SOME HEURISTICS AND RESULTS FOR SMALL CYCLES OF THE DISCRETE LOGARITHM

Transcription

1 MATHEMATICS OF COMPUTATION Volum 75, Numbr 253, Pags S Articl lctronically publishd on Jun 28, 2005 SOME HEURISTICS AND RESULTS FOR SMALL CYCLES OF THE DISCRETE LOGARITHM JOSHUA HOLDEN AND PIETER MOREE Abstract. Brizolis askd th qustion: dos vry prim p hav a pair g, h such that h is a fixd point for th discrt logarithm with bas g? Th first author prviously xtndd this qustion to ask about not only fixd points but also two-cycls, and gav huristics building on work of Zhang, Cobli, Zaharscu, Campbll, and Pomranc for stimating th numbr of such pairs givn crtain conditions on g and h. In this papr w xtnd ths huristics and prov rsults for som of thm, building again on th aformntiond work. W also mak som nw conjcturs and prov som avrag vrsions of th rsults.. Introduction and statmnt of th basic quations Paragraph F9 of [5] includs th following problm, attributd to Brizolis: givn aprimp>3, is thr always a pair g, h such that g is a primitiv root of p, h, and g h h mod p? In othr words, is thr always a primitiv root g such that th discrt logarithm log g has a fixd point? As w shall s, Zhang [8] not only answrd th qustion for sufficintly larg p, but also stimatd th numbr Np ofpairsg, h which satisfy th quation, hav g as a primitiv root, and also hav h as a primitiv root which thus must b rlativly prim to. This rsult sms to hav bn discovrd and provd by Zhang in [8] and latr, indpndntly, by Cobli and Zaharscu in [2]. Campbll [] and Pomranc mad th valu of sufficintly larg small nough that thy wr abl to us a dirct sarch to affirmativly answr Brizolis original qustion. As in [6], w will also considr a numbr of variations involving sid conditions on g and h. In [6], th first author also invstigatd th two-cycls of log g,thatis,thpairs g, h such that thr is som a btwn and such that 2 g h a mod p and g a h mod p. Rcivd by th ditor January 4, 2004 and, in rvisd form, August 30, Mathmatics Subjct Classification. Primary A07; Scondary N37, 94A60, -04. Th first author would lik to thank th Ros-Hulman Institut of Tchnology for th spcial stipnd which supportd this projct during th summr of Th rsarch of th scond author was carrid out whil h was a visiting assistant profssor at th Univrsity of Amstrdam and supportd by Prof. E. M. Opdam s Pionr Grant of th Nthrlands Organization for Scintific Rsarch NWO. 49 c 2005 Amrican Mathmatical Socity Rvrts to public domain 28 yars from publication

2 420 JOSHUA HOLDEN AND PIETER MOREE As w obsrvd, attacking 2 dirctly rquirs th simultanous solution of two modular quations, prsnting both computational and thortical difficultis. Whnvr possibl, thrfor, w instad work with th modular quation 3 h h a a mod p. Givn g, h, anda as in 2, thn 3 is clarly satisfid and th common valu is g ah modulo p. Conditions on g and h in 2 can somtims b translatd into conditions on h and a in 3. On th othr hand, givn a pair h, a that satisfis 3, w can attmpt to solv for g such that g, h satisfis 2 and translat conditions on h, a into conditions on g, h. Again, w will invstigat using various sid conditions. Using th sam notation as in [6], w will rfr to an intgr that is a primitiv root modulo p as PR and an intgr that is rlativly prim to asrp. An intgr that is both will b rfrrd to as RPPR and on that has no rstrictions will b rfrrd to as ANY. In som instancs, will b usd to stand for any on of ths four conditions. All intgrs will b takn to b btwn and, inclusiv, unlss statd othrwis. If Np is, as abov, th numbr of solutions to such that g is a primitiv root and h is a primitiv root rlativly prim to, thn w will say Np =F g PR,h RPPR p F for fixd points and similarly for othr quations and conditions. Likwis th numbr of solutions to 2 will b dnotd by T for twocycls and th numbr of solutions to 3 will b dnotd by C for collisions. If ord p g =ord p h, w say that g ORD h. Th first part of this papr focuss on solutions to, with Sction 2 covring th basic huristics usd and th lmmas that can b provd about thm. Sction 3 prsnts th conjcturs about thos solutions to that follow from th huristics, and Sction 4 provs som nw thorms which giv support to th conjcturs. Th middl of th papr dals with solutions to 2 and 3. Sction 5 xamins th rlationship btwn solutions of th two quations, whil Sction 6 prsnts th huristics usd to stimat th numbr of solutions to ths two quations and th conjcturs that follow from ths huristics. Th latr sctions of th papr dal with avrag vrsions of th conjcturs and rsults prsntd in prvious sctions. Sction 7 sts out th lmmas w nd and givs avrag vrsions of th conjcturs. Sction 8 givs avrag vrsions of th rsults w hav provd, whr possibl, and maks conjcturs on th othrs. Sction 9 discusss furthr work to b don along th lins of this papr. 2. Th indpndnc of ordr and GCD Th fundamntal obsrvation at th hart of th stimation of F g PR,h RPPR p is that if h is a primitiv root modulo p that is also rlativly prim to, thn thr is a uniqu primitiv root g satisfying, namly g = h h rducd modulo p, whrh dnots th invrs of h modulo throughout this papr. Thus to stimat Np, w only nd to count th numbr of such h; g no longr has to b considrd. W obsrv that thr ar φ possibilitis for h that ar rlativly prim to, and w would xpct ach of thm to b a primitiv root with probability φ/. This huristic uss th assumption that th condition of bing a primitiv root is in som sns indpndnt of th condition of bing rlativly prim.

3 SMALL CYCLES OF THE DISCRETE LOGARITHM 42 Huristic 2.. Th condition of x RP is indpndnt of th condition that x PR, in th sns that for all p, #{x {,...,p }: x RPPR} #{x {,...,p }: x RP} #{x {,...,p }: x PR}. That this is ssntially th cas was provd in [8] and in [2]. W start with th ky lmmas of [2]. Fix a prim p. Lt P = Pa, r, N ={a, a + r,...,a+n r} b an arithmtic progrssion, whr a, r, andn ar positiv intgrs such that P {,...,p}. Lt P PR = {x P: x PR} this is calld P in [2], P RP = {x P: x RP}, and P RPPR = {x P: x RPPR}. Finally, for any st of intgrs S, lt S k = { x S: x y k mod p for som y } k-th powrs of x modulo p and S d = {x S: x 0 mod d}. Thn: Lmma 2.2. Lt S b a st of intgrs and a divisor of. Thn #{x S:gcdx, = } = µk#s k, whr µk is th Möbius function. k p Lmma 2.3 Lmma 4 of [2]. Lt S b a st of intgrs. Thn #S PR = µk#s k. k p Lmma 2.4 Lmma 5 of [2]. Lt p>3 b a prim numbr, P = Pa, r, N, and lt k and d b intgrs btwn and such that k divids. Thn #Pk d #P d k p + ln p. It should b notd that [2] only provs Lmma 2.4 for gcdr, d =, but th proof gos through mor gnrally. Now th indpndnc of RP and PR: Lmma 2.5 Lmma 6 of [2]. Lt P = Pa, r, N with gcdr, =. Thn 2 φ #PRPPR N d + d2 p + ln p.

4 422 JOSHUA HOLDEN AND PIETER MOREE As th scond author obsrvd in [3], th factors of d that occur hr can in fact b improvd to d p µd =2ωp using th sam proof; this is also don in [8]. In addition, if N, thn th first d trm may b omittd. In fact, svral tims in [6] th following mor gnral huristic was usd: Huristic 2.6. Th ordr of x modulo p is indpndnt of th gratst common divisor of x and, in th sns that for all p, { # x {,...,p }: gcdx, =, ord p x = } f #{x {,...,p }: gcdx, = } # { x {,...,p }: ord p x = f To prov a rigorous form of this w nd slightly lss gnrality in th squnc than in Lmma 2.5. Th obsrvations on Lmma 2.5 likwis hold hr. Lmma 2.7. Lt and f b divisors of, andn amultiplof. Lt P = P,,N and Thn P = { x P:gcdx, =, ord p x = }. f N p #P 2 φ φ d d + ln p f f d 2 p + ln p. With th us of th mor gnral vrsion of Lmma 2.4, th proof of Lmma 2.7 is ssntially th sam as that of Lmma 2.5. An quivalnt way of thinking about Huristic 2.6 is to fix a primitiv root b modulo p and say that th discrt logarithm log with bas b is a random map considrd in trms of divisibility; that is, that gcdlog x, which quals /ord p x is distributd indpndntly of gcdx,. If w apply this discrt logarithm to, w gt a nw quation: 4 h log g log h mod. Looking at 4 with th random map ida in mind, w s that gcdg, sms to b indpndnt of this quation. This is th ida undrlying th following huristic: Huristic 2.8. Among solutions to, th gratst common divisor of g and p is indpndnt of all othr conditions on th ordr and th gratst common divisor }.

5 SMALL CYCLES OF THE DISCRETE LOGARITHM 423 of g and h, in th sns that for all p, { # g :holds, gcdh, =, ord p h = f #, ord p g =, gcdg, = n d { g :holds, gcdh, =, ord p h =, ord p g = } f d #{g :holds, gcdg, = n}. Huristic 2.8, unlik Huristics 2. and 2.6, cannot yt b mad rigorous. 3. Conjcturs for fixd points Th following conjcturs and thorms on fixd points wr listd in [6] and corrctd in th unpublishd nots [7]. Proposition 3.. F g ANY,h RP p =φ. Thorm 3.2 Zhang, indpndntly by Cobli and Zaharscu. F g PR,h RPPR p =F g PR,h RP p = F g PR,h PR p = F g ANY,h RPPR p = F g ANY,h PR p φ 2 /. Conjctur 3.3. a F g ANY,h ANY p. b F g PR,h ANY p φ. c F g RP,h p φ/f g ANY,h p. d F g RPPR,h p φ/f g PR,h p. Rmark 3.4. Not that Conjctur c of [6] is incorrct. In, if h PR, thng PR also, so F g ANY,h PR p isqualtof g PR,h RPPR p and not diffrnt as was originally conjcturd. Proposition 3. follows dirctly from th fact that g = h h. Thorm 3.2 also follows, with th application of Lmma 2.5 that is, Huristic 2.. Conjctur 3.3a is ssntially th sam but w nd to considr whthr h is an -th powr, whr = gcdh,. Thus th conjctur uss Huristic 2.6. Mor spcifically, w s that can b solvd xactly whn gcdh, = and h is an -th powr modulo p, and in fact thr ar xactly such solutions. Thus 5 F g ANY,h ANY p = T, p, whr p { } T, p =# h P,,p :gcdh, =. }

6 424 JOSHUA HOLDEN AND PIETER MOREE According to Huristic 2.6, w can modl this sum using a st of indpndnt random variabls X,...,X p such that { gcdh, with probability gcdh,p X h = ; 0 othrwis. Thn th huristic suggsts that F g ANY,h ANY p is approximatly qual to th xpctd valu of X + + X p, which is clarly. Conjctur 3.3b was justifid in [6] using th argumnt that g PR should b indpndnt of gcdh, and ord p h. This is somwhat dubious on th fac of it, sinc if holds, thn th ordr of g is crtainly constraind by both gcdh, and ord p h. Th assumption is not ncssary, howvr. Obsrv first that if 4 holds with g PR, thngcdh, = gcdlog h,. Thn w apply th following lmntary lmma: Lmma 3.5. Lt gcda, q =gcdb, q =d. Thn th numbr of solutions of ax b mod q with gcdx, q =is givn by φq/φq/d. In particular, thr ar always btwn and d solutions. Thus th numbr of solutions to with g PR and h ANY is { # x {,...,p }: gcdx, = d, ord p x = } φ d φ /d, d p which by Huristic 2.6 is approximatly qual to 2 φ φ = φ. d φ /d d p This argumnt justifis Conjctur 3.3b. Conjcturs 3.3c and 3.3d wr justifid in [6] with Huristic 2.8; in fact th conjcturs ar mrly spcial cass of th huristic. In Sction 4, w will try to approximat th rror trm in Conjcturs 3.3a and 3.3b using Lmma 2.7. Th rsults, howvr, will not b ntirly satisfactory. With this in mind, w will also us Huristic 2.6 to modl th distribution of th valus of F g ANY,h ANY p. Lt X,...,X p b as abov. Thn w wish to find σ 2, th xpctd valu of p 2 X h. h= Not that th xpctd valu of X h X j is gcdh, if h = j and othrwis. Using this, an asy computation shows that p σ 2 = gcdh, = dφ. d h= d p In particular, σ<p /2+ɛ for vry ɛ>0. Thus w hav th following: Conjctur 3.6. Thr ar ox/ ln x prims p x for which F g ANY,h ANY p >p /2+ɛ for vry ɛ>0.

7 SMALL CYCLES OF THE DISCRETE LOGARITHM 425 Tabl. Solutions to a Prdictd formulas for F p g \ h ANY PR RP RPPR ANY p φp 2 p =φp φp 2 p PR φp φp 2 p RP φp φp 3 p 2 RPPR φp 2 p φp 3 p 2 φp 2 p φp 2 p φp 3 p 2 φp 2 p φp 3 p 2 φp 3 p 2 b Prdictd valus for F g \ h ANY PR RP RPPR ANY PR RP RPPR c Obsrvd valus for F g \ h ANY PR RP RPPR ANY PR RP RPPR Som progrss toward proving this conjctur is dscribd in Sction 4. Proposition 3., Thorm 3.2, and Conjctur 3.3 ar summarizd in Tabl, which appard in [7]. Th tabl also contains nw data collctd sinc [6]. 4. Thorms on fixd points Th first rigorous rsult on this subjct was Thorm 3.2. Both [8] and [2] providd bounds on th rror involvd; w will us notation closr to [2]. Thorm 4. Thorm of [2]. F φ2 g PR,h RPPRp d2 p + ln p. Proof. Apply Lmma 2.5 with P = P,,p. Th obsrvations on d apply. W nxt turn our attntion to F g ANY,h ANY p. Rcall from Sction 3 that its valu can b xprssd by 5. Th quantity T, p that occurs thr can b straightforwardly valuatd using Lmmas 2.2 and 2.4. W can also us th following charactrization: Lmma 4.2. Lt k. Thn T k,p =# { j : j k, j, k =, j k k k mod p }.

8 426 JOSHUA HOLDEN AND PIETER MOREE Proof. For ach intgr h with gcdh, = /k, h = j/k for som j k with gcdj, k =, such that, morovr, j x p /k mod p k for som intgr x. It follows that j k mod p k and hnc j k k k mod p. Not that p k. On obsrving that if z k mod p, thn z x p /k mod p for som intgr x, th proof of th rvrs implication asily follows. W now hav th following rsults: Proposition 4.3. Lt. Thn a T, p p φ d + ln p. b T,p=φp. c If k is a divisor of such that 2k k p, thnt d 0 T, p φ. F g ANY,h ANY p p 3 d f For any E, E, k,p =0. σ 3 2 p + ln p. F g ANY,h ANY p Edp 2 p + ln p+p d p, E whr d k n =#{d : d<k}. Proof. Th cardinality of T, p quals { } # h P,,p :gcdh, = = µk#p,,p k by Lmma 2.2 k p = k p [ ] µk #P,,p k + η,k p + ln p

9 SMALL CYCLES OF THE DISCRETE LOGARITHM 427 for som η,k, by Lmma 2.4 = [ ] µk k + η,k p + ln p k p = k p µk k 2 + η p + ln pd for som η = [ ] φ + η p + ln pd from whnc part a follows. Parts b and d ar clar from th dfinition. Part c follows from Lmma 4.2, sinc for such valus of k on has 0 <k k j k <p for any j btwn and k, rlativly prim to k. Thiswasobsrvdbyananonymous rfr. Part follows upon noting that T, p = [ φ p p ] + η p + ln pd = + η p + ln pd σ for som η and thn applying part c. Part f is similar; obsrv that T, p p = p E [ φ p E ] + η p + ln pd + T, p p = [ ] φ + η p + ln pd + η φ p p E >E =p + η p + ln pd + η φ p = + Eηd 2 p + ln p+η >E p >E >E =p + Eηdp 2 p + ln p+η d p, E whr η, η, η.

10 428 JOSHUA HOLDEN AND PIETER MOREE Unfortunatly for part, σ 3/2 =Op ln ln p inthworstcas, although if p is a Sophi Grmain prim, σp 3p /2 = 3, and th avrag cas, avraging ovr a rang of p, isσ 3/ S latr in this sction for mor on Sophi Grmain prims, and Sctions 7 and 8 for furthr dtails of th avrag cas. Thus th rror trm for F g ANY,h ANY p will b largr than th main trm for infinitly many p. In fact, this stimat is vn wakr than th rathr trivial bound φ F g ANY,h ANY p φ d p obtaind from parts b and d of th proposition. On th basis of a huristic argumnt w conjctur that th avrag ordr of φ p is c p ln p with c a positiv constant. A littl thought rvals th problm: sinc #{h P,,p : gcdh, = } is multiplid by ach divisor of, an rror of vn in calculating th numbr of lmnts in th st for a larg valu of will rsult in an rror of O. Part f givs us somthing of an improvmnt; but it dos not solv th problm in gnral. In ordr to mak th trm Edp 2 p + ln p bvnop, w must pick E<, which maks d p d/2 byanlmntary E counting of divisors. Thus th rror trm will still b of largr ordr than th main trm. On th othr hand, th lin of argumnt from part works if w rstrict to prims p for which Ep =max{:, T, p > 0} is not too larg. Thus, th rror in T, p will not b multiplid by too larg an. Proposition 4.4. Suppos that /4 β, Ep p β,andδ>0. Thn Mor spcifically, F g ANY,h ANY p = + O δ p /2+β+δ. F g ANY,h ANY p p /2+β d ln p. Proof. By th assumption on Ep, 5, and Proposition 4.3a, w hav F g ANY,h ANY p = p p β = p p β T, p φ + η p β d 2 p + ln p

11 SMALL CYCLES OF THE DISCRETE LOGARITHM 429 for som η = φ for som η 2 0 for som η 3 p >p β + η p /2+β d 2 + ln p = +η 2 dp β + η p /2+β d 2 + ln p = +η 3 p /2+β d ln p = +O p /2+β+δ, whr w usd th facts that dn =O δ n δ for vry δ>0andφn n. Rmark 4.5. On rason to considr th mor spcific vrsion of this proposition is to aid in computr sarchs such as th on dscribd in []. Proposition 4.4 is, of cours, only usful if thr xist sufficintly many prims satisfying Ep p β for som appropriat β. For instanc, β nds to b lss than /2 bfor th rror trm is lss than th main trm: Corollary 4.6. Suppos Ep p /2 δ and δ>0. Thn F g ANY,h ANY p =p + op. In fact, w will prov that thr ar x/ ln x prims p x for which Ep p and thus that thr ar x/ ln x prims p x such that F g ANY,h ANY p =p + O p 5/6. Th proof of this starts with th following application of Lmma 4.2: Proposition 4.7. Lt δ > 0, α 2/3. ExcptforO x 3 3α /ln 3α +3δ x prims p x w hav Ep <p α ln α+δ p. In particular, ltting α =2/3, xcptforo x/ln +3δ x prims p x w hav Ep <p 2/3 ln 2/3+δ p. Proof. Lt f δ x =x α / ln α+δ x.ifis a prim not dividing k P = j k k k, thn, by Lmma 4.2, for som k implis k f δ x j= j,k= T,p > 0 k k >f δ x > p α ln α+δ p

12 430 JOSHUA HOLDEN AND PIETER MOREE and hnc Ep <p α ln α+δ p. Th nonzro intgr P has O k 2 ln k = O f δ x 3 ln f δ x x 3 3α = O ln 3α +3δ x k f δ x distinct prim divisors. Ths ar th possibl xcptions to th inquality Ep <p α ln α+δ p. W can now prov: Proposition 4.8. Thr ar x/ ln x prims p x for which Ep p Proof. It is a dp rsult of Fouvry s,.g., [4], that x/ ln x prims p x ar such that has a prim factor largr than p In combination with Proposition 4.7 it follows that thr ar x/ ln x prims p x for which Ep < p and has a prim factor largr than p Sinc Ep isadivisorof it must divid th factors of bsids th largst, and thus Ep <p for any such prims. Ltting β = and δ = in Proposition 4.4 and invoking Proposition 4.8, w now hav: Thorm 4.9. Thr ar x/ ln x prims p x such that F g ANY,h ANY p =p + O p 5/6. Mor spcifically, thr ar x/ ln x prims p x such that F g ANY,h ANY p p d ln p. Rmark 4.0. If on can stablish that in Fouvry s assrtion, can b rplacd by som largr θ up to θ =3/4, thn in Thorm 4.9 th xponnts 5/6 and0.833 can b rplacd by 3/2 θ + δ and 3/2 θ for any δ>0. Th most wll-known prims p with having a larg prim factor ar th Sophi Grmain prims. Ths ar th prims p such that =2q with q a prim. For ths prims it is asily shown using Proposition 4.3c with k =and k =2that F g ANY,h ANY p =T,p+2T2,p. Procding as in th proof of Proposition 4.3, th following rsult is thn obtaind: Proposition 4.. If p is a Sophi Grmain prim, thn F g ANY,h ANY p p 3 2 p + ln p. By siving mthods it can b shown that thr ar x/ log 2 x Sophi Grmain prims p x. On th othr hand, it is not known whthr or not thr ar infinitly many Sophi Grmain prims. In fact, w can stat a similar rsult for prims p of th form p =mq as long as q is prim and m is sufficintly small. This was obsrvd by an anonymous rfr.

13 SMALL CYCLES OF THE DISCRETE LOGARITHM 43 Lt W b th Lambrt W function, which has th proprty that W x W x = x for any x. Thn as long as m lnp/2/w lnp/2, any divisor k of m will hav th proprty that 2k k p. Thus Proposition 4.3c givs us F g ANY,h ANY p = m T, p and thus: Proposition 4.2. If p is a prim as dscribd abov, thn F g ANY,h ANY p m 2dmσm p + ln p. Th factor 2dmσm can somtims b improvd, as was th cas for Sophi Grmain prims. It is also worth asking how larg Ep can b with rspct to p. W put forward th following conjctur: Conjctur 4.3. Lt α<. Thr xist infinitly many prims p with Ep >p α. Th ida is that amongst th numbrs of th form k k j k, j k, gcdj, k =, thr will b many that ar clos to bing a prim and that if q is a larg prim divisor of such a numbr, thn Eq will b larg. Taking k =29andj =5w infr, for xampl, that th prim q = satisfis Eq >q Ifkis odd and q = k k j k isaprimforsom j k, thneq > q /k. Turning back to th gnral cas, th situation whr g is PR and h is ANY follows th argumnt xplaind in th justification of Conjctur 3.3b, and uss Lmma 2.7 to stimat th rror trm. It is vry similar to th prvious cas, and unfortunatly has th sam problm in th gnral cas: Proposition 4.4. a F g PR,h ANY p φ 2 d 2 σ 3 2 p + ln p. b For any E, E, F g PR,h ANY p φ Edp 2 p + ln p+φp d p. E W can procd in th sam fashion as Thorm 4.9, howvr, to prov: Thorm 4.5. Thr ar x/ ln x prims p x such that F g PR,h ANY p =φ + O p 5/6. Mor spcifically, thr ar x/ ln x prims p x such that F g PR,h ANY p φ p d ln p.

14 432 JOSHUA HOLDEN AND PIETER MOREE Finally, w should mntion that th scond author in [3] pointd out that w could also stimat th numbr G g PR,h ANY p ofvalush such that thr xists som g satisfying, with g PR and h ANY. From it was shown: G g ANY,h ANY p = p { # p h: ord p h =, gcdh, = Thorm 4.6. G g PR,h ANYp 2 φ d3 p + ln p. Similarly, w can stimat G g ANY,h ANY p = giving: p Thorm 4.7. G g ANY,h ANYp }, { } # h P,,p :gcdh, =, p φ d2 p + ln p. Sinc w ar no longr counting multipl solutions for ach valu of h th problm with th rror trms discussd abov disappars; th rror trms ar Op /2+ɛ whil th main trms look on avrag lik a constant tims p. For compltnss, w should not that if h is RP and/or PR, thn Huristic 2.8 would also prdict that G g,h p =F,g,h p. G g RP,h p φ/g g ANY,h p and G g RPPR,h p φ/g g PR,h p. 5. Equivalnc of th quations for two-cycls As obsrvd in [6], conditions on 2 can somtims b translatd into conditions on 3 in a rlativly straightforward mannr. Tabl 2, rproducd from [7], summarizs ths straightforward rlationships. W can go slightly furthr, howvr. Taking th logarithm of th two quations of 2 with rspct to th sam primitiv root b givs us nw quations: h log g log a mod ; 6 a log g log h mod. Lt d =gcdh, a,, and lt u 0 and v 0 b such that u 0 h + v 0 a d mod.

15 SMALL CYCLES OF THE DISCRETE LOGARITHM 433 Tabl 2. Rlationship btwn solutions to 2 and solutions to 3 a \ h ANY PR RP RPPR ANY g ANY g PR h RP h RPPR PR g PR g PR h RP h RPPR RP h ANY g PR h RP g PR g ORD h h PR g ORD h h RPPR RPPR g PR g PR g PR g PR h RPPR h RPPR h RPPR h RPPR By using th Smith Normal Form, w can show that 6 is quivalnt to th quations: 0 h d log h a log a mod ; 7 d d log g v 0 log h + u 0 log a mod, or: h h/d a a/d mod p; 8 g d h v 0 a u 0 mod p. Inthcaswhrd =gcdh, a, =, thn this bcoms just 9 Thus: h h a a mod p; g h v 0 a u 0 mod p. Proposition 5.. If gcdh, a, p =, thn thr is a on-to-on corrspondnc btwn tripls g, h, a that satisfy 2 and pairs h, a that satisfy 3, andthvalu of g is uniqu givn h and a. In particular, this is tru if h is RP or a is RP. It was obsrvd in [6] that whn nithr h nor a is RP th rlationship btwn 2 and 3 is lss clar. It was claimd thr that givn a pair h, a thatisasolution to 3 w xpct on avrag gcda, gcdh, / gcdha, 2 pairs g, h that ar solutions to 2. It is clar from 8, howvr, that whn d =gcdh, a, this is not th corrct way to think about things. Th propr quation to look at in this cas is not 3, but 0 h h/d a a/d mod p. W will us C to dnot th numbr of solutions to 0. Now 8 shows that a nontrivial solution to 0 producs d pairs g, h which ar nontrivial solutions to 2 if h v 0 a u 0 is a d-th powr modulo p, and othrwis no solutions. As in [6], w considr th trivial solutions to 2 to b th ons that ar also solutions to. Thus th following huristic implis that vry nontrivial solution to 0 producs on avrag on pair g, h thatisanontrivialsolution to 2.

16 434 JOSHUA HOLDEN AND PIETER MOREE Tabl 3. Rlationship btwn solutions to 2 and solutions to 0 g \ h ANY PR RP RPPR ANY h ANY,aANY h PR h RP h RPPR ET/C a RP a ANY a RPPR PR h ANY,aANY h PR h RP h RPPR ET/C φp p a RP a PR a RPPR Huristic 5.2. For any pair h, a, ltd =gcdh, a,, andltu 0 and v 0 b such that u 0 h + v 0 a d mod. Thn h, a h v 0 a u 0 is a random map, vn whn rstrictd to gcdh, a, p = d, in th sns that #{h, a: h v 0 a u 0 y mod p, gcdh, a, = d} #{h, a: gcdh, a, = d} #{y {,...,p }}. On th othr hand, thr is a solution to 8 with g PR if and only if h v 0 a u 0 is xactly a d-th powr modulo p; thatis,ord p h v 0 a u 0 =p /d. Thn Lmma 3.5 says that th numbr of such solutions is φ/φ/d. Thus Huristic 5.2 implis that vry solution to 0 producs on avrag φ/ pairs g, h that ar solutions to 2 with g PR. Ths rlationships btwn conditions on 2 and conditions on 0 ar summarizd in Tabl 3, whr ET/C is th xpctd numbr of solutions to 2 givn a solution to Huristics and conjcturs for two-cycls W mntiond in Sction 2 that w could viw x log x as a random map in som sns. W will also suppos that th map x x x mod p is random, in a slightly diffrnt sns. Huristic 6.. Th map x x x mod p is a random map givn th obvious rstrictions on ordr in th sns that for all p, givn y {,...,p }, thn #{x {,...,p }: x x y mod p} #{z {,...,p }: ord pz/ gcdz, ord p z=ord p y}. #{w {,...,p }: ord p w =ord p y} Th fraction on th right-hand sid was rfrrd to in [6] as #S m /#T m,whr m =ord p y. Th argumnts thr usd this huristic implicitly. In fact, w would lik a slightly strongr vrsion of this: Huristic 6.2. Th map x x x mod p is a random map, vn whn rstrictd to a spcific ordr and gratst common divisor, in th sns that for all p, givn y {,...,p } such that ord p y = f/gcd, f, thn #{x {,...,p }: x x y mod p, gcdx, =, ord p x = f} #{z {,...,p }: gcdz, =, ord pz = f}. #{w {,...,p }: ord p w =ord p y} Huristic 6.2, lik Huristic 2.8, cannot yt b mad rigorous. Using Proposition 5. and Huristic 6.2, w hav th following conjcturs from [6], as corrctd in [7].

17 SMALL CYCLES OF THE DISCRETE LOGARITHM 435 Conjctur 6.3. a T g ANY,h RP p =C h RP,a ANY p 2φ. b T h RP,g ORD h p =C h RP,a RP p φ + φ 2 /. c T g PR,h RP p =C h RP,a PR p 2φ 2 /. d T g PR,h RPPR p =T g ANY,h RPPR p = C h RPPR,a p =C h,a RPPR p φ 2 / + φ 3 / 2. T h ANY,g ORD h p =C h ANY,a RP p 2φ. f T g PR,h PR p =T g ANY,h PR p =C h PR,a RP p 2φ 2 /. In Conjcturs 6.3a and 6.3 it should b notd that th obsrvd valus in qustion must b xactly not just approximatly qual, by th symmtry of 3. Th sam applis in Conjcturs 6.3c and 6.3f. W also mad in [6] th following conjcturs about solutions to 3. Conjctur 6.4. a C h ANY,a ANY p + m p φm m 2 d p /m φdm d b If is squarfr, thn C h ANY,a ANY p + whr th product is takn ovr prims q dividing. c In gnral, 2. q p q +, q C h ANY,a ANY p + q α p [ ] 2 α + q + 3 [ α + 2 qα+ q 2α + αqα+2 α +q α+ + q q q q 2 + α2 q α+3 2α 2 +2α q α+2 +α 2 +2α +q α+ q 2 q q 3 whr th product is takn ovr prims q dividing and α is th xact powr of q dividing. d C h PR,a ANY p 2φ. C h ANY,a PR p 2φ. f C h PR,a PR p φ + φ 2 /. Th formulas in Conjctur 6.4a and Conjctur 6.4c appar in [6] with typos. Thy appar corrctly hr and in [7]. ]

18 436 JOSHUA HOLDEN AND PIETER MOREE Tabl 4. Solutions to 3 a Prdictd formulas for th nontrivial part of Cp a \ h ANY PR RP RPPR ANY S m 2 T m φp φp φp 3 p 2 PR φp φp 2 p RP φp φp 2 p RPPR φp 3 p 2 φp 3 p 2 φp 2 p φp 2 p φp 3 p 2 φp 3 p 2 φp 3 p 2 φp 3 p 2 b Prdictd valus for th nontrivial part of C00057 a \ h ANY PR RP RPPR ANY PR RP RPPR c Obsrvd valus for th nontrivial part of C00057 a \ h ANY PR RP RPPR ANY PR RP RPPR Ths conjcturs rly on Huristics 2.6 and 6.2 and a standard birthday paradox argumnt. Thanks to Lmma 2.7 w ar now closr to making thm into rigorous thorms. All of th conjcturs on 3 ar summarizd in Tabl 4, which appard in [7]. Th tabl also contains nw data collctd sinc [6]. As in [6], w distinguish btwn th trivial solutions to 3, whr h = a, and th nontrivial solutions. As obsrvd in Sction 5, to stimat th numbr of solutions to 2 in th rmaining cass w nd to look at 0. W start by stimating th numbr of nontrivial solutions. This rquirs a finr vrsion of Huristic 6.2 which taks d =gcdh, a, into account. Huristic 6.5. Fix d, such that divids and d divids. Thn th map x x x/d mod p is a random map, vn whn rstrictd to a spcific ordr and gratst common divisor, in th sns that for all p, givn y {,...,p } such that ord p y = f/gcd, f, thn { # x {,...,p }: x x/d y } mod p, gcdx, =, ord p x = f #{z {,...,p }: gcdz, =, ord pz = f}. #{w {,...,p }: ord p w =ord p y} Now w can approximat th numbr of nontrivial solutions of 0 using a similar birthday paradox argumnt to that usd in [6] for Conjctur 6.4.

19 SMALL CYCLES OF THE DISCRETE LOGARITHM 437 By Huristic 6.5, w s that th nontrivial part of C h ANY,a ANY p isqualto: #{h, a: h a, 0 holds, gcdh, a, = d} d p = #{h, a: h a, 0 holds, gcdh, =, d p,f p gcd,f=d d p,f p m p gcd,f=d #S m, #S m,f #T m, whr { } S m,r = x: ord p x x/d =m, gcdx, = r = { x x: ord p x =nm, gcd d,nm = n p /m n p /m gcd r d,nm=n {x: ord p x =nm, gcdx, = r} and T m = {x: ord p x = m}. Thn, by Huristic 2.6, w hav: #S m,r = n p /m gcd r d,nm=n n p /m gcd r d,nm=n gcda, = f} } = n, gcdx, = r #{x: ord px =nm} #{x: gcdx, = r} φnmφ r. Thus #{h, a: h a, 0 holds, gcdh, a, = d} d p d p,f p m p gcd,f=d = φm n p /m gcd d,nm=n t p /m gcd f d,tm=t d p,f p m p n p /m t p /m gcd,f=d gcd d,nm=n gcd f d,tm=t φnmφ φtmφ f φnmφtmφ p 2 φm φ p f.

20 438 JOSHUA HOLDEN AND PIETER MOREE Proposition 6.6. For any d dividing q,,f q m q n q/m t q/m gcd,f=d gcd d,nm=n gcd f d,tm=t φnmφtmφ q φ q f q = qj 2, φm d whr J 2 r is th Jordan function J 2 r = s r s2 µ r s. Proof. This can b vrifid dirctly whn q is a prim powr; thn us multiplicativity for th gnral cas. It sms likly that a mor combinatorial proof of this proposition can b found. Finally, w s that th nontrivial part of C h ANY,a ANY p is approximatly d p,f p m p n p /m t p /m gcd,f=d gcd d,nm=n gcd f d,tm=t φnmφtmφ p 2 φm = d p =. φ p f J 2 As w saw in Sction 5, Huristic 5.2 implis that vry nontrivial solution to 0 with h ANY and a ANY producs on avrag on pair g, h that is a nontrivial solution to 2. Thus th nontrivial part of T g ANY,h ANY p and also th nontrivial part of C h ANY,a ANY p ar both approximatly qual to. Similarly, w saw that Huristic 5.2 implis that vry solution to 0 with h ANY and a ANY producs on avrag φp /p pairs g, hthatarsolutions to 2 with g PR. Combining this with th prvious argumnt, w s that th nontrivial part of T g PR,h ANY p is approximatly d p J p 2 d φ = φ. Ths calculations justify th following conjcturs: Conjctur 6.7. a T g PR,h ANY p 2φ. b T g ANY,h ANY p 2. Ths conjcturs wr mad in [6] on th basis of an xtnsion of th random map ida for x log x. As was xplaind thr, howvr, it was not clar how to formulat th ida as a huristic that could b provd in a rigorous form. Th nw analysis xplains th complications in th rlationship btwn C h ANY,a ANY and T g ANY,h ANY ncountrd in [6]. Finally, Huristic 5.2 can b usd to justify th last st of conjcturs from [7]: Conjctur 6.8. a T g RP,h p [φ/] T g ANY,h p. b T g RPPR,h p [φ/] T g PR,h p. d

21 SMALL CYCLES OF THE DISCRETE LOGARITHM 439 Tabl 5. Solutions to 2 a Prdictd formulas for th nontrivial part of T p g \ h ANY PR RP RPPR ANY p φp 2 p φp φp 3 p 2 PR φp φp 2 p RP φp φp 3 p 2 RPPR φp 2 p φp 3 p 2 φp 2 p φp 2 p φp 3 p 2 φp 3 p 2 φp 4 p 3 φp 4 p 3 b Prdictd valus for th nontrivial part of T g \ h ANY PR RP RPPR ANY PR RP RPPR c Obsrvd valus for th nontrivial part of T g \ h ANY PR RP RPPR ANY PR RP RPPR Th conjcturs on 2 ar summarizd in Tabl 5, which appard in [7]. Th tabl also contains nw data collctd sinc [6]. Th data sts from Tabls, 4, and 5 wr collctd on a Bowulf clustr with 9 nods, ach consisting of 2 Pntium III procssors running at Ghz. Th programming was don in C, using MPI, OpnMP, and OpnSSL libraris. Th collction took 68 hours for all valus of F p, T p, and Cp, for fiv prims p starting at Avrags of th main trms Thus far w hav considrd variants of th Brizolis conjctur for a fixd finit fild with p lmnts. In th nxt two sctions w considr avrag vrsions of ths rsults and conjcturs. Th conjcturs prdict a main trm; th rsults giv a main trm and an rror trm. Th following squnc of lmmas givs th bhavior of th main trms, on avrag. Th only rsult from analytic numbr thory w nd in ordr to prov ths lmmas is th so-calld Sigl-Walfisz thorm. As usual πx; d, a dnots th numbr of prims p x such that p a modulo d, and Lix = x dt/ ln t dnots th logarithmic intgral. 2 Lmma 7. [5, Satz 4.8.3]. Lt C>0 b arbitrary. Thn πx; d, a = Lix φd + Ox c ln x, uniformly for d ln C x, a, d =, whr th constants dpnd at most on C.

22 440 JOSHUA HOLDEN AND PIETER MOREE Th following rsult for k = is wll known; s,.g., [2, 6]. For arbitrary k it was claimd by Essn [3] but only provd for k = 3. W prsnt a proof basd on an ida of Carl Pomranc [4]. An analogu of this rsult for natural numbrs was provd by Issai Schur in his Wintr Smstr lcturs of H provd, for any complx numbr s, that lim m m m s φn = n n= p + /ps. p For an instructiv discussion of this rsult s [8, Chaptr 4.2]. Lmma 7.2. Lt k and C b arbitrary ral numbrs with C>0. Thn k φ x = A k Lix+O C,k ln C, x whr A k = + /pk. p Proof. Th implicit constants in this proof dpnd at most on C and k. Lt g k b th Dirichlt convolution of th Möbius function and φn/n k. Notic that g k is a multiplicativ function and that φn/n k = d n g kd. Using th lattr idntity w infr that k φ = g k d = g k dπx; d,. d p d x If p is a prim, thn clarly g k p = /p k andg k p r =0forr 2. For vry k thr xists a constant c k such that g k p c k /p for vry prim p. Not that g k n cωn k µn n +ɛ, n whr ωn dnots th numbr of distinct prim divisors of n. Nowwrit g k dπx; d, = g k dπx; d, + g k dπx; d, d x d ln B x ln B x<d x = S + S 2, say, whr B>0isarbitrary for th momnt. In ordr to stimat S, w invok Lmma 7.. This givs g k d x S =Lix φd + O C ln C. x Now d ln B x d ln B x g k d φd = d= g k d φd + O d>ln B x g k d. φd W hav d/φd = p d p p d p ln d, using Mrtns formula. This togthr with th stimat shows that th sum d= g kd/φd

23 SMALL CYCLES OF THE DISCRETE LOGARITHM 44 Tabl 6. Th constants A k k A k is absolutly convrgnt. Sinc, morovr, g k d/φd is multiplicativ, w find using th Eulr product idntity that d= g kd/φd =A k. Using w infr that d>ln B x g k d φd d>ln B x ln d B ln ln x d2 ɛ ln B ɛ x. Invoking th stimats πx; d, <x/dand lads to S 2 = Ox ln B ɛ x. On putting vrything togthr and taking B sufficintly larg, th rsult follows. Rmark 7.3. Using,.g., Mapl it turns out that in th rang 0 k 27 th constant A k is quit wll approximatd by.0k k2. Th constant A quals th Artin constant. Lt A k,n = + /pk and ζ n k =ζk p p>n p n k. If k is a natural numbr and n is sufficintly larg, thn A k,n = k 2 ζ nr k,r, whr th xponnts k,r ar intgrs that can b xplicitly computd []. In this way A k and indd any othr Eulr product apparing in this papr can b valuatd with arbitrary prcision; cf. Thorm 2 of []. In Tabl 6 w prsnt a fw xampls. If a and b ar natural numbrs, thn by a, b w dnot th gratst common divisor of a and b and by [a, b] th lowst common multipl. Lmma 7.4. Lt a and b b natural numbrs and C>0. W hav φ p p a φ b 2 x 2 = ra, ba 2 Lix+O a,b,c ln C x whr p mod a p mod b 3 ra, b = W hav 4 [a,b] φ a,b φ[a, b] [a, b] 4 p ab pp 2 + p 3 p 2 2p + p ab a,b 2 φ [a,b] a,b [a,b] φ[a, b][a, b] 2 ra, b 4.3 φ a,b φ[a, b][a, b] 2., pp 2 p 3 2p +.

24 442 JOSHUA HOLDEN AND PIETER MOREE Proof. Th proof can b carrid out similarly to that of Lmma 7.2. W introduc an arithmtic function h a,b that satisfis 5 φm a mφ a a,b φm b a,b a,b mφ b a,b = d m h a,b d. On noting that th lft-hand sid of 5 is a multiplicativ function of m, it follows that h a,b is multiplicativ. Thn h a,b is asily valuatd. Taking m =/[a, b] w find that 2 holds with constant φ [a,b] a,b φ[a, b][a, b] 2 d= h a,b dφ[a, b]. φd[a, b] Aftr som manipulations th lattr xprssion, in which th sum has as argumnt a multiplicativ function, is sn to qual 6 A 2 φ [a,b] a,b φ[a, b][a, b] 2 p ab p 3 2p + pp 3 p 2 2p + p ab a,b 2 pp 2 p 3 2p +. On furthr simplification this is sn to qual ra, ba 2.Itcanbshownthat p 2 p 3 p 2 2p p This inquality and th fact that th local factors in th two products apparing in 6 ar all > thn stablishs th truth of 4. Lmma 7.5. Lt C>0 b arbitrary. W hav φ p = S Lix+O C x ln C x whr S = p p p is th Stphns constant s [7]. Proof. Using th fact that φn/n = d n µd/d with n =p /, w find on making th substitution d = v and swapping th ordr of summation that φ = d v µdd v 2. p v x, p mod v On splitting th summation rang in th rang v ln B x and v>ln B x for an appropriat B, th rsult is thn dducd as in Lmma 7.2. Rmark 7.6. Lt V = {V n } n=0 b a squnc of intgrs. W say that m divids th squnc V if m divids at last on trm of th squnc. Dnot by δv th natural dnsity of prims p dividing V, if it xists. Stphns [7] provd, subjct to th Gnralizd Rimann Hypothsis GRH, that δv xists for a larg class of scond-ordr linar rcurrncs. Morovr h showd, subjct to GRH, that for ths squncs δv quals a rational numbr tims th Stphns constant.

25 SMALL CYCLES OF THE DISCRETE LOGARITHM 443 His work is xtndd and corrctd in [9, 0]. For mor dtails on th numrical approximation to S givn in th lmma s [, p. 397]. Lmma 7.7. Lt C>0 b arbitrary. W hav 2 ζ3 x 2 φ = A ζ2 Lix+O C ln C, x whr A ζ3 ζ2 = p p 2p p Proof. Using th fact that φn/n 2 = d n g 2d withn =p / for th dfinition of g 2 d s th proof of Lmma 7.2, w find on making th substitution d = v and swapping th ordr of summation that p 2 φ = v x d v d2 g 2 d v 2 p mod v On splitting th summation rang in th rang v ln B x and v>ln B x for an appropriat B, th rsult is thn dducd as in Lmma 7.2. Rmark 7.8. Lmma 7.4 suggsts that th sum in th prvious lmma is asymptotically qual to A 2 = r,. Som computation shows that, in agrmnt with Lmma 7.7, w hav A 2 = r, =A 2 = 3 Lmma 7.9. Lt C>0 b arbitrary. W hav 7 φm 2 φd d whr m p U = p d p m p p 3 2p + p 3 p 2 2p + = A ζ3 ζ2.. x = U Lix+O C ln C, x + 3p2 +2p + pp +p Proof. Lt us dfin h n = d n φd/d2. Not that h is multiplicativ. Lt us dnot th lft-hand sid of 7 by I.Whav I = = = v x m p m p φ p m m p m h m m h m δ p m δ v µδh v δ v µδ δ p mod v.

26 444 JOSHUA HOLDEN AND PIETER MOREE Procding as in most of th arlir lmmas, w thn dduc that 7 holds tru with constant v= δ v µδg v δ = vφv p + k= which, aftr som tdious calculation, is sn to qual U. Lmma 7.0. Lt C>0 b arbitrary. W hav φm φd m 2 d m p v x d p m 2+2k /p p 2k, x = L Lix+O C ln C, x whr L = + p5 +2p 4 3p 3 + p 2 + p 3 p p Proof. Lt us dnot th lft-hand sid of 8 by I 2.Whav I 2 = h m φ p m 3 m p m p m = h m g 3 δ m m p δ p m = δ v δh δg 3 v δ. v p mod v Procding as in most of th arlir lmmas, w thn dduc that 8 holds tru with constant δ v δh δg 3 v δ vφv v= = + k p p 3 p + k p 2 p 2k, p k= which, aftr som tdious calculation, is sn to qual L. Th final lmma w will prsnt is actually usd in our rror trms and not our main trms, but it is of th sam charactr as th othrs in this sction. Lmma 7.. Lt k and C b arbitrary ral numbrs with C>0, k>0. Thn σ k x k = T klix+o C,k ln C, x whr σ k n = d k d n and T k = p p + p k+.

27 SMALL CYCLES OF THE DISCRETE LOGARITHM 445 Tabl 7. Th constants T k k T k Proof. Using th fact that σ k n/n k = d n dk /n k = d n /dk,wsthat σ k k = d k = πx; d,. dk d x d p On splitting th summation rang in th rang v ln B x and v>ln B x for an appropriat B, th rsult is thn dducd as in Lmma 7.2. W hav not yt computd th constants T k using th tchniqus dscribd in Rmark 7.3, but a rough approximation using Mapl givs th rsults shown in Tabl Avrags of th conjcturs and rsults Givn th lmmas from th prvious sction it is trivial to stablish avrag vrsions of som of our rsults. For xampl, w hav: Thorm 8.. Lt C>0 b arbitrary. W hav F g PR,h RPPR p = A 2 Lix+O C x ln C x Proof. This follows at onc from Thorm 4., Lmma 7.2, and th obsrvation that, for vry ɛ>0, d p + ln p/ = Ox /2+ɛ. Similarly, w hav: Thorm 8.2. Lt C>0 b arbitrary. W hav G gpr,hany p ζ3 x = A ζ2 Lix+O C ln C x and G gany,hany p. x = S Lix+O C ln C. x Proof. This likwis follows from Thorms 4.6 and 4.7 and Lmmas 7.5 and 7.7.

28 446 JOSHUA HOLDEN AND PIETER MOREE Propositions 4.3 and 4.4 ar unfortunatly mor problmatic, du to th prsnc of th xcptionally larg rror trm. As rmarkd thr, th factor of σ 3/2 in th rror trm can b avragd as σ 3/2 x =T 2 3/2Lix+O C ln C x x Lix+O C ln C. x Apply Lmma 7.. Th factor of p, howvr, will still rsult in an rror trm with an ordr of magnitud largr than th main trm. On th othr hand, almost all of th conjcturs on, 3, and 2 lnd thmslvs asily to avrag vrsions of th sort tratd abov. For instanc, w hav: Conjctur 8.3. a F g ANY,h ANY p Lix. b F g PR,h ANY p A Lix. Ths conjcturs and th avrag vrsions of our othr conjcturs ar summarizd in Tabls 8, 9, and 0. Th data sts in ths tabls wr collctd on th sam Bowulf clustr with similar softwar. Th collction took 7 hours for all valus of F p p, T p p,and Cp p,forx = 643. Th rsults of th prcding sction unfortunatly do not allow us to valuat th avrag valu of th right-hand sid of Conjctur 6.4a. Lt us put wp = φm 2 φdm. dm m p d m Numrically it sms that lim x wp =.644, πx with rathr fast convrgnc. W ar thus tmptd to propos th following conjctur. Conjctur 8.4. Lt C>0 b arbitrary. W hav C aany,hany p =2.644 Lix+O C x ln C x Although w cannot prov or vn compltly justify this at prsnt, w can stablish th following rsult. Lmma 8.5. For vry x sufficintly larg w hav.444 wp πx

29 SMALL CYCLES OF THE DISCRETE LOGARITHM 447 Tabl 8. Avrag solutions to F p a Prdictd approximat valus for πx g \ h ANY PR RP RPPR ANY A 2 A A 2 PR A A 2 A 2 A 2 RP A A 3 A 2 A 3 RPPR A 2 A 3 A 3 A 3 b Prdictd approximat numric valus for πx F p g \ h ANY PR RP RPPR ANY PR RP RPPR c Obsrvd valus for x = 643 g \ h ANY PR RP RPPR ANY PR RP RPPR πx Tabl 9. Avrag solutions to 3 a Prdictd approximat valus for th nontrivial part of Cp a \ h ANY PR RP RPPR ANY.644 A A A 3 PR A A 2 A 2 A 3 RP A A 2 A 2 A 3 RPPR A 3 A 3 A 3 A 3 b Prdictd approximat numric valus for th nontrivial part of Cp πx a \ h ANY PR RP RPPR ANY PR RP RPPR c Obsrvd valus for th nontrivial part for x = 643 a \ h ANY PR RP RPPR ANY PR RP RPPR

30 448 JOSHUA HOLDEN AND PIETER MOREE πx Tabl 0. Avrag solutions to 2 a Prdictd approximat valus for th nontrivial part of T p g \ h ANY PR RP RPPR ANY A 2 A A 3 PR A A 2 A 2 A 3 RP A A 3 A 2 A 4 RPPR A 2 A 3 A 3 A 4 b Prdictd approximat numric valus for th nontrivial part of T p πx g \ h ANY PR RP RPPR ANY PR RP RPPR c Obsrvd valus for th nontrivial part for x = 643 g \ h ANY PR RP RPPR ANY PR RP RPPR Proof. Not that m p φm 3 m 2 d p m φd d 2 wp m p φm d p m 2 φd, d whr th first inquality, by th way, is xact if is squarfr. Th rsult now follows on invoking Lmma 7.0 and Lmma Conclusion and futur work Most of th thorms of Sction 4 suffr from an rror trm that is largr than th main trm. This sms to b a dirct consqunc of th us of Lmma 2.7 and may b unavoidabl. Howvr, w hav shown that w can put som limits on how oftn th rror actually approachs th worst cas, and w hav conjcturd that vn bttr limits xist. Th bst nxt stp may b furthr data collction in ordr to mpirically count th numbr of prims with th potntial for larg rrors. W hav bgun to put our conjcturs on a firm footing, driving thm from as fw huristics as possibl. W hop to b abl to prov ths huristics in th futur. Thn w should b abl to convrt th conjcturs into thorms by mrly stimating th rror trm. Th projct of xtnding our analysis to thr-cycls and mor gnrally k-cycls for small valus of k, mntiond in [6], still rmains to b don. Along similar lins, Igor Shparlinski has suggstd attmpting to analyz th avrag lngth of a cycl,

31 SMALL CYCLES OF THE DISCRETE LOGARITHM 449 which could hav many practical applications in th analysis of cryptographically scur psudorandom bit gnrators, as mntiond in [6]. Acknowldgmnts Onc again, th first author would lik to thank th popl mntiond in [6]: John Rickrt, Igor Shparlinski, Mariana Campbll, and Carl Pomranc. H would also lik to thank Victor Millr for th suggstion to us th Smith Normal Form. Both authors would lik to thank th anonymous rfrs for many hlpful commnts. Rfrncs. Campbll, Mariana, On fixd points for discrt logarithms, Mastr s Thsis, Cristian Cobli and Alxandru Zaharscu, An xponntial congrunc with solutions in primitiv roots, Rv. Roumain Math. Purs Appl , MR d: Carl-Gustav Essn, A stochastic modl for primitiv roots, Rv. Roumain Math. Purs Appl , MR m:0 4. Étinn Fouvry, Théorèm d Brun-Titchmarsh: Application au théorèmdfrmat, Invnt. Math , MR g: Richard K. Guy, Unsolvd problms in numbr thory, Springr-Vrlag, 98. MR k: Joshua Holdn, Fixd points and two-cycls of th discrt logarithm, Algorithmic numbr thory ANTS 2002 C. Fikr and D. Kohl, ds. LNCS, Springr, 2002, pp MR , Addnda/corrignda: Fixd points and two-cycls of th discrt logarithm, 2002, unpublishd 8. Mark Kac, Statistical indpndnc in probability, analysis and numbr thory, Th Carus Mathmatical Monographs, vol. 2, Mathmatical Association of Amrica, 959. MR004 22: Pitr Mor and Ptr Stvnhagn, A two-variabl Artin conjctur, J. Numbr Thory , MR k:88 0., Prim divisors of th Lagarias squnc, J.Théor. Nombrs Bordaux 3 200, MR c:06. Pitr Mor, Approximation of singular sris and automata, Manuscripta Math , MR f:204 2., Asymptotically xact huristics for nar primitiv roots, J. Numbr Thory , MR m:6 3. Pitr Mor, An xponntial congrunc with solutions in primitiv roots rviw, Mathmatical Rviws MR d: Carl Pomranc, Prsonal communication. 5. Karl Prachar, Primzahlvrtilung, Springr, 957. MR :393b 6. P.J. Stphns, An avrag rsult for Artin s conjctur, Mathmatika6 969, MR : , Prim divisors of scond ordr linar rcurrncs I, II, J. Numbr Thory 8 976, , MR :542; MR : Wn Png Zhang, On a problm of Brizolis, Pur Appl. Math. 995, 3. MR d:099 Dpartmnt of Mathmatics, Ros-Hulman Institut of Tchnology, Trr Haut, Indiana, addrss: holdn@ros-hulman.du Max-Planck-Institut für Mathmatik, Vivatsgass 7, D-53 Bonn, Grmany addrss: mor@mpim-bonn.mpg.d URL: