Diophantine Equations

Winter Semester 2018/2019

University of Bayreuth

Michael Stoll

Contents

1. Introduction and Examples 3

2. Appetizers 8

3. The Law of Quadratic Reciprocity 12

Screen version of October 25, 2018, 11:59.

2

This course is a so-called “Vertiefungsvorlesung” within the area Algebra/NumberTheory/Discrete Mathematics. It can be taken during the bachelor or the masterphase of the Mathematics study program in Bayreuth.

Some parts of these notes are printed in a smaller font. They usually contain additional commentsthat do not belong to the core material of these lectures, but that might still be interesting foryou.

In the screen version of these notes you can find some links like this one (it pointsto my homepage). Most of them point to Wikipedia entries of mathematicians.

For the purposes of this course, we will consider zero to be a natural number:

N = {0, 1, 2, 3, . . .} ;

occasionally we will use the notation

N+ = {1, 2, 3, . . .}for the set of positive natural numbers (or integers). To avoid possible confusion,we will mostly use Z≥0 and Z>0 to denote these two sets. As usual, we use Z todenote the ring of integers, Q to denote the field of rational numbers, R to denotethe field of real numbers and C to denote the field of complex numbers. We writeA ⊂ B for a non necessarily strict inclusion of sets (A = B is allowed); a strictinclusion (with A 6= B) will be written A ( B. The notation a ⊥ b means thatthe integers a and b are coprime (i.e., gcd(a, b) = 1).

§ 1. Introduction and Examples 3

1. Introduction and Examples

What are “Diophantine Equations”? Here is a definition.

1.1. Definition. A Diophantine Equation is an algebraic equation over Z (in DEFDiophantineEquation

several variables) that is to be solved in integers or rational numbers. ♦

An algebraic equation over Z is an equation of the form

F (x1, x2, . . . , xn) = 0

with F ∈ Z[x1, x2, . . . , xn] a polynomial with integral coefficients.

The important part of this definition is not the form of the equation, but the factthat we are looking for integral or rational solutions. Which of the two is the moreinteresting question depends on the specific problem.

The definition can be extended to include systems of equations. (But note thatsince x2

1 + . . .+x2m = 0 is equivalent to x1 = . . . = xm = 0 when the xj are rational

numbers, any system

F1(x1, . . . , xn) = . . . = Fm(x1, . . . , xn) = 0

is actually equivalent to the single equation

F1(x1, . . . , xn)2 + . . .+ Fm(x1, . . . , xn)2 = 0 ,

so this is not really a generalization.)

In some cases, one treats one or several of the exponents as variables (for non-negative integers). Such an equation is also called an exponential DiophantineEquation.

The name honors Diophantus of Alexandria. Not much is known about him. Itis reasonably certain that he was active between 150 BC and 350 AD; it appearsmost likely that he lived in the third century AD. There is a riddle whose solutionpurports to give his age; it is contained in a collection that was created around 500.

“Here lies Diophantus,” the wonder behold.Through art algebraic, the stone tells how old:“God gave him his boyhood one-sixth of his life,One twelfth more as youth while whiskers grew rife;And then yet one-seventh ere marriage begun;In five years there came a bouncing new son.Alas, the dear child of master and sagePassed away when attaining half father’s final age.After consoling his fate with the science of numbers,For four years, then Diophantus did slumber.”

(Solution as an exercise.) Still, some of his writings have survived. His mainachievement is the Arithmetika, of whose originally 13 books six, or perhaps ten,have been preserved. In these books, Diophantus studies the solution of equationsin rational numbers; this is the first known systematic treatment of the subject. Tothis end, he introduces as one of the first symbolic notation for an indeterminateand its powers.

The first usable translation (into Latin) and annotation of the Greek text, whichwas also available to the general public, was published by Bachet in 1621. Fermatobtained a copy of this translation, which inspired him to do some research of his

§ 1. Introduction and Examples 4

own. This is the beginning of the study of Diophantine Equations in the modernera. It is also this copy of Bachet’s book in which Fermat wrote his infamousmarginal note, claiming what is now known as “Fermat’s Last Theorem”. Fermat’sson published a version of Bachet’s translation together with the notes his fatherleft in his copy.

Here is a (fairly arbitrary) selection of examples of Diophantine Equations.

(1) aX + bY = c

with given a, b, c ∈ Z; we are looking for solutions X, Y ∈ Z (there arealways rational solutions, unless a = b = 0 and c 6= 0).

This simple linear equation is solvable if and only if the greatest commondivisor of a and b divides c. If (x0, y0) is some solution, then all solutionshave the form (x0 + tb′, y0 − ta′) with t ∈ Z, where a′ = a/ gcd(a, b) andb′ = b/ gcd(a, b).

(2) X2 + Y 2 = Z2

with X, Y, Z ∈ Z (or Q, this does not make an essential difference). Thisequation is homogeneous (i.e., each term has the same total degree, 2 inthe example). This implies that we can scale solutions: if (x, y, z) is asolution, then so is (λx, λy, λz) for any λ. Except for the trivial solutionX = Y = Z = 0, which is uninteresting, all (integral or rational) solutionsare multiples of a primitive integral solution, i.e., an integral solution suchthat gcd(X, Y, Z) = 1.

We will see soon that all primitive integral solutions can be given in a simpleparametric form. Since the equation looks like the equation a2 + b2 = c2 inthe Pythagorean Theorem, integral solutions (like (3, 4, 5)) of this equationare called Pythagorean Triples.

(3) Xn + Y n = Zn

This equation is again homogeneous, so that we can reduce to primitiveintegral solutions. This is the famous Fermat Equation: Fermat claimed ina marginal note in his copy of Bachet’s translation of Diophantus’ Arith-metika that this equation has no solution in positive integers as soon asn ≥ 3 (this excludes solutions like (1, 0, 1)). He claimed to have found a“wonderful proof”, which unfortunately the margin was too small to con-tain. Fermat actually did have a proof for the case n = 4 and possibly alsofor n = 3. Experts mostly agree that Fermat’s alleged proof for the generalcase was faulty and that Fermat realized this quickly (he never repeatedthis claim for n ≥ 5 in his letters to other mathematicians, for example).

In the centuries following Fermat’s death, the quest for a proof of “Fer-mat’s Last Theorem” led to a treasure trove of mathematical results andtheories, up to Wiles’ proof of the Modularity Theorem for Elliptic Curves.Unfortunately, there are still many amateurs, who think they have foundFermat’s original (wrong!) proof. . .

(4) X21 +X2

2 +X23 +X2

4 = m

with given m ∈ Z≥0; we look for integral solutions. This means that weask which natural numbers can be written as a sum of four squares.

Diophantus guessed, Fermat knew and Lagrange proved that this is alwayspossible. We will see a proof later.

§ 1. Introduction and Examples 5

(5) X2 − 409Y 2 = 1

We look for nontrivial (meaning Y 6= 0) integral solutions. Equations ofthis form (where instead of 409 we can put an arbitrary positive integerthat is not a square) are called Pell Equations . This name goes back toEuler and is based on a misunderstanding, since Pell did not have anythingto do with this kind of equation.

We will see later that there are always (nontrivial) solutions and that theycan all be generated from a “fundamental solution”. In our example, thesmallest positive solution is

X = 25 052 977 273 092 427 986 049 , Y = 1 238 789 998 647 218 582 160 .

(6) X2 + Y 2 = U2, X2 + Z2 = V 2, Y 2 + Z2 = W 2, X2 + Y 2 + Z2 = T 2

We look for nontrivial (X, Y, Z 6= 0) and w.l.o.g. positive rational solutions.This is an example of a system of Diophantine Equations. The systemdescribes a rectangular box whose sides (X, Y, Z), face diagonals (U, V,W )and long diagonal (T ) all have rational lengths. No solution is known, butthere is also no (known) proof that no solution exists—an open problem! Ifone of the conditions is removed (so one side, one face diagonal or the longdiagonal is allowed to have irrational length), then solutions are known.

(7) Y 2 = X3 + 7823

Here we are interested in rational solutions (integral ones do not exist). Theequation describes an Elliptic Curve; such a curve is given by an equationof the form Y 2 = X3 + aX + b. There is a very rich theory of EllipticCurves (which can easily fill several semesters of lecture courses). Amongother applications, Elliptic Curves played an important role in Wiles’ proofof Fermat’s Last Theorem.

In our concrete case one can show that all solutions are generated by onebasic solution, which is given by

X =2263582143321421502100209233517777

119816734100955612

Y =186398152584623305624837551485596770028144776655756

119816734100955613

and was found by me in 2002.

(8) X2 + Y 3 = Z7

This is an instance of the Generalized Fermat Equation. For somewhat lessobvious, but still very good reasons, one is again interested in primitive(coprime) integral solutions.

Considering more generally Xp + Y q = Zr (with p, q, r ≥ 2), it is knownthat there are infinitely many solutions (which fall into finitely many pa-rameterized families), if χ := 1/p+ 1/q + 1/r > 1, and only finitely many,if χ ≤ 1 (the case χ = 1 is classical and was dealt with by Fermat andEuler, see Section 2 for (p, q, r) = (4, 4, 2)).

Together with two colleagues, I was able to show for the equation abovethat the list of known solutions

(±1,−1, 0), (±1, 0, 1), ±(0, 1, 1), (±3,−2, 1), (±71,−17, 2),

(±2213459, 1414, 65), (±15312283, 9262, 113), (±21063928,−76271, 17)

§ 1. Introduction and Examples 6

is complete.1 When a Diophantine Equation has only finitely many solu-tions, then it is usually fairly easy to find them. The hard part is to showthat there are no others!

D. Hilbert

1862–1943

Y. Matiyasevich

1947–c©Y. Matiyasevich

H. Putnam

1926–2016c©H. Putnam

unchanged, License

M. Davis

1928–c©G. Bergman

License

J. Robinson

1919–1985c©G. Bergman

License

(9)

(Y

2

)=

(X

5

)(or 60Y (Y − 1) = X(X − 1)(X − 2)(X − 3)(X − 4))

We look for integral solutions. Equations of this type can be solved inprinciple, and nowadays there are even practical algorithms.2 The solutionsof our equation that have X > 4 are given by

(5,−1), (5, 2), (6,−3), (6, 4), (7,−6), (7, 7),

(15,−77), (15, 78), (19,−152), (19, 153) .

Also in this case, the hard part is to show that these are all solutions.

(10) X2 + 7 = 2n

We look for solutions with X ∈ Z and n ∈ Z≥0. This problem was proposedby Ramanujan and first solved completely by Nagell. This is an examplefor an equation with a variable exponent.

Its solutions are given by n ∈ {3, 4, 5, 7, 15}.

Before we look at a few classical proofs, I would like to mention a negative resultthat tells us that we should not expect too much in general.

The famous mathematician David Hilbert gave an equally famous speech at theInternational Congress of Mathematicians in Paris in 1900, in which he proposeda list of 23 problems whose solution he thought would lead to progress in mathe-matics in the 20. century. One of these problems, Hilbert’s Tenth Problem, askedfor a procedure (today one would say “algorithm”) that decides for any givenpolynomial F ∈ Z[X1, . . . , Xn], whether the equation F (X1, . . . , Xn) = 0 can besolved in integers or not. It took until the 1970s to reach a conclusion, whenYuri Matiyasevich, building on essential prior work of Putnam, Davis and JuliaRobinson, was able to prove that such an algorithm does not exist.3

Such a proof became possible only after the notion of computability was formalizedand sufficiently understood. The idea of the proof, put very concisely, is as follows.First, it is easy to see (exercise) that Hilbert’s formulation of the problem isequivalent to a formulation where solvability in integers is replaced by solvabilityin natural number (i.e., in N = Z≥0). A diophantine set D is a set of the form

D = {a ∈ N | ∃x1, . . . , xn ∈ N : F (a, x1, . . . , xn) = 0} ,where F ∈ Z[x0, x1, . . . , xn] is a suitable polynomial. A recursively enumerable setis the set of all a ∈ N such that a suitable algorithm eventually halts when givena as input. It is easy to show (exercise) that every diophantine set is recursivelyenumerable. What Matiyasevich really proved is that the converse is true as well:every recursively enumerable set is diophantine. Since it is a standard resultin mathematical logic that there exist recursively enumerable sets that are notdecidable (i.e., there is no algorithm that decides for a given a ∈ N whether a is

1B. Poonen, E.F. Schaefer, M. Stoll: Twists of X(7) and primitive solutions to x2 + y3 = z7,Duke Math. J. 137, 103–158 (2007).

2Y. Bugeaud, M. Mignotte, S. Siksek, M. Stoll, Sz. Tengely: Integral points on hyperellipticcurves, Algebra & Number Theory 2, No. 8, 859–885 (2008).

3Yuri V. Matiyasevich, Hilbert’s tenth problem, Foundations of Computing Series, MIT Press,Cambridge, MA, 1993.

§ 1. Introduction and Examples 7

an element of the set or not), it follows that there is a polynomial F as above suchthat, given a ∈ N, one cannot decide whether F (a, x1, . . . , xn) = 0 has solutionsin natural numbers (or, for a different F , in integers).

§ 2. Appetizers 8

2. Appetizers

Before entering into a systematic study of some types of Diophantine Equations,I would like to present complete solutions of two such equations. The first of theseis the equation describing pythagorean triples,

X2 + Y 2 = Z2 .

We want to find its primitive integral solutions.

As a first step, we consider the parity of the variables: which of them can takeeven, which can take odd values? It is clear that not all of them can be even,since then the solution would not be primitive. For the equation to hold mod 2,we then need two of the variables to be odd and one to be even. However, sincethe square of an odd integer is always ≡ 1 mod 4, it is not possible that both Xand Y are odd, since then the left hand side would be divisible by 2, but not by 4and so could not be a square. It follows that Z must be odd, and we can assume(after interchanging X and Y if necessary) that X is even and Y is odd.

For the next step, we need an auxiliary result.

2.1. Lemma. If a, b, c are integers with a and b coprime and satisfying ab = c2, LEMMAab = c2then there exist (coprime) untegers u and v such that either

a = u2 , b = v2 and c = uv

ora = −u2 , b = −v2 and c = uv .

Proof. We first assume that c 6= 0. Then a, b 6= 0, too, and so we can considerthe prime factorizations of a and b. Let p be a prime that divides a (say). Sincea and b are coprime, it follows that p does not divide b. This implies that theexponent of p in the factorization of a is the same as that in the factorization of c2

and is therefore even. This shows that every prime occurs with an even exponentin the prime factorization of a, so there is u ∈ Z with a = ±u2. In the same way,we see that there is v ∈ Z with b = ±v2. Since ab = c2 > 0, both signs must agree.We also see that c = ±uv. If necessary, we can change the sign of u to get c = uv.

If c = 0, then we must have (a, b) = (±1, 0) or (0,±1), and the claim also holds(with (u, v) = (1, 0) or (0, 1)). q

We now write our equation as

X2 = Z2 − Y 2 = (Z − Y )(Z + Y ) .

Both factors on the right are even (since Y and Z are both odd), hence there areU, V ∈ Z such that 2U = Z − Y and 2V = Z + Y . We can also set X = 2W withW ∈ Z (since X is even). Every common divisor of U and V is also a commondivisor of Y = V − U and Z = V + U and then also a divisor of X. Since weassume that X, Y, Z are coprime, it follows that U and V are coprime as well.

Note that we now have that W 2 = UV with U and V coprime. By Lemma 2.1there are S, T ∈ Z such that

U = S2, V = T 2, W = ST or U = −S2, V = −T 2, W = ST .

In the first case we get

X = 2ST, Y = T 2 − S2, Z = T 2 + S2 ,

§ 2. Appetizers 9

and in the second case

X = 2TS, Y = S2 − T 2, Z = −(S2 + T 2) .

We also know that S and T are coprime and of different parity (meaning that oneof them is even, the other is odd), since S2 + T 2 = ±Z is odd. We have thereforeproved the following.

2.2. Theorem. The primitive pythagorean triples (X, Y, Z) with X even and THMpythagoreantriples

Z > 0 have the form

X = 2ST, Y = S2 − T 2, Z = S2 + T 2

with S, T ∈ Z coprime and of different parity.

It is clear (and easy to check independently) that each such triple actually is aprimitive pythagorean triple.

I will now present a second, “geometric”, proof of this theorem (as opposed tothe “algebraic” proof given above). To this end, we note that in any nontrivialsolution (i.e., (X, Y, Z) 6= (0, 0, 0)), we must have Z 6= 0. This allows us to dividethe equation by Z2, resulting in

x2 + y2 = 1 , where x = X/Z and y = Y/Z.

We now want to determine the rational solutions of this equation. We obtain theprimitive integral solutions of the original equation (with Z > 0) by multiplyingwith the least common denominator Z of x and y.

The way geometry comes into play is that we canvisualize the real solutions of x2 + y2 = 1 as thepoints on the unit circle in the xy-plane. Therational solutions then correspnd to the pointswith rational coordinates, the so-called rationalpoints of the unit circle. There are four obvioussuch points, namely (x, y) = (±1, 0) and (0,±1).Let P0 = (−1, 0) be one of them. If P = (x, y) 6=P0 is another rational point, then the line throughP0 and P has rational slope t = y

x+1. We therefore

x

y

0 1

1

t

P

P0

obtain all rational points 6= P0 by taking lines with rational slope through P0 andconsidering the second intersection point with the unit circle. This second pointof intersection is indeed rational; this is because it is determined by a quadraticequation with rational coefficients, whose other solution is also rational.

The equation of the line through P0 with slope t is given by

y = t(x+ 1) .

We substitute the right hand side for y in the equation of the circle:

0 = x2 + y2 − 1 = x2 − 1 + t2(x+ 1)2 = (x+ 1)(x− 1 + t2(x+ 1)

).

We have that x 6= −1 at the second intersection point, so we can divide by (x+ 1)and obtain

x =1− t2

1 + t2, y = t(x+ 1) =

2t

1 + t2.

This “rational parametization of the unit circle” gives all rational solutions ofx2 + y2 = 1 except P0. We can think of P0 as given by the limit as t→∞. In our

§ 2. Appetizers 10

construction, we would need a line that meets the circle “twice” in P0; this is thetangent to the circle in P0. This tangent is vertical, so has slope ∞.

To go back to primitive integral solutions of X2 + Y 2 = Z2, we must write ourexpressions for x and y as fractions in lowest terms. To this end, we first writet = U/V as a fraction in lowest terms, giving

x =V 2 − U2

V 2 + U2, y =

2UV

V 2 + U2.

(In this formulation, P0 is included if we allow U = 1, V = 0.) The fractiongiving x is in lowest terms when U and V are of opposite parity. Otherwise (whenU and V are both odd) the gcd of numerator and denominator is 2, and the sameis true for the fraction giving y. In the first case, we therefore get

X = V 2 − U2 , Y = 2UV , Z = V 2 + U2

with U and V coprime and of different parity. In the second case, we writeV + U = 2R, V − U = 2S with integers R and S; then

x =2RS

R2 + S2, y =

R2 − S2

R2 + S2

are fractions in lowest terms, and we obtain the primitive pythagorean triple

X = 2RS , Y = R2 − S2 , Z = R2 + S2 .

This recovers Theorem 2.2 in a version that covers both the cases when X is evenand when Y is even.

What we did here is actually quite close to what Diophantus is doing (in a purelyalgebraic formulation), in that we reduce the degree of the equation so that itbecomes linear.

The rational parametization of the unit circle has further applications. It expressessinα and cosα rationally in terms of t = tan α

2and can be used, for example, to

transform integrals over rational expressions in sinx and cosx into integrals overrational functions in t, which can be more easily computed.

As a further appetizer, I would like to present Fermat’s proof thatP. de Fermat

1607–1665X4 + Y 4 = Z2

has no integral solutions with X, Y, Z 6= 0. Of course, this immediately impliesthat

X4 + Y 4 = Z4

has no positive integral solutions either.

We first note that we only need to consider solutions with X, Y, Z coprime in pairs.If p is a prime that divides two of the variables, then it also has to divide the third,and we obtain a smaller solution when we replace (X, Y, Z) by (X/p, Y/p, Z/p2).Note that Z must be divisible by p2, since both sides of the equation are divisibleby p4. We can continue in this way, until we obtain a solution with X, Y, Z coprimein pairs.

Fermat’s great idea was, given a primitive solution with X, Y, Z > 0, to constructanother smaller (i.e., with smaller Z) such solution. Since there are no infinitestrictly descending sequences of natural numbers, this leads to a contradiction.Fermat called this method of proof the infinite descent.

§ 2. Appetizers 11

So let (X, Y, Z) be a primitive solution with X, Y, Z > 0. Then (X2, Y 2, Z) is aprimitive pythagorean triple. We can assume that X is even; then Theorem 2.2tells us that there are coprime integers R and S of different parity such that

X2 = 2RS , Y 2 = R2 − S2 , Z = R2 + S2 .

Without loss of generality, R and S are positive. Since Y is odd, the secondequation implies that S must be even. (If R is even and S is odd, then the righthand side is ≡ 3 mod 4, but the left hand side is ≡ 1 mod 4.) We write S = 2Tand X = 2W ; this results in

W 2 = RT

with R and T coprime. According to Lemma 2.1, there are coprime integersU, V > 0 such that

R = U2 , T = V 2 ,

hence S = 2V 2 and therefore

Y 2 = U4 − 4V 4 .

We also have that U ≤ U2 = R ≤ R2 < Z.

We see that (Y, 2V 2, U2) is another primitive pythagorean triple. So there arecoprime integers P,Q > 0 such that

Y = P 2 −Q2 , 2V 2 = 2PQ , U2 = P 2 +Q2 .

We can again apply Lemma 2.1 to the second equality; this gives us coprimeintegers A,B > 0 with

P = A2 and Q = B2 .

Plugging this into the third equality, this finally gives

A4 +B4 = U2 .

This shows that (A,B, U) is another primitive solution of X4 + Y 4 = Z2 withA,B, U > 0 and U < Z. By Fermat’s principle, this proves the following.

2.3. Theorem. The only primitive integral solutions of THMY 4 + Y 4 = Z2

X4 + Y 4 = Z2

are given by X = 0, Y = ±1, Z = ±1 and X = ±1, Y = 0, Z = ±1.

Since in the course of the proof, we have seen that a nontrivial solution of Y 2 =U4 − 4V 4 leads to a nontrivial solution of X4 + Y 4 = Z2, we have also shown thefollowing.

2.4. Theorem. The only primitive integral solutions of THMY 4 − 4Y 4 =Z2X4 − 4Y 4 = Z2

are given by X = ±1, Y = 0, Z = ±1.

§ 3. The Law of Quadratic Reciprocity 12

3. The Law of Quadratic Reciprocity

We can use the Chinese Remainder Theorem and the Euclidean Algorithm tosolve linear congruences or systems of linear congruences. A natural next step isto consider quadratic congruences.

3.1. Definition. Let p be an odd prime number and a ∈ Z not a multiple of p. DEFquadratic(non)residue

Then a is a quadratic residue mod p if the congruence x2 ≡ a mod p has solutionsin Z. Otherwise a is a quadratic nonresidue mod p. ♦

3.2. Example. EXquadratic(non)residues

p qu. residues qu. nonresidues3 1 25 1, 4 2, 37 1, 2, 4 3, 5, 611 1, 3, 4, 5, 9 2, 6, 7, 8, 10 ♣

Let g be a primitive root mod p (i.e, the residue class g ∈ Fp generates themultiplicative group F×p ; such primitive roots always exist, since the group is

cyclic). Then every a ∈ Z with p - a is congruent to some gk mod p, where k ∈ Zis uniquely determined modulo p − 1. In particular, the parity of k is uniquelydetermined, since p− 1 is even. We write k = logg a ∈ Z/(p− 1)Z for the discretelogarithm of a with respect to g.

3.3. Theorem. Let p be an odd prime and a ∈ Z with p - a. Assume further THMEuler’scriterion

that g is a primitive root mod p. Then the following are equivalent.

(1) a is a quadratic residue mod p.

(2) logg a is even.

(3) a(p−1)/2 ≡ 1 mod p (Euler’s criterion).

Proof. We have that a ≡ gk mod p with k = logg a.

“(2) ⇒ (1)”: If k = 2l is even, then a ≡ x2 mod p with x = gl, implying that a isa quadratic residue mod p.

“(1) ⇒ (3)”: If a is a quadratic residue, so that a ≡ x2 mod p with some x ∈ Z,then a(p−1)/2 ≡ xp−1 ≡ 1 mod p by Fermat’s little theorem.

“(3) ⇒ (2)”: If a(p−1)/2 ≡ 1 mod p, then we have that gk(p−1)/2 ≡ 1 mod p. Sinceg is a primitive root, this means that p− 1 divides the exponent k(p− 1)/2, whichimplies that k is even. q

This already tells us that there are exactly (p−1)/2 residue classes mod p consistingof quadratic residues and (p− 1)/2 classes consisting of quadratic nonresidues.

3.4. Corollary. Keep the notations of Theorem 3.3. We have the following CORCriterion fornonresidues

equivalences.

a is a quadratic nonresidue mod p ⇐⇒ logg a is odd ⇐⇒ a(p−1)/2 ≡ −1 mod p .

Proof. We only have to show that a(p−1)/2 ≡ ±1 mod p (assuming p - a). Setb = a(p−1)/2. Then b2 = ap−1 ≡ 1 mod p, so (b − 1)(b + 1) = 0 in the field Fp. Soone of the factors must vanish, which means that b ≡ 1 or b ≡ −1 mod p. q

§ 3. The Law of Quadratic Reciprocity 13

3.5. Definition. We define the Legendre symbol for an odd prime p and a ∈ Z DEFLegendresymbol

by (a

p

)=

1 if p - a and a is a quadratic residue mod p,−1 if p - a and a is a quadratic nonresidue mod p,

0 if p | a.

It follows that

(a

p

)=

(b

p

)when a ≡ b mod p. ♦

Euler’s criterion implies that(

ap

)can be computed efficiently: The power a(p−1)/2 ∈ Fp can be

computed using O((log p)3

)bit operations(O(log p) multiplications in Fp to compute the power

by successive squaring; one multiplication can be done in O((log p)2

)bit operations or faster).

It is a completely different problem to actually exhibit a square root of a mod p (some x ∈ Zwith x2 ≡ a mod p). There are probabilistic algorithms that have polynomial running time, butso far there is no efficient deterministic algorithm.4

3.6. Corollary. The number of solutions of X2 = a in Fp is exactly 1 +

(a

p

). COR

Numberof squareroots of aProof. If a = 0, then there is exactly one solution X = 0, and

(ap

)= 0.

If a 6= 0 is a square in Fp, then there are exactly two solutions (differing only by

sign), and(ap

)= 1.

If a is a non-square in Fp, then there is no solution, and(ap

)= −1. q

3.7. Corollary. Let p be an odd prime and a ∈ Z. Then CORLegendrevia Euler

(a

p

)≡ a(p−1)/2 mod p ,

and this congruence determines the value of the Legendre symbol uniquely.

Proof. If p | a, then both sides are zero mod p. In the other two cases, thecongruence follows from Theorem 3.3 and Corollary 3.4. The uniqueness statementfollows from the fact that the Legendre symbol takes one of the values −1, 0, 1,which are all distinct mod p (since p ≥ 3). q

3.8. Theorem. Let p be an odd prime and a, b ∈ Z. Then THMLegendresymbol ismultiplicative

(ab

p

)=

(a

p

)(b

p

).

Proof. By Corollary 3.7, we have that(a

p

)(b

p

)≡ a(p−1)/2b(p−1)/2 = (ab)(p−1)/2 ≡

(ab

p

)mod p .

Equality follows again, since the possible values −1, 0, 1 that the left and righthand sides can take are distinct mod p. q

4http://en.wikipedia.org/wiki/Quadratic residue#Complexity of finding square roots

§ 3. The Law of Quadratic Reciprocity 14

We see in particular that the product of two quadratic nonresidues mod p is aquadratic residue mod p.

The statement of Theorem 3.8 can also be formulated in the following way. Themap

F×p −→ {±1} , a 7−→(a

p

)is a group homomorphism. Since there always exist quadratic nonresidues (e.g.,every primitive root mod p is a quadratic nonresidue), this homomorphism issurjective; its kernel consists precisely of the squares in F×p .

3.9. Example. We can factor(ap

)using the prime factorization of a. Assume EX

Legendresymboland primefactorization

that a = ±2eqf11 qf22 . . . qfkk with pairwise distinct odd primes qj. Then we get that(a

p

)=

(±1

p

)(2

p

)e(q1

p

)f1 (q2

p

)f2. . .

(qkp

)fk. ♣

We will now study how we can compute the various factors in this product.

The first and simplest case is a = −1.

3.10. Theorem. Let p be an odd prime. Then THMFirstsupplementto LQR

(−1

p

)= (−1)(p−1)/2 =

{1 if p ≡ 1 mod 4,

−1 if p ≡ 3 mod 4.

Proof. By Corollary 3.7, we have that(−1

p

)≡ (−1)(p−1)/2 mod p .

Equality follows, since both sides are ±1. q

This says that when p ≡ 1 mod 4, there is a square root of −1 mod p. It is evenpossible to write down such a square root explicitly. Let p = 2m+ 1. Then

(m!)2 = (−1)m · 1 · 2 · · ·m · (−m) · · · (−2) · (−1)

≡ (−1)m · 1 · 2 · · ·m · (m+ 1) · · · (p− 1)

= (−1)m(p− 1)! ≡ (−1)m+1 mod p .

In the last step, we have used Wilson’s Theorem (p − 1)! ≡ −1 mod p. This canbe proved by pairing each factor with its inverse mod p in the product giving thefactorial (p − 1)!. The only unpaired factors are 1 and −1 (which are there owninverses).

We see therefore that (m!)2 ≡ −1 mod p, when m is even and hence p ≡ 1 mod 4.There is however no efficient way of computing m! mod p, so that this formula isuseless for practical purposes.

In the other case, p ≡ 3 mod 4, we have that (m!)2 ≡ 1 mod p, and so m! ≡ ±1 mod p. Onecan ask which sign we get. It turns out that for p > 3, the sign is determined by the residueclass mod 4 of the class number h of Q(

√−p). If h ≡ 1 mod 4, then m! ≡ −1 mod p, and if

h ≡ 3 mod 4, then m! ≡ 1 mod p (in this case, h is always odd).

§ 3. The Law of Quadratic Reciprocity 15

The next step is to consider a = 2. Here is a small table.

p 1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31(2p

)− − + − − + − + − +

Extending this table, one is led to the conjecture that(

2p

)depends only on p mod

8; more precisely, it looks like(

2p

)= 1 when p ≡ 1 or 7 mod 8 and

(2p

)= −1

when p ≡ 3 or 5 mod 8.

If we want to prove such a statement, we need to express the Legendre symbol insome other way. This is achieved by the following result due to Gauß.

3.11. Lemma. Let p be an odd prime number. Let further S ⊂ Z be a subset with LEMMAGauß’Lemma onquadraticresidues

#S = (p−1)/2 and such that {0}∪S∪−S is a complete system of representativesmod p. (For example, we can take S = {1, 2, . . . , (p−1)/2}.) Then for a ∈ Z withp - a, we have that (

a

p

)= (−1)#{s∈S | as∈−S} .

Here S = {s | s ∈ S} denotes the set of residue classes mod p represented byelements of S.

Whether a is a quadratic residue or not therefore depends on how many of theresidues in S “change sides” when multiplied by a.

C.F. Gauß(1777–1855)

Proof. For each s ∈ S there are unique t(s) ∈ S and ε(s) ∈ {±1} such thatas ≡ ε(s)t(s) mod p. The map S 3 s 7→ t(s) ∈ S is then a permutation of S. It issufficient to show that it is injective. So assume that s, s′ ∈ S with t(s) = t(s′).Then as ≡ ±as′ mod p, so (since a is invertible mod p) s ≡ ±s′ mod p. By thechoice of S. this is only possible when s = s′.

Modulo p, we then have the following congruences.(a

p

)∏s∈S

s ≡ a(p−1)/2∏s∈S

s

=∏s∈S

(as)

≡∏s∈S

(ε(s)t(s))

=∏s∈S

ε(s)∏s∈S

s

= (−1)#{s∈S | ε(s)=−1}∏s∈S

s .

Since p does not divide the product∏

s∈S s, it follows that(a

p

)≡ (−1)#{s∈S | ε(s)=−1} = (−1)#{s∈S | as∈−S} mod p ,

which implies the desired equality (both sides are ±1). q

If we take a = −1 in the lemma, then we recover Theorem 3.10.

We can now prove our conjecture regarding(

2p

).

§ 3. The Law of Quadratic Reciprocity 16

3.12. Theorem. Let p be an odd prime. Then THMSecondsupplementto LQR

(2

p

)= (−1)(p2−1)/8 =

{1 if p ≡ ±1 mod 8,−1 if p ≡ ±3 mod 8.

Proof. We use Lemma 3.11 with the standard choice

S ={

1, 2, 3, . . . ,p− 1

2

}.

We have to count the elements of S that (when considered mod p) end up outsideof S after doubling. For a given s ∈ S, this is the case exactly when 2s > (p−1)/2,so for (p − 1)/4 < s ≤ (p − 1)/2. (Note that 2s < p, so there is no possibility of“wrapping around”.) The number of these elements is given by

n(p) =p− 1

2−⌊p− 1

4

⌋.

We determine n(p) for the various residue classes of p mod 8 in the following table.

p n(p)(

2p

)8k + 1 2k +18k + 3 2k + 1 −18k + 5 2k + 1 −18k + 7 2k + 2 +1 q

What about(qp

)when q is a fixed odd prime and we let p vary?

As before for a = 2, we can make tables for a = 3 and a = 5 (say). This leads usto conjecture that(

3

p

)=

{1 if p ≡ ±1 mod 12,−1 if p ≡ ±5 mod 12;

}=

{ (p3

)if p ≡ 1 mod 4,

−(p3

)if p ≡ −1 mod 4;(

5

p

)=

{1 if p ≡ ±1 mod 5,−1 if p ≡ ±2 mod 5.

}=(p

5

).

For larger primes q we observe similar patterns: for q ≡ 1 mod 4, it looks likethe result depends only on p mod q, and for q ≡ 4 mod 4, it looks like the resultdepends only on p mod 4q. Both cases can be combined into the following result,whose first complete proof was found by Gauss in 1796. (Gauss found quite a fewmore proofs in the course of his life.)

3.13. Theorem. Let p and q be distinct odd primes. Then THMLaw ofQuadraticReciprocity

(q

p

)=

(p∗

q

)= (−1)

p−12

q−12

(p

q

)

=

(p

q

)if p ≡ 1 mod 4 or q ≡ 1 mod 4,

−(p

q

)if p ≡ −1 mod 4 and q ≡ −1 mod 4.

Here we use the notation p∗ = (−1)(p−1)/2p, so p∗ = p for p ≡ 1 mod 4 andp∗ = −p for p ≡ −1 mod 4.

§ 3. The Law of Quadratic Reciprocity 17

1 p - 12

1

q - 12

p + 14

q + 14

X

Figure 1. Sketch for the proof of Theorem 3.13. Here p = 47,q = 29 with m = 11, n = 7.

Proof. This proof is again based on Gauss’ Lemma 3.11. Since there are now twoLegendre symbols to deal with, we need to fix two sets

S =

{1, 2, . . . ,

p− 1

2

}and T =

{1, 2, . . . ,

q − 1

2

}.

Set m = #{s ∈ S | qs ∈ −S} (mod p) and n = #{t ∈ T | pt ∈ −T} (mod q).Then (

q

p

)(p

q

)= (−1)m(−1)n = (−1)m+n .

The task is therefore to determine the parity of m+ n.

If qs ≡ −s′ mod p for some s′ ∈ S (so that s contributes to m), then there is auniquely determined t ∈ Z such that pt− qs = s′ ∈ S, so 0 < pt− qs ≤ (p− 1)/2.This number t must be in T , since

pt > qs > 0 and pt ≤ p− 1

2+ qs ≤ (q + 1)

p− 1

2< p

q + 1

2,

which implies that t < (q + 1)/2. Since q is odd, this means t ≤ (q − 1)/2. Thisgives

m = #{

(s, t) ∈ S × T∣∣∣ 0 < pt− qs ≤ p− 1

2

}.

In the same way, we obtain that

n = #{

(s, t) ∈ S × T∣∣∣ −q − 1

2≤ pt− qs < 0

}.

Since pt − qs is never zero when s ∈ S and t ∈ T , this shows that m + n = #Xwith

X ={

(s, t) ∈ S × T∣∣∣ −q − 1

2≤ pt− qs ≤ p− 1

2

}.

We claim that this set X lies symmetrically with respect to the midpoint orthe rectangle [1, p−1

2] × [1, q−1

2]. Reflection in the point (p+1

4, q+1

4) moves (s, t)

§ 3. The Law of Quadratic Reciprocity 18

to (s′, t′) = (p+12− s, q+1

2− t), and

pt′ − qs′ = p(q + 1

2− t)− q(p+ 1

2− s)

=p− q

2− (pt− qs) .

This implies that

pt− qs ≤ p− 1

2⇐⇒ pt′ − qs′ ≥ −q − 1

2and

pt− qs ≥ −q − 1

2⇐⇒ pt′ − qs′ ≤ p− 1

2,

i.e., (s′, t′) ∈ X ⇐⇒ (s, t) ∈ X. Since the only fixed point of the reflection is themidpoint (p+1

4, q+1

4) and this point is in X if and only if it has integral coordinates,

we see that

#X is odd ⇐⇒ p+ 1

4,q + 1

4∈ Z ⇐⇒ p ≡ −1 mod 4 and q ≡ −1 mod 4.

This proves the theorem. q

3.14. Example. We can use the Law of Quadratic Reciprocity to compute Le- EXLegendresymbolvia LQR

gendre symbols in the following way.(67

109

)=

(109

67

)=

(42

67

)=

(2 · 3 · 7

67

)=

(2

67

)(3

67

)(7

67

)= (−1)(−

(67

3

))(−

(67

7

)) = −

(1

3

)(4

7

)= −1 ♣

The disadvantage of this method is that we need to factor the numbers occurringon the way. This can be very involved when these numbers are large. (There isno known efficient factorization algorithm.)

We can avoid this problem by extending the definition of the Legendre symbol insuch a way that we allow arbitrary odd integers in the “denominator” instead ofjust odd prime numbers.

3.15. Definition. Let a, n ∈ Z with n odd, where n has prime factorization DEFJacobisymbol

n = ±pe11 pe22 . . . pekk . We define the Jacobi symbol by(a

n

)=

k∏j=1

(a

pj

)ej. ♦

Of course, the Jacobi symbol agrees with the Legendre symbol whenever n = p isan odd prime, so it makes sense to write them in the same way.

The Jacobi symbol has the following properties that generalize the correspondingproperties of the Legendre symbol.

C.G.J. Jacobi(1804–1851)(1)

(an

)= 0 if and only if gcd(a, n) 6= 1.

(2) If a ≡ b mod n, then(an

)=

(b

n

).

(3)

(ab

n

)=(an

)( bn

).

(3’)( a

mn

)=( am

)(an

). (This is implied by the definition.)

§ 3. The Law of Quadratic Reciprocity 19

(4)(an

)= 1 if a ⊥ n and a is a square mod n.

Warning. The converse of the last implication is false in general when n is not

!a prime. For example, we have that(2

15

)=

(2

3

)(2

5

)= (−1) · (−1) = 1 ,

but 2 is not a square mod 15 (since 2 is a quadratic nonresidue mod 3 and alsomod 5).

However, the most important property of the Jacobi symbol is that the Law ofQuadratic Reciprocity and its supplements remain valid in this more general set-ting.

3.16. Theorem. Let m,n ∈ Z be positive and odd. Then THMLQR for theJacobisymbol

(1)

(−1

n

)= (−1)

n−12 .

(2)

(2

n

)= (−1)

n2−18 .

(3)(mn

)= (−1)

m−12

n−12

( nm

).

Proof. We first show that n 7→ (−1)(n−1)/2 and n 7→ (−1)(n2−1)/8 are multiplicativeas maps from 1 + 2Z to {±1}. Since the value depends only on n mod 4 (resp.,n mod 8), this is a finite verification. In a similar way one checks that (m,n) 7→(−1)(m−1)(n−1)/4 is multiplicative in both arguments. Alternatively, we can proceedas follows.

nn′ − 1

2− n− 1

2− n′ − 1

2=

(n− 1)(n′ − 1)

2∈ 2Z ,

since n and n′ are both odd. Similarly,

(nn′)2 − 1

8− n2 − 1

8− (n′)2 − 1

8=

(n2 − 1)((n′)2 − 1)

8∈ 2Z .

This implies that

(−1)nn′−1

2 = (−1)n−12 · (−1)

n′−12 and

(−1)(nn′)2−1

8 = (−1)n2−1

8 · (−1)(n′)2−1

8 .

There is an argument along the same lines that shows the multiplicativity of(−1)(m−1)(n−1)/4 in m and n.

This now implies that in all three statements above, both sides are multiplicativein m and in n. This allows us to reduce the claims to the case of prime numbers(m and) n, which gives us exactly the known theorems 3.10, 3.12 and 3.13. q

§ 3. The Law of Quadratic Reciprocity 20

3.17. Example. We compute(

67109

)again. EX

Using theJacobisymbol

(67

109

)=

(109

67

)=

(42

67

)=

(2

67

)(21

67

)= (−1)

(67

21

)= −

(4

21

)= −1

This shows that one can compute Legendre (or Jacobi) symbols essentially inthe same way as one computes a gcd using the Euclidean Algorithm. The onlydifference is that one has to pull out factors of 2 and treat them separately. ♣

Euler’s Criterion 3.7 does not generalize to apply to the Jacobi symbol. Euler’s

!generalization of Fermat’s little theorem says that aϕ(n) ≡ 1 mod n for all n ∈ Z≥1

and all a ∈ Z with a ⊥ n, where ϕ(n) = #{a ∈ Z : 0 ≤ a < n, a ⊥ n} denotesthe Euler totient function. So one could hope that aϕ(n)/2 ≡

(an

)mod n for odd n.

But we have for example that

aϕ(15)/2 ≡ 1 mod 15

for all a such that a ⊥ 15, even though the Jacobi symbol(a15

)also takes the

value −1 (e.g., for a = 7).

The expectation that a(n−1)/2 ≡(an

)mod n is “even more wrong”. However, this can be turned

around to give a test that can show that n is not a prime number: we pick an a ∈ {2, 3, . . . , n−2}at random and check the congruence above (we can compute both sides mod n efficiently). If itdoes not hold, then n cannot be a prime number. This is the so-called Solovay-Strassen PrimalityTest.

The Jacobi symbol allows us to prove the following result (that can also be for-mulated for the Legendre symbol by restricting n to be a prime number) in anelegant way.

3.18. Theorem. Let a ∈ Z\{0}. Then the value of(an

)(for n > 0 odd) depends THM

n 7→(an

)is periodic

only on n mod 4a.

Proof. We write a = ε · 2e ·m with m odd, m > 0, and ε = ±1. By Theorem 3.16,(a

n

)=

(ε

n

)(2

n

)e(m

n

)=

(ε

n

)(2

n

)e(−1)(m−1)(n−1)/4

(n

m

)=(ε(−1)(m−1)/2

)(n−1)/2((−1)e

)(n2−1)/8(n

m

).

The first factor depends at most on n mod 4. If the second factor is nontrivial,then e > 0, implying that 2m | a, and the second factor depends only on n mod 8.Finally, the last factor depends only on n mod m. In total,

(an

)depends only on

• n mod m, if a = 4k ·m′ with m′ ≡ 1 mod 4;

• n mod 4m, if a = 4k ·m′ with m′ ≡ 3 mod 4;

• n mod 8m, if a = 4k ·m′ with m′ ≡ 2 mod 4.

We have in all cases that m, 4m or 8m divides 4a. q

I will now demonstrate how the Law of Quadratic Reciprocity can be used toshow that a Diophantine Equation has no solution. The following equation was

§ 3. The Law of Quadratic Reciprocity 21

studied independently by Lind5 and Reichardt.6 We can reduce from nontrivial toprimitive integral solutions in the same way as for Fermat’s equation in Section 2.

3.19. Theorem. The equation X4 − 17Y 4 = 2Z2 has no primitive integral THMThm. ofLind andReichardt

solutions.

It can be shown that the equation has nontrivial real solutions (this is clear) andthat it has primitive solutions mod n for all n ≥ 1. (A triple (x, y, z) ∈ Z3 isa primitive solution mod n, if x4 − 17y4 ≡ 2z2 mod n and gcd(x, y, z, n) = 1.)So reduction mod n is not sufficient to prove the theorem, and we need a bettermethod.

Proof. Let (X, Y, Z) ∈ Z3 be a primitive solution. Let p be an odd prime divisorof Z. Note that Z 6= 0, since 17 is not a fourth power in Q. p cannot be 17,since otherwise X and then also Y would have to be divisible by 17, contradictinggcd(X, Y, Z) = 1. Considering the equation mod p, we get that X4 ≡ 17Y 4; inparticular, 17 must be a quadratic residue mod p. The LQR 3.13 then shows that(

p

17

)=

(17

p

)= 1 .

By the two supplements 3.10 and 3.12, we also have that(2

17

)=

(−1

17

)= 1 .

Since Z is a product of powers of −1, 2 and its odd prime divisors p, it followsthat Z is a quadratic residue mod 17, so there is some W ∈ Z such that W 2 ≡Z mod 17. This leads to the congruence

X4 ≡ 2W 4 mod 17 ,

where W 6≡ 0 mod 17. Multiplying by an inverse of W 4 mod 17, this gives

U4 ≡ 2 mod 17

for a suitable U ∈ Z. This congruence now has no solution, which gives the desiredcontradiction. (Note that the square roots of 2 mod 17 are ±6, neither of whichis a quadratic residue mod 17.) q

5Carl-Erik Lind, Untersuchungen uber die rationalen Punkte der ebenen kubischen Kurvenvom Geschlecht Eins, Uppsala: Diss. 97 S. (1940).

6Hans Reichardt, Einige im Kleinen uberall losbare, im Grossen unlosbare diophantische Gle-ichungen, J. reine angew. Math. 184, 12–18 (1942).