Quadratic residue


In number theory, an integer q is called a quadratic residue modulo n if it is congruent to a perfect square modulo n; i.e., if there exists an integer x such that:
Otherwise, q is called a quadratic nonresidue modulo n.
Originally an abstract mathematical concept from the branch of number theory known as modular arithmetic, quadratic residues are now used in [|applications] ranging from acoustical engineering to [|cryptography] and the factoring of large numbers.

History, conventions, and elementary facts

, Euler, Lagrange, Legendre, and other number theorists of the 17th and 18th centuries established theorems and formed conjectures about quadratic residues, but the first systematic treatment is § IV of Gauss's Disquisitiones Arithmeticae. Article 95 introduces the terminology "quadratic residue" and "quadratic nonresidue", and states that if the context makes it clear, the adjective "quadratic" may be dropped.
For a given n a list of the quadratic residues modulo n may be obtained by simply squaring the numbers 0, 1,...,. Because a2 ≡ 2, the list of squares modulo n is symmetrical around n/2, and the list only needs to go that high. This can be seen in the table [|below].
Thus, the number of quadratic residues modulo n cannot exceed n/2 + 1 or /2.
The product of two residues is always a residue.

Prime modulus

Modulo 2, every integer is a quadratic residue.
Modulo an odd prime number p there are /2 residues and /2 nonresidues, by Euler's criterion. In this case, it is customary to consider 0 as a special case and work within the multiplicative group of nonzero elements of the field Z/pZ.
Following this convention, the multiplicative inverse of a residue is a residue, and the inverse of a nonresidue is a nonresidue.
Following this convention, modulo an odd prime number there are an equal number of residues and nonresidues.
Modulo a prime, the product of two nonresidues is a residue and the product of a nonresidue and a residue is a nonresidue.
The first supplement to the law of quadratic reciprocity is that if p ≡ 1 then −1 is a quadratic residue modulo p, and if p ≡ 3 then −1 is a nonresidue modulo p. This implies the following:
If p ≡ 1 the negative of a residue modulo p is a residue and the negative of a nonresidue is a nonresidue.
If p ≡ 3 the negative of a residue modulo p is a nonresidue and the negative of a nonresidue is a residue.

Prime power modulus

All odd squares are ≡ 1 and thus also ≡ 1. If a is an odd number and m = 8, 16, or some higher power of 2, then a is a residue modulo m if and only if a ≡ 1.
For example, mod the odd squares are
and the even ones are

So a nonzero number is a residue mod 8, 16, etc., if and only if it is of the form 4k.
A number a relatively prime to an odd prime p is a residue modulo any power of p if and only if it is a residue modulo p.
If the modulus is pn,
Notice that the rules are different for powers of two and powers of odd primes.
Modulo an odd prime power n = pk, the products of residues and nonresidues relatively prime to p obey the same rules as they do mod p; p is a nonresidue, and in general all the residues and nonresidues obey the same rules, except that the products will be zero if the power of p in the product ≥ n.
Modulo 8, the product of the nonresidues 3 and 5 is the nonresidue 7, and likewise for permutations of 3, 5 and 7. In fact, the multiplicative group of the non-residues and 1 form the Klein four-group.

Composite modulus not a prime power

The basic fact in this case is
Modulo a composite number, the product of two residues is a residue. The product of a residue and a nonresidue may be a residue, a nonresidue, or zero.

For example, from the table for modulus 6
1, 2, 3, 4, 5.
The product of the residue 3 and the nonresidue 5 is the residue 3, whereas the product of the residue 4 and the nonresidue 2 is the nonresidue 2.

Also, the product of two nonresidues may be either a residue, a nonresidue, or zero.

For example, from the table for modulus 15
1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14.
The product of the nonresidues 2 and 8 is the residue 1, whereas the product of the nonresidues 2 and 7 is the nonresidue 14.

This phenomenon can best be described using the vocabulary of abstract algebra. The congruence classes relatively prime to the modulus are a group under multiplication, called the group of units of the ring Z/nZ, and the squares are a subgroup of it. Different nonresidues may belong to different cosets, and there is no simple rule that predicts which one their product will be in. Modulo a prime, there is only the subgroup of squares and a single coset.
The fact that, e.g., modulo 15 the product of the nonresidues 3 and 5, or of the nonresidue 5 and the residue 9, or the two residues 9 and 10 are all zero comes from working in the full ring Z/nZ, which has zero divisors for composite n.
For this reason some authors add to the definition that a quadratic residue a must not only be a square but must also be relatively prime to the modulus n.
Although it makes things tidier, this article does not insist that residues must be coprime to the modulus.

Notations

Gauss used and to denote residuosity and non-residuosity, respectively;
Although this notation is compact and convenient for some purposes, a more useful notation is the Legendre symbol, also called the quadratic character, which is defined for all integers and positive odd prime numbers as
There are two reasons why numbers ≡ 0 are treated specially. As we have seen, it makes many formulas and theorems easier to state. The other reason is that the quadratic character is a homomorphism from the multiplicative group of nonzero congruence classes modulo to the complex numbers under multiplication. Setting allows its domain to be extended to the multiplicative semigroup of all the integers.
One advantage of this notation over Gauss's is that the Legendre symbol is a function that can be used in formulas. It can also easily be generalized to cubic, quartic and higher power residues.
There is a generalization of the Legendre symbol for composite values of, the Jacobi symbol, but its properties are not as simple: if is composite and the Jacobi symbol then, and if then but if we do not know whether or. For example: and, but and. If is prime, the Jacobi and Legendre symbols agree.

Distribution of quadratic residues

Although quadratic residues appear to occur in a rather random pattern modulo n, and this has been exploited in such applications as [|acoustics] and cryptography, their distribution also exhibits some striking regularities.
Using Dirichlet's theorem on primes in arithmetic progressions, the law of quadratic reciprocity, and the Chinese remainder theorem it is easy to see that for any M > 0 there are primes p such that the numbers 1, 2,..., M are all residues modulo p.
For example, if p ≡ 1,, and, then by the law of quadratic reciprocity 2, 3, 5, and 7 will all be residues modulo p, and thus all numbers 1-10 will be. The CRT says that this is the same as p ≡ 1, and Dirichlet's theorem says there are an infinite number of primes of this form. 2521 is the smallest, and indeed 12 ≡ 1, 10462 ≡ 2, 1232 ≡ 3, 22 ≡ 4, 6432 ≡ 5, 872 ≡ 6, 6682 ≡ 7, 4292 ≡ 8, 32 ≡ 9, and 5292 ≡ 10.

Dirichlet's formulas

The first of these regularities stems from Peter Gustav Lejeune Dirichlet's work on the analytic formula for the class number of binary quadratic forms. Let q be a prime number, s a complex variable, and define a Dirichlet L-function as
Dirichlet showed that if q ≡ 3, then
Therefore, in this case, the sum of the quadratic residues minus the sum of the nonresidues in the range 1, 2,..., q − 1 is a negative number.

For example, modulo 11,
In fact the difference will always be an odd multiple of q if q > 3. In contrast, for prime q ≡ 1, the sum of the quadratic residues minus the sum of the nonresidues in the range 1, 2,..., q − 1 is zero, implying that both sums equal.
Dirichlet also proved that for prime q ≡ 3,
This implies that there are more quadratic residues than nonresidues among the numbers 1, 2,..., /2.
For example, modulo 11 there are four residues less than 6, but only one nonresidue.

An intriguing fact about these two theorems is that all known proofs rely on analysis; no-one has ever published a simple or direct proof of either statement.

Law of quadratic reciprocity

If p and q are odd primes, then:
if and only if ) if and only if.
That is:
where is the Legendre symbol.
Thus, for numbers a and odd primes p that does not divide a:
aa is a quadratic residue mod p if and only ifaa is a quadratic residue mod p if and only if
1−1p ≡ 1
2p ≡ 1, 7 −2p ≡ 1, 3
3p ≡ 1, 11 −3p ≡ 1
4−4p ≡ 1
5p ≡ 1, 4 −5p ≡ 1, 3, 7, 9
6p ≡ 1, 5, 19, 23 −6p ≡ 1, 5, 7, 11
7p ≡ 1, 3, 9, 19, 25, 27 −7p ≡ 1, 2, 4
8p ≡ 1, 7 −8p ≡ 1, 3
9−9p ≡ 1
10p ≡ 1, 3, 9, 13, 27, 31, 37, 39 −10p ≡ 1, 7, 9, 11, 13, 19, 23, 37
11p ≡ 1, 5, 7, 9, 19, 25, 35, 37, 39, 43 −11p ≡ 1, 3, 4, 5, 9
12p ≡ 1, 11 −12p ≡ 1

See also quadratic reciprocity.

Pairs of residues and nonresidues

Modulo a prime p, the number of pairs n, n + 1 where n R p and n + 1 R p, or n N p and n + 1 R p, etc., are almost equal. More precisely, let p be an odd prime. For i, j = 0, 1 define the sets
and let
That is,
Then if p ≡ 1
and if p ≡ 3
For example:
Modulo 17
Modulo 19
Gauss introduced this sort of counting when he proved that if p ≡ 1 then x4 ≡ 2 can be solved if and only if p = a2 + 64 b2.

The Pólya–Vinogradov inequality

The values of for consecutive values of a mimic a random variable like a coin flip. Specifically, Pólya and Vinogradov proved in 1918 that for any nonprincipal Dirichlet character χ modulo q and any integers M and N,
in big O notation. Setting
this shows that the number of quadratic residues modulo q in any interval of length N is
It is easy to prove that
In fact,
Montgomery and Vaughan improved this in 1977, showing that, if the generalized Riemann hypothesis is true then
This result cannot be substantially improved, for Schur had proved in 1918 that
and Paley had proved in 1932 that
for infinitely many d > 0.

Least quadratic non-residue

The least quadratic residue mod p is clearly 1. The question of the magnitude of the least quadratic non-residue n is more subtle, but it is always prime. The Pólya–Vinogradov inequality above gives O. The best unconditional estimate is n ≪ pθ for any θ>1/4, obtained by estimates of Burgess on character sums. On the assumption of the Generalised Riemann hypothesis, Ankeny obtained n ≪ 2. Linnik has shown that the number of p less than X such that n > Xε is bounded by a constant depending on ε.
Least quadratic non-residue mod p for odd primes p are:

Quadratic excess

Let p be an odd prime. The quadratic excess E is the number of quadratic residues on the range minus the number in the range . For p congruent to 1 mod 4, the excess is zero, since −1 is a quadratic residue and the residues are symmetric under r ↔ p−r. For p congruent to 3 mod 4, the excess E is always positive.

Complexity of finding square roots

That is, given a number a and a modulus n, how hard is it
  1. to tell whether an x solving x2 ≡ a exists
  2. assuming one does exist, to calculate it?
An important difference between prime and composite moduli shows up here. Modulo a prime p, a quadratic residue a has 1 + roots, or two if a R p and gcd
In general if a composite modulus n is written as a product of powers of distinct primes, and there are n1 roots modulo the first one, n2 mod the second,..., there will be n1n2... roots modulo n.
The theoretical way solutions modulo the prime powers are combined to make solutions modulo n is called the Chinese remainder theorem; it can be implemented with an efficient algorithm.
For example:

Prime or prime power modulus

First off, if the modulus n is prime the Legendre symbol can be quickly computed using a variation of Euclid's algorithm or the Euler's criterion. If it is −1 there is no solution.
Secondly, assuming that, if n ≡ 3, Lagrange found that the solutions are given by
and Legendre found a similar solution if n ≡ 5 :
For prime n ≡ 1, however, there is no known formula. Tonelli and Cipolla found efficient algorithms that work for all prime moduli. Both algorithms require finding a quadratic nonresidue modulo n, and there is no efficient deterministic algorithm known for doing that. But since half the numbers between 1 and n are nonresidues, picking numbers x at random and calculating the Legendre symbol until a nonresidue is found will quickly produce one. A slight variant of this algorithm is the Tonelli–Shanks algorithm.
If the modulus n is a prime power n = pe, a solution may be found modulo p and "lifted" to a solution modulo n using Hensel's lemma or an algorithm of Gauss.

Composite modulus

If the modulus n has been factored into prime powers the solution was discussed above.
If n is not congruent to 2 modulo 4 and the Kronecker symbol then there is no solution; if n is congruent to 2 modulo 4 and, then there is also no solution. If n is not congruent to 2 modulo 4 and, or n is congruent to 2 modulo 4 and, there may or may not be one.
If the complete factorization of n is not known, and and n is not congruent to 2 modulo 4, or n is congruent to 2 modulo 4 and, the problem is known to be equivalent to integer factorization of n.
The above discussion indicates how knowing the factors of n allows us to find the roots efficiently. Say there were an efficient algorithm for finding square roots modulo a composite number. The article congruence of squares discusses how finding two numbers x and y where and suffices to factorize n efficiently. Generate a random number, square it modulo n, and have the efficient square root algorithm find a root. Repeat until it returns a number not equal to the one we originally squared, then follow the algorithm described in congruence of squares. The efficiency of the factoring algorithm depends on the exact characteristics of the root-finder, but it will be efficient.

Determining whether a is a quadratic residue or nonresidue modulo n can be done efficiently for prime n by computing the Legendre symbol. However, for composite n, this forms the quadratic residuosity problem, which is not known to be as hard as factorization, but is assumed to be quite hard.
On the other hand, if we want to know if there is a solution for x less than some given limit c, this problem is NP-complete; however, this is a fixed-parameter tractable problem, where c is the parameter.
In general, to determine if a is a quadratic residue modulo composite n, one can use the following theorem:
Let, and. Then is solvable if and only if:
  • The Legendre symbol for all odd prime divisors p of n.
  • if n is divisible by 4 but not 8; or if n is divisible by 8.
Note: This theorem essentially requires that the factorization of n is known. Also notice that if, then the congruence can be reduced to, but then this takes the problem away from quadratic residues.

The number of quadratic residues

The list of the number of quadratic residues modulo n, for n = 1, 2, 3..., looks like:
A formula to count the number of squares modulo n is given by Stangl.

Applications of quadratic residues

Acoustics

have been based on number-theoretic concepts such as primitive roots and quadratic residues.

Graph theory

s are dense undirected graphs, one for each prime p ≡ 1, that form an infinite family of conference graphs, which yield an infinite family of symmetric conference matrices.
Paley digraphs are directed analogs of Paley graphs, one for each p ≡ 3, that yield antisymmetric conference matrices.
The construction of these graphs uses quadratic residues.

Cryptography

The fact that finding a square root of a number modulo a large composite n is equivalent to factoring has been used for constructing cryptographic schemes such as the Rabin cryptosystem and the oblivious transfer. The quadratic residuosity problem is the basis for the Goldwasser-Micali cryptosystem.
The discrete logarithm is a similar problem that is also used in cryptography.

Primality testing

is a formula for the Legendre symbol where p is prime. If p is composite the formula may or may not compute correctly. The Solovay-Strassen primality test for whether a given number n is prime or composite picks a random a and computes using a modification of Euclid's algorithm, and also using Euler's criterion. If the results disagree, n is composite; if they agree, n may be composite or prime. For a composite n at least 1/2 the values of a in the range 2, 3,..., n − 1 will return "n is composite"; for prime n none will. If, after using many different values of a, n has not been proved composite it is called a "probable prime".
The Miller-Rabin primality test is based on the same principles. There is a deterministic version of it, but the proof that it works depends on the generalized Riemann hypothesis; the output from this test is "n is definitely composite" or "either n is prime or the GRH is false". If the second output ever occurs for a composite n, then the GRH would be false, which would have implications through many branches of mathematics.

Integer factorization

In § VI of the Disquisitiones Arithmeticae Gauss discusses two factoring algorithms that use quadratic residues and the law of quadratic reciprocity.
Several modern factorization algorithms generate small quadratic residues in an attempt to find a congruence of squares which will yield a factorization. The number field sieve is the fastest general-purpose factorization algorithm known.

Table of quadratic residues

The following table lists the quadratic residues mod 1 to 75.
nquadratic residues mod nnquadratic residues mod nnquadratic residues mod n
1026, 1, 3,, 9,,,,,, 17,, 23, 2551, 1, 4,, 13,, 16,, 19,, 25,,,,,, 43, 49
2, 127, 1, 4, 7,, 10, 13, 16, 19, 22, 2552, 1,, 9,,,, 17, 25, 29,,,, 49
3, 128, 1,,, 9,,, 2553, 1, 4, 6, 7, 9, 10, 11, 13, 15, 16, 17, 24, 25, 28, 29, 36, 37, 38, 40, 42, 43, 44, 46, 47, 49, 52
4, 129, 1, 4, 5, 6, 7, 9, 13, 16, 20, 22, 23, 24, 25, 2854, 1,, 7,,, 13,, 19,, 25,,, 31,,, 37,, 43,, 49,
5, 1, 430, 1,,,,,,, 19,,, 55, 1, 4,, 9,, 14,, 16,,, 26, 31, 34, 36,,, 49
6, 1,, 31, 1, 2, 4, 5, 7, 8, 9, 10, 14, 16, 18, 19, 20, 25, 2856, 1,,, 9,, 25,,,,,
7, 1, 2, 432, 1,, 9,, 17, 2557, 1, 4,, 7,, 16,,, 25, 28,,,,, 43,, 49,, 55
8, 1, 33, 1,, 4,,,, 16,, 25,, 3158, 1,, 5,, 7, 9, 13,,,, 23,, 25,,,, 33,, 35,,,, 45, 49, 51,, 53,, 57
9, 1, 4, 734, 1,,,, 9, 13, 15,,,, 19, 21, 25,,,, 3359, 1, 3, 4, 5, 7, 9, 12, 15, 16, 17, 19, 20, 21, 22, 25, 26, 27, 28, 29, 35, 36, 41, 45, 46, 48, 49, 51, 53, 57
10, 1,,,, 935, 1, 4, 9, 11,,, 16,,, 29, 60, 1,,,,,,,,,, 49
11, 1, 3, 4, 5, 936, 1,,, 13,, 25, 61, 1, 3, 4, 5, 9, 12, 13, 14, 15, 16, 19, 20, 22, 25, 27, 34, 36, 39, 41, 42, 45, 46, 47, 48, 49, 52, 56, 57, 58, 60
12, 1,, 37, 1, 3, 4, 7, 9, 10, 11, 12, 16, 21, 25, 26, 27, 28, 30, 33, 34, 3662, 1,,, 5, 7,, 9,,,,, 19,, 25,,,, 33, 35,,, 39,, 41, 45, 47, 49,, 51,, 59
13, 1, 3, 4, 9, 10, 1238, 1,, 5,, 7, 9, 11,, 17,,, 23,, 25,,,, 35, 63, 1, 4,,, 16,, 22, 25,,, 37, 43, 46,, 58
14, 1,,,,, 9, 1139, 1,, 4,, 10,,, 16, 22, 25,,, 64, 1,, 9,, 17, 25, 33,, 41, 49, 57
15, 1, 4,,, 40, 1,, 9,,,,, 65, 1, 4, 9,, 14, 16,,, 29,,, 36,,, 49, 51,, 56, 61, 64
16, 1,, 941, 1, 2, 4, 5, 8, 9, 10, 16, 18, 20, 21, 23, 25, 31, 32, 33, 36, 37, 39, 4066, 1,,,,,,,, 25,, 31,,,, 37,,,, 49,,,,
17, 1, 2, 4, 8, 9, 13, 15, 1642, 1,,,,,,,,, 25,,,, 37, 67, 1, 4, 6, 9, 10, 14, 15, 16, 17, 19, 21, 22, 23, 24, 25, 26, 29, 33, 35, 36, 37, 39, 40, 47, 49, 54, 55, 56, 59, 60, 62, 64, 65
18, 1,, 7,,, 13, 43, 1, 4, 6, 9, 10, 11, 13, 14, 15, 16, 17, 21, 23, 24, 25, 31, 35, 36, 38, 40, 4168, 1,,, 9, 13,,, 21, 25,, 33,, 49,, 53,,
19, 1, 4, 5, 6, 7, 9, 11, 16, 1744, 1,, 5, 9,,,, 25,,, 3769, 1,, 4,,,, 13, 16,,, 25,, 31,,,,, 49, 52,, 55, 58, 64
20, 1,,, 9, 45, 1, 4,,, 16, 19,, 31, 34,, 70, 1,, 9, 11,,,,,, 29,,,, 39,,,,, 51,,,,
21, 1, 4,,,, 16, 46, 1,, 3,,,, 9,, 13,,,,, 25,, 27, 29, 31,, 35,, 39, 4171, 1, 2, 3, 4, 5, 6, 8, 9, 10, 12, 15, 16, 18, 19, 20, 24, 25, 27, 29, 30, 32, 36, 37, 38, 40, 43, 45, 48, 49, 50, 54, 57, 58, 60, 64
22, 1, 3,, 5, 9,,,, 15,, 47, 1, 2, 3, 4, 6, 7, 8, 9, 12, 14, 16, 17, 18, 21, 24, 25, 27, 28, 32, 34, 36, 37, 4272, 1,,,, 25,,,, 49,,
23, 1, 2, 3, 4, 6, 8, 9, 12, 13, 16, 1848, 1,,,, 25,, 73, 1, 2, 3, 4, 6, 8, 9, 12, 16, 18, 19, 23, 24, 25, 27, 32, 35, 36, 37, 38, 41, 46, 48, 49, 50, 54, 55, 57, 61, 64, 65, 67, 69, 70, 71, 72
24, 1,,,, 49, 1, 2, 4, 8, 9, 11, 15, 16, 18, 22, 23, 25, 29, 30, 32, 36, 37, 39, 43, 44, 4674, 1, 3,, 7, 9,, 11,,, 21, 25,, 27,,, 33,,,,,, 41,,, 47,, 49, 53,,, 63,, 65, 67,, 71, 73
25, 1, 4, 6, 9, 11, 14, 16, 19, 21, 2450, 1,,, 9, 11,,, 19, 21,,,, 29, 31,,, 39, 41,,, 4975, 1, 4,,, 16, 19,,,, 31, 34,,, 46, 49,,, 61, 64,,

x12345678910111213141516171819202122232425
x2149162536496481100121144169196225256289324361400441484529576625
mod 10000000000000000000000000
mod 21010101010101010101010101
mod 31101101101101101101101101
mod 41010101010101010101010101
mod 51441014410144101441014410
mod 61434101434101434101434101
mod 71422410142241014224101422
mod 81410141014101410141014101
mod 91407704101407704101407704
mod 101496569410149656941014965
mod 111495335941014953359410149
mod 121494101494101494101494101
mod 13149312101012394101493121010123941
mod 1414921187811294101492118781129
mod 1514911064461019410149110644610
mod 161490941014909410149094101
mod 171491682151313152816941014916821513
mod 18149167013109101307169410149167013
mod 19149166171175571117616941014916617
mod 20149165169410149165169410149165
mod 211491641571181616181715416941014916
mod 22149163145201512111215205143169410149
mod 23149162133181286681218313216941014
mod 241491611211694101491611211694101
mod 251491601124146021191921061424110169410