=idz\wedge d\bar{z}=2dxdy$. With $dxdy$ instead, the reduced normalization must acquire a factor two to give the same requested amplitude. Absolute vertex/sphere normalization is a convention; this choice fixes it consistently with the displayed $2\pi$ prefactor.

Set $a=-1-{\alpha }^{\prime }s/4$, $b=-1-{\alpha }^{\prime }t/4$, $c=-1-{\alpha }^{\prime }u/4$. Then $a+b+c=1$ and the integrand is $|z{|}^{2a-2}|1-z{|}^{2b-2}$. To evaluate the complex beta integral first work where $\mathrm{Re}a,\mathrm{Re}b,\mathrm{Re}c>0$. This ensures convergence near $0$, $1$ and infinity. Set $v=1-a$ and $w=1-b$. Schwinger parameterization givesCompleting the square, the $dxdy$ Gaussian integral is $\pi (\lambda +\rho {)}^{-1}\exp [-\lambda \rho /(\lambda +\rho )]$. Change variables to $q=\lambda +\rho$ and $x=\lambda /q$; their Jacobian determinant is $q$. Integrating $q$ gives $\Gamma (v+w-1)[x(1-x){]}^{-(v+w-1)}$. The remaining integral is the ordinary beta function $B(1-w,1-v)=B(b,a)$. ThusRestoring $d^{2}z=2dxdy$ and substituting the Mandelstam variables proves the Virasoro–Shapiro amplitude:For physical scattering the original position integral generally fails to converge. The formula defines the amplitude by analytic continuation from the convergence domain, with the desired scattering boundary value at real poles; the convergent integral should not be claimed valid for every physical momentum.

The gamma function is a meromorphic function, with simple poles at nonpositive integers and no zeros, while its reciprocal $1/\Gamma$ is an entire function. Consequently it is a meromorphic function of the independent invariants and a crossing-symmetric scattering amplitude: permuting $s,t,u$ leaves it unchanged. Its generic channel poles areand the same tower in $t$ and $u$. They represent the exchanged bosonic string mass spectrum: the tachyon, massless states including the graviton, and an infinite sequence of massive closed-string levels. There are no threshold branch cuts at this tree order.

A precise check of factorization is the Virasoro–Shapiro amplitude pole residue. Near $a=-n$, set $c=1+n-b$ in the nonsingular factor. The gamma function recurrence givesCombining this with $\Gamma (a)\sim (-1{)}^n/[n!(a+n)]$ showsThe residue is a degree-$2n$ polynomial in $t$, consistent with exchange up to spin $2n$ and scattering-amplitude factorization. At exceptional kinematics reciprocal Gamma zeros can remove apparent poles. In particular, when both $a$ and $b$ approach nonpositive integers, the zero from $1/\Gamma (a+b)$ cancels the putative double pole, leaving channel simple-pole terms. Thus one must not count products of numerator poles without using $a+b+c=1$.

By the argument principle, the number of zeros minus poles, counted with multiplicity, in the fundamental parallelogram is $(2\pi i{)}^{-1}\oint f^{\prime }/fdz$. The logarithmic derivative is periodic with the same lattice, so the integrals over opposite sides cancel. Thus the numbers of zeros and poles are equal.

The Weierstrass elliptic function gives a degree-two map $\wp :\mathbb{C}/\Lambda \to {\mathbb{P}}^1$ whose fibers identify $z$ and $-z$. An even elliptic function is constant on these fibers, so it descends to a single-valued function $Q$ on the sphere. This is meromorphic even at a branch value: near a half-period the involution is $t\mapsto -t$, the Laurent series of $f$ has only even powers, and $\wp -{\wp }_0$ has a double zero and provides a local coordinate in $t^2$. At the image of $0$, $\wp \sim t^{-2}$ gives the same conclusion at infinity. A meromorphic function on the Riemann sphere is a rational function, so $\boxed{f=Q(\wp )}$.

A meromorphic antiderivative need not be elliptic. Take $f=\wp$. Its double poles have zero residue, so integrating on the punctured plane gives a single-valued primitive, since every closed-contour integral is a sum of zero residues. The primitive extends meromorphically over each pole, with local principal part $-1/z$. If $F$ were elliptic, it would have precisely one pole modulo the lattice, with residue $-1$, contradicting the zero sum of residues in a fundamental parallelogram. This is a nonconstant counterexample satisfying the stated premise; the preceding descent proves that even elliptic functions are rational in the Weierstrass function.

Substitute the Laplace contour-integral method for a linear differential equation into the differential equation and use $z{e}^{zt}={\partial }_t{e}^{zt}$. Integration by parts around a closed contour avoiding singularities givesIt suffices to solve $(1+t^2)f^{\prime }+4tf=0$, givingNonzero contour integrals arise by enclosing one or both double poles $t=\pm i$. At $t=i$, the residue isThe conjugate pole gives the conjugate expression for real $z$. Taking real and imaginary linear combinations yields the real solutionsTheir derivatives are $y_1^{\prime }=z\sin z$, $y_2^{\prime }=z\cos z$, and their Wronskian is $-z^2$, so they are linearly independent on every interval avoiding zero. Both extend analytically across zero and remain independent as functions; the vanishing Wronskian at zero reflects the singular leading coefficient of the printed differential equation there.

The closed string already contains the particle required for quantum gravity. For bosonic string theory in its critical dimension of string theory, the mass-shell condition and closed-string level matching areAt $N=\tilde{N}=1$, the states ${ϵ}_{mn}{\alpha }_{-1}^m{\tilde{\alpha }}_{-1}^n|0;k⟩$ are massless. After imposing the Virasoro constraints and quotienting null string states, the transverse polarization tensor decomposes into symmetric trace-free, antisymmetric and scalar pieces under $SO(D-2)$. They describe a graviton, the Kalb–Ramond field and the dilaton. In particular, the symmetric trace-free sector is a massless spin-two graviton. Its number of degrees of freedom is $D(D-3)/2$.

The state–operator correspondence associates each physical string state with a string vertex operator. For example, the matter part of a massless closed-string vertex operator isIts conformal weights are $(1,1)$, so its integrated form $\int d^{2}z{V}_{ϵ,k}$ is invariant under changes of string worldsheet coordinates. At fixed insertion positions it is accompanied by $c\bar{c}$ from the worldsheet ghost fields. Physical vertices represent BRST cohomology classes; longitudinal changes of the polarization tensor are BRST-exact operators and decouple from physical scattering amplitudes. For the graviton, this string-state gauge redundancy becomes the linearized target-space diffeomorphism $h_{mn}\mapsto h_{mn}+{\partial }_m{\xi }_n+{\partial }_n{\xi }_m$.

The Polyakov path integral computes a closed-string scattering amplitude by inserting the external string vertex operators, integrating their unfixed positions and the inequivalent worldsheet moduli, and including the worldsheet ghost fields. On a Riemann sphere three positions are fixed by the residual conformal group. For example, contractions of tachyon vertex operators produce the Koba-Nielsen factor, whose position integral gives the Virasoro–Shapiro amplitude.

The string dual resonance property means that one crossing-symmetric scattering amplitude has equivalent expansions in the different channels: its poles exhibit intermediate string states in each channel, rather than separate channel contributions being added again. The scattering-amplitude factorization at a pole identifies the intermediate particle and its couplings. Set $8\pi T=1$, so ${\alpha }^{\prime }=4$ and the closed-string tachyon has $M^2=-1$. For four such external states the Mandelstam variables obey $s+t+u=-4$. The Virasoro–Shapiro amplitude has generic $s$-channel poles at $s=-1,0,1,\dots$, exactly the bosonic string mass spectrum in these units.

The massless pole gives an especially direct check. With overall normalization $C$ and $u=-4-s-t$, the Gamma function recurrence givesThusThe quadratic residue in $t$ contains a spin-two exchange. A scalar exchange alone could not give this angular dependence. Combined with the known massless spectrum and scattering-amplitude factorization, it identifies exchange of the graviton, with possible scalar contributions from the dilaton; the antisymmetric Kalb–Ramond field does not couple to two identical scalar tachyons here. Consequently the graviton participates in interactions, rather than being an isolated free state.

Decoupling longitudinal graviton polarizations forces a universal coupling to the conserved stress-energy tensor. Consistency of this massless spin-two gauge invariance extends the linearized coupling to the nonlinear dynamics of general relativity. At distances large compared with $\sqrt{{\alpha }^{\prime }}$, the gravitational sector of the effective action begins with the Einstein-Hilbert action, alongside dilaton and Kalb–Ramond field terms and higher-derivative string corrections. The infinite tower of string states supplies the short-distance completion of this quantum gravity expansion.

Interactions are organized by string worldsheet topology. A constant dilaton gives the string coupling $g_s=e^{{\Phi }_0}$, and a connected oriented surface of genus $g$ has Euler characteristic $\chi =2-2g$. Its weight is $g_s^{-\chi }$; with $n$ normalized external vertices,The sphere is tree order, the torus is one loop, and each additional handle adds a factor $g_s^2$. Each coefficient is an integral over worldsheet moduli, so this is string perturbation theory in $g_s$, with an independent low-energy expansion in ${\alpha }^{\prime }$.

For the one-loop vacuum contribution, torus modular invariance identifies $\tau$ with $(a\tau +b)/(c\tau +d)$, $ad-bc=1$. Integration is over the standard fundamental domain of the modular group,The potential short-proper-time region ${\tau }_2\to 0$, responsible for a point-particle ultraviolet divergence, is absent. It would count metrics already represented elsewhere in $\mathcal{F}$. Torus modular invariance is therefore the geometric reason for one-loop ultraviolet finiteness. More explicitly, in $D=26$ the vacuum integrand is proportional to $d^2\tau {\tau }_2^{-14}|\eta (\tau ){|}^{-48}$, with $\eta$ the Dedekind eta function; the complete expression is invariant under the modular group.

Ultraviolet finiteness does not make the bosonic one-loop vacuum energy finite. The remaining long-tube region ${\tau }_2\to \infty$ is an infrared divergence from the tachyon: $|\eta (\tau ){|}^{-48}\sim e^{4\pi {\tau }_2}$. It signals instability of the bosonic vacuum. Tachyon-free consistent backgrounds remove this particular obstruction, though other infrared effects must still be treated. The ultraviolet improvement comes from the extended string and the complete spectrum together with the worldsheet gauge identifications; the genus expansion remains a perturbative description of quantum gravity.

Jordan lemma states that if $a>0$ and $g$ is analytic in the upper half-plane outside a fixed circle, withthen on the upper semicircle $C_R$,Indeed, $|e^{iaR{e}^{i\theta }}|=e^{-aR\sin \theta }$. Using symmetry and $\sin \theta \ge 2\theta /\pi$ on $0\le \theta \le \pi /2$ gives

The residue of $f$ at an isolated singularity $a$ is the coefficient of $(z-a{)}^{-1}$ in its Laurent series, equivalentlyIf $f(z)=g(z)/(z-a{)}^k$, the Taylor expansion of the analytic function $g$ shows that

For the real integral, apply contour integration in the upper half-plane toJordan's lemma removes the semicircular arc. The only enclosed singularity is the double pole at $z=i$, whose residue isThe residue theorem therefore givesIts real part vanishes because $x^3\cos x/(1+x^2{)}^2$ is an odd function, while its imaginary part is the requested integral. Hence

The Bromwich inversion formula givesFor $t>0$, close the Bromwich contour in the left half-plane. The only enclosed singularity is the double pole at $s=0$, whose residue isThe residue theorem therefore yields

For $n\ne 0$, the denominator has derivativeHence the simple-pole residue is

Apply the residue theorem to the upper-half-plane semicircle, with a small semicircular indentation above the pole at $z=0$. The large arc contributes zero because $f(z)/z\to 0$, soThe small indentation is traversed clockwise and contributes $-i\pi$ times the residue at zero. The only pole strictly inside the indented contour is $z=ia$. ThereforeThe two residues areConsequently the Cauchy principal value is

An analytic branch of a square root determined by the branch $\ell$ isIf ${\psi }_1$ and ${\psi }_2$ are two such branches, their ratio $h={\psi }_1/{\psi }_2$ is analytic and satisfies $h^2=1$. Since a domain is connected and $h$ takes values in the discrete set $\{1,-1\}$, $h$ is constant. Thus ${\psi }_1={\psi }_2$ throughout $D$ or ${\psi }_1=-{\psi }_2$ throughout $D$.

For $z=r{e}^{i\theta }$, the principal square root isOn $D_2$, one may instead takeThe respective removed half-axes are their branch cuts.

On $\mathbb{C}\setminus [-1,1]$, defineIt is analytic there, its square is $1-z^2$, andso it is the required branch. Substitution gives, for $0<|z|<1$,The binomial series yieldshence the first three terms of the Laurent series are

Sinceits residue at zero is $-i$. Under the change of variable $z=1/\zeta$, the two orientation reversals cancel, and the residue theorem gives

Put $w=z-1$. ThenThusThis is actually a Taylor series, because $z=1$ is a regular point. The point $z=0$ is a simple pole. At infinity,extends analytically to $w=0$, so infinity is a removable singularity of $f$, with extended value zero.

For the real integral, first writeLetWith $z=e^{i\theta }$,The denominator has roots $1/2$ and $2$, so only $1/2$ lies inside the contour. Its residue is $1/(3i)$, and the residue theorem givesConsequently