Fixed points for discrete logarithms

Transcription

1 Fixed points for discrete logarithms Mariana Levin 1, Carl Pomerance 2, and and K. Sondararajan 3 1 Gradate Grop in Science and Mathematics Edcation University of California Berkeley, CA 94720, USA levin@berkeley.ed 2 Department of Mathematics Dartmoth College Hanover, NH 03755, USA carl.pomerance@dartmoth.ed 3 Department of Mathematics Stanford University Stanford, CA 94305, USA ksond@math.stanford.ed Abstract. We establish a conjectre of Brizolis that for every prime p > 3 there is a primitive root g and an integer x in the interval [1, p 1] with log g x = x. Here, log g is the discrete logarithm fnction to the base g for the cyclic grop Z/pZ). Tools inclde a nmerically explicit smoothed version of the Pólya Vinogradov ineqality for the sm of vales of a Dirichlet character on an interval, a simple lower bond sieve, and an exhastive search over small cases. 1 Introdction If g is an element in a grop G and t g, there is some integer n with g n = t. Finding a valid choice for n is known as the discrete logarithm problem. Note that if g has finite order m, then n is actally a reside class modlo m. We write log g t = n or log g t n mod m)) in analogy to sal logarithmic notation. Ths, the problem in the title of this paper does not seem to make good sense, since if log g x = x, then the first x is a member of the grop g and the second x is either an integer or a reside class modlo m. However, sense is made of the eqation throgh the traditional conflation of members of the ring Z/kZ with least nonnegative members of reside classes. The work for this paper was begn at Bell Laboratories in 2001 while the first athor was a smmer stdent working with the second athor. A version of this work was presented as the 2003 Master s Thesis of the first athor at U. C. Berkeley, see [3]. The second athor was spported in part by NSF grant DMS The third athor was spported in part by NSF grant DMS

2 In particlar, sppose G = Z/pZ), where p is a prime nmber. This is known to be a cyclic grop of order p 1. Sppose g is a cyclic generator of this grop, known as a primitive root for p. A fixed point for the discrete logarithm modlo p to the base g is then an integer x in the interval [1, p 1] sch that log g x = x, that is, g x x mod p). Note that if x is not restricted to the interval [1, p 1] it is easy to find fixed points. Namely, if x is a soltion to the Chinese remainder problem x 1 mod p 1), x g mod p), then g x x mod p).) Brizolis see Gy [6, Section F9]) made the conjectre that for every prime p > 3 there is a primitive root g and an integer x in [1, p 1] with log g x = x, that is, g x x mod p). In this paper we prove this conjectre in a somewhat stronger form. Brizolis had noticed that if there is a primitive root x for p with x in [1, p 1] and gcdx, p 1) = 1, then with y the mltiplicative inverse of x modlo p 1 and g = x y, we wold have that g is a primitive root for p as well, and g x x xy x mod p), that is, there is a soltion to the fixed point problem. We shall prove then the stronger reslt that for each prime p > 3 there is a primitive root x for p in [1, p 1] that is coprime to p 1. Several athors have shown that the Brizolis property holds for all sfficiently large primes p. In particlar, Zhang [12] showed the strong conjectre holds for all sfficiently large primes p, bt did not give an estimate of what sfficiently large is. Cobeli and Zaharesc [4] also showed that the strong conjectre holds for sfficiently large primes p, and gave the details that it holds for all p > , bt they indicated that their method wold spport a bond arond Or method is similar to that of Zhang, who sed the Pólya Vinogradov ineqality for character sms on an interval. Here we introdce a nmerically explicit smoothed version of this ineqality, see 2. In addition, we combine the traditional character-sm approach with a simple lower bond sieve. There is still some need for direct calclation for smaller vales of p, which are easily handled by a short Mathematica program. In particlar, we directly verified the strong conjectre for each prime p < We mention the article by Holden and Moree [8], which considers some related problems. The total nmber of soltions to g x x mod p) as p rns p to some high bond N, where either g is restricted to be a primitive root, and where it is not so restricted, is considered in Borgain, Konyagin, and Shparlinski [2]. The smoothed version of the Pólya Vinogradov ineqality that we introdce in the next section is qite simple and the proof is rotine, so it may be known to others. We have fond it to be qite sefl nmerically; we hope it will find applications in closing the gap in other problems where character sms arise. Some notation: ωn) denotes the nmber of distinct prime divisors of n.

3 2 A smoothed Pólya Vinogradov ineqality Let χ be a non-principal Dirichlet character to the modls q. The Pólya Vinogradov ineqality independently discovered by Pólya and Vinogradov in 1918) asserts that there is a niversal constant c sch that χa) c q log q 1) M a M+N for any choice of nmbers M, N. Let Np) denote the nmer of primitive roots g for p with g [1, p 1] and gcdg, p 1) = 1. Using 1) one can show see Zhang [12] and Campbell [3]) that Np) = ϕp 1)2 p 1 + Op 1/2+ǫ ), for every fixed ǫ > 0, and so Np) > 0 for all sfficiently large p. The aim of this paper is to close the gap and find the complete set of primes p with Np) > 0. Towards this end it wold be sefl to have a nmerically explicit version of 1). In [3], the theorem of Bachman and Rachakonda [1] was sed pls a small npblished improvement on a secondary term in their ineqality de to the second athor of the present paper). Recently, elaborating on the work in an early paper of Landa [10], pls an idea of Bateman as mentioned in Hildebrand [7], the second athor in [11] proved a stronger nmerically explicit version of 1). Using this simplifies the approach in [3]. However, we have fond a way to simplify even frther by sing a smoothed version of 1). In this section we prove the following theorem. Theorem 1. Let χ be a primitive Dirichlet character to the modls q > 1 and let M, N be real nmbers with 0 < N q. Then ) χa) 1 a M N 1 q N. q M a M+2N Proof. We se Poisson smmation, see [9, 4.3]. Let We wish to estimate S, where Ht) = max{0, 1 t }. S := a Zχa)H Towards this end we se the identity ) a M N 1. χa) = 1 q 1 χj)eaj/q), τ χ) j=0

4 where τ χ) is the Gass sm for χ and ex) := e 2πix. Ths, The Forier transform of H is Ĥs) = S = 1 q 1 χj) ) a M τ χ) N j=0 a Zeaj/q)H 1. Ht)e st)dt = 1 cos2πs 2π 2 s 2 when s 0, Ĥ0) = 1, which is nonnegative for s real. By a change of variables in the integral, we see that the Forier transform of ejt/q)ht M)/N 1) is Ne M + N)s j/q) ) Ĥ s j/q)n ). Hence, by Poisson smmation, we have S = N q 1 χj) τ χ) j=0 n Ze M + N)n j/q) ) Ĥ n j/q)n ). Estimating trivially that is, taking the absolte vale of each term) and sing Ĥ nonnegative and χ0) = 0, we have S N q 1 Ĥ n j/q)n ) = N q q j=1 n Z k Z\qZ Ĥ ) kn. q Since N/q)ĤsN/q) is the Forier transform of Hqt/N), from the last calclation we have S q ) N kn q Ĥ q N q q Ĥ0) + ) ) N kn q Ĥ q k Z\qZ k Z = q N q + ) ) ql H = N N q + qh0) = q N, q l Z by another appeal to Poisson smmation and the definition of H. This completes the proof of the theorem. In or application we will need a version of Theorem 1 with the variable a satisfying a coprimality condition. We dedce sch a reslt below. Corollary 2 Let k be a sqare-free integer and let χ be a primitive character to the modls q > 1. For 0 < N q, we have χa) 1 a ) { N 1 2 ωk) q always 0 a 2N 2 ωk) 1 q if k is even. a,k)=1

5 Proof. Since d k,a) µd) gives 1 if a, k) = 1 and 0 otherwise, the sm in qestion eqals µd)χd) χa) 1 ad ) N 1 d k a 2N/d and sing Theorem 1 this is bonded in size by 2 ωk) q as desired. If k, q) is even, then χd) = 0 for even divisors d of k, so that we achieve the bond 2 ωk) 1 q, again as desired. Sppose now that k is even and q is odd. For each odd divisor d of k, we grop together the contribtion from d and 2d, and so we may write the sm in qestion as µd)χd) d k/2 a 2N/d a odd χa) 1 ad ) N 1. We replace a in the inner sm by q + a, and since q is now odd, the condition that a is odd may be replaced with the condition that q + a = 2b is even. Ths, the above sm becomes µd)χd)χ2) d k/2 q/2 b q/2+n/d χb) 1 2db q/2) N ) 1, and appealing again to Theorem 1 we obtain the Corollary in this case. Thogh we will not need it for or proof, we record the following corollary of Theorem 1. Corollary 3 Let χ be a primitive Dirichlet character to the modls q > 1 and let M, N be real nmbers with N > 0. Then, with θ the fractional part of N/q, ) χa) 1 a M N 1 q3/2 θ1 θ). N M a M+2N 3 A criterion for the Brizolis property Let s write the largest sqare-free divisor of p 1 as v where and v will be chosen later. We shall assme that is even, and have in mind the sitation that is composed of the small prime factors of p 1, and that v is composed of the large prime factors; we also allow for the possibility that v = 1. For the rest of the paper, the letter l will denote a prime nmber. Let S denote the set of primitive roots in [1, p 1] that are coprime to p 1. Ths, an integer g [1, p 1] is in S if and only if for each prime l p 1 we have both l g and g is not an l-th power mod p). Let S 1 denote the set of integers in [1, p 1] that are coprime to and which are not eqal to an l-th power mod p) for any prime l dividing. Let S 2 denote the set of integers in S 1 which are divisible by some prime l which divides v. Let S 3 denote the set

6 of integers in S 1 which eqal an l-th power mod p) for some prime l dividing v. Now S S 1, and the elements in S 1 that are not in S are precisely those that, for some prime l v, are either divisible by l or are an l-th power mod p). Ths, S = S 1 \S 2 S 3 ). We seek a positive lower bond for N := 2g ) 1 p 1 1, g S since if N > 0, then S. By or observation above we have N N 1 N 2 N 3, where, for j = 1, 2, 3, N j = 2g ) 1 p 1 1. g S j If d is a sqare-free divisor of p 1 and g is an integer in [1, p 1], let C d g) be 1 if g is a d-th power mod p) and 0 otherwise. Ths, C d g) = C l g) = 1 χg) l l d l d χ l =χ 0 = χg) = 1 d d l d χ of order l m d χ of order m χg). Note that µd)c d g) d is 1 if, for each l, g is not an l-th power mod p), and is 0 otherwise. By the above calclation, this expression is d µd) d m d χ of order mχg) = m χ of order m The inner sm here is ϕ)/)µm)/ϕm), so that N 1 = ϕ) 1 g p 1 g,)=1 2g ) 1 p 1 1 m µm) ϕm) χg) n /m χ of order m µnm) nm. χg). 2) Let m with m > 1. Using Corollary 2, the terms above contribte an amont bonded in magnitde by ϕ) 2ω) 1 p,

7 so the total contribtion over all m with m > 1 has magnitde at most ϕ) ) 2 ω) 1 2 ω) 1 p. The sm over g in 2) with m = 1 and so χ = χ 0 ) is ϕ) 1 g p 1 g,)=1 2g ) 1 p 1 1 = ϕ) µd) d h p 1)/d 1 2dh ) p 1 1. The inner sm over h can be evalated explicitly: it eqals p 1)/2d) if p 1)/d is even, and it eqals p 1)/2d) d/2p 1)) if p 1)/d is odd. It follows that the contribtion when m = 1 is ) 2 ϕ) p 1 2 ϕ) We conclde that ) 2 ϕ) p N 1 ϕ) > 1 2p 1) d p 1)/d odd dµd) ) 2 ϕ) p 1 ϕ)2 2 p 1) 2 ϕ) ϕ) ) 2 p 2 ϕ) 2 4ω) p. ϕ) ) 2 p 2 ϕ). ) 2 ω) 1 2 ω) 1 p Next we trn to N 2. Since an element in S 2 mst be divisible by some prime we have that N 2 h p 1)/l h,)=1 1 2hl ) ϕ) p 1 1 m µm) ϕm) χ of order m χhl). If v = 1, then N 2 = 0, so assme v > 1. The terms with m > 1 contribte, sing Corollary 2, an amont bonded in size by ϕ) ) ωv) 2 ω) 1 2 ω) 1 p. The main term m = 1 above contribtes arging as in or evalation of the main term for N 1 above) ϕ) h p 1)/l h,)=1 1 2hl ) ) 2 ϕ) p 1 1 p 1 2l + l v ).

8 Since l v, and sing v > 1, we conclde that ) 2 ϕ) p 1 1 N 2 2 l + ϕ) ) 2 ϕ) p 1 2 l + ϕ) 2 4ω) ωv) p. ) 2 + ϕ) ) ωv) 2 ω) 1 2 ω) 1 p Lastly we consider N 3. An element g of S 3 mst be an l-th power for some prime, and the indicator fnction for this condition is 1 l ψ l =χ 0 ψg), as seen above. Therefore we have that N 3 is at most g p 1 g,)=1 2g ) ϕ) 1 p 1 1 m µm) ϕm) χ of order m ) 1 χg) l ) ψg). ψ l =χ 0 Appealing to Corollary 2 for the terms above with χψ χ 0 we find that the contribtion of sch terms is bonded in magnitde by The main term χ = ψ = χ 0 gives Ths, ϕ) 1 l g p 1 g,)=1 ϕ) 22ω) 1 ωv) p. 2g ) 1 p 1 1 ϕ) ) 2 ϕ) p 1 = + 1 ) 2 v 1 l ϕ) p 1 2 ϕ) + ϕ) ) 1 p 1 l ) 2 p 1 2 l. ) 2 ϕ) p 1 N 3 2 l + ϕ) 2 4ω) ωv) p. Combining these bonds for N 1, N 2 and N 3 we obtain that ϕ) N ) 2 p ) ϕ) l 2 4ω) 1 + 2ωv)) p. We may conclde as follows: The Brizolis property holds for the prime p 5, if we may write the largest sqare-free divisor of p 1 as v with even, 1/l < 1/2, and with p > 4 ω) ϕ) 1 + 2ωv) 1 2 3) 1/l.

9 4 Completing the proof Or criterion 3) can be sed in a straightforward way with v = 1 to get an pper bond for possible conterexamples to the Brizolis conjectre. Indeed, after a small calclation sing 4 ωn) < 1404n 1/3 and n/ϕn) < 2 log log n for n larger than the prodct of the first eleven primes), it is seen that the Brizolis property holds for all p > It is not pleasant to contemplate checking each prime to this point, so instead we se 3) with v > 1. Sppose ωp 1) = k 10, and take v to be the prodct of the six largest primes dividing p 1, and to be the prodct of the other smaller primes. Since ωp 1) 10, the primes dividing v are all at least 11, and we have that l ) > If p j denotes the j-th prime, then 4 ω) /ϕ) k 6 j=1 4p j/p j 1)), and p > p 1 k j=1 p j. So from or criterion 3), if we have k j=1 pj 13 k 6 4p j 0.28 p j=1 j 1, then the Brizolis property holds for all p with ωp 1) = k. We verified that the ineqality above holds for k = 10. If k is increased by 1 then the LHS of or ineqality is increased by a factor of at least 31 > 5, bt the RHS is increased only by a factor of at most 4 11/10) = 4.4. Ths, the ineqality holds for all k 10. Sppose now that k = ωp 1) 9. If k 4, we take to be the prodct of the for smallest primes dividing p 1, and otherwise, we take to be the prodct of all the primes dividing p 1. Then v has at most 5 prime factors, and 1 2 1/l 1 21/11 + 1/13 + 1/17 + 1/19 + 1/23) Frther p 4p/p 1) 4 j=1 4p j/p j 1) = Or criterion 3) shows that if p ) 2 = 1,239,040,000, 0.35 then p satisfies the Brizolis property. Using the fnctions Prime[ ] and PrimitiveRoot[ ] in Mathematica, we were able to directly exhibit a primitive root g for each prime 3 < p < with g in [1, p 1] and coprime to p 1. Or program rns as follows. The fnction Prime[ ] allows s to seqentially step throgh the primes p to or bond. For each prime p retrned by Prime[ ], we invoke PrimitiveRoot[p] to find the least positive primitive root r for p. We then seqentially check r 2k 1 mod p for k = 1, 2,... ntil we find a vale coprime to p 1 with 2k 1 also coprime to p 1. The exponent being coprime to p 1 garantees that the power is a primitive root, and the reside being coprime to p 1 then garantees that we

10 have fond a member of S. If no sch primitive root exists, this algorithm wold not terminate, bt it did, ths verifying the Brizolis property for the given range. There are varios small speed-ps that one can se to agment the program. For example, if r = 2 is a primitive root and p 1 mod 4), then note that p 2 is a primitive root coprime to p 1, and so work with this prime p is complete. The agmented program ran in abot 90 mintes on a Dell workstation. This completes or proof of the Brizolis conjectre. Acknowledgment. We thank Richard Crandall for some technical assistance with the Mathematica program and the referees for some helpfl comments. References 1. G. Bachman and L. Rachakonda, On a problem of Dobrowolski and Williams and the Pólya Vinogradov ineqality, Ramanjan J ), J. Borgain, S. V. Konyagin, and I. E. Shparlinski, Prodct sets of rationals, mltiplicative translates of sbgrops in reside rings, and fixed points of the discrete logarithm, Int. Math. Res. Notices 2008, art. ID rnn090, 29 pp. Corrigendm: ibid. 2009, no. 16, ) 3. M. E. Campbell, On fixed points for discrete logarithms, Master s Thesis, U. C. Berkeley Department of Mathematics, C. Cobeli and A. Zaharesc, An exponential congrence with soltions in primitive roots, Rev. Romaine Math. Pres Appl ), R. Crandall and C. Pomerance, Prime nmbers: a comptational perspective, Second ed., Springer, New York, R. K. Gy, Unsolved problems in nmber theory, Springer, New York Berlin, A. Hildebrand, On the constant in the Pólya Vinogradov ineqality, Canad. Math. Bll ), J. Holden and P. Moree, Some heristics and reslts for small cycles of the discrete logarithm, Math. Comp ), H. Iwaniec and E. Kowalski, Analytic nmber theory, American Math. Soc., Providence, E. Landa, Abschätzngen von Charaktersmmen, Einheiten nd Klassenzahlen, Nachrichten Königl. Ges. Wiss. Göttingen 1918), C. Pomerance, Remarks on the Pólya Vinogradov ineqality, sbmitted for pblication, W.-P. Zhang, On a problem of Brizolis. Chinese. English, Chinese smmary.) Pre Appl. Math ) sppl., 1 3.