Factor the modulus

Question

I've been hitting myself in the head trying to figure this problem out, but no luck so far. Let $N$ be an integer that equals the product of two odd primes, and $\gcd(a, N) = 1$ (i'll specify $a$ in a bit). Suppose I knew how to find all four solutions to $x^2 \equiv a \mod N$ for some $a$. How can I factor $N$ with this assumption?

This is the second part of a homework question, but I asked about a homework question (1st part) earlier today (maybe it'll help with this problem)

Perfect square modulo $n = pq$

So far, i've been trying different examples, but I haven't seen a consistent pattern. What I do see is that the four solutions have to do with the factors of $N$, where in some examples I did, subtracting two solutions gave me a factor of $N$.

One example I did:

Primes: 3 and 5

The problem: $x^2 \equiv a \mod N$

The only possible $a$ values with solutions are $1$ and $4$ mod 15.

When $a = 1$, I found that my solutions are 1, 4, 11, 14 mod 15.

When $a = 4$, my solutions are $2, 7, 8, 13$.

I did it for other 2 distinct odd primes, but they did not provide me with an insight.

Thanks.

Answer 1

Hint $\ $ It is a special case of the following

Theorem $\;$ One may factor $\rm m>1\:$ given a polynomial with more roots mod $\rm\: m\:$ than its degree, viz. suppose that, mod $\rm m,\;$ a polynomial $\rm\: f(x)\ne 0\:$ has degree $\rm\:n\:$ but has $\rm\:n\!+\!1 \:$ distinct roots $\rm\:r_{\,i}.\:$ Then one of $\rm\;gcd(m,\:r_{\:i} - r_{\:j}),\; i\ne j \:$ must yield a proper factor of $\rm\:m.\;$ For if that failed, then all of the gcds must be improper so $1,\:$ not $\rm\;m, \;$ since $\rm\; i\ne j\,\Rightarrow\, r_{\:i} \not\equiv r_{\:j}\ (mod\ m). \,$ Induction using Factor Theorem yields $\rm\;f(x) = (x-r_1)\cdots(x-r_{n+1})\; g(x),\;\; g(x) \ne 0 \;\;$ contra $\rm\;\:\deg\: f = n. \,$

Example $\rm\;(deg\ f = 1)\;\:$ Suppose, mod $\rm\:m,\:$ that $\rm\; 0 \:\ne\: f \:=\: a\:x\;$ has a "nontrivial" root $\rm\: b\ne 0\:$. Then $\:\rm gcd(m,b)\:$ is a proper factor of $\rm\: m\:.\ $ More directly: $\rm\; m\:|\:ab\:,\;$ not $\rm\; m|a\;\:$ nor $\rm\: m|b \,$ $\Rightarrow$ $\rm\, gcd(m,b)\;$ is a proper factor of $\rm\:m\:,\:$ i.e. if $\rm\: m\:$ fails the Prime Divisor Property then $\rm\: m\:$ is "constructively" composite.

Example $\rm\;(deg\ f = 2)\;\:$ Suppose, mod $\rm\:m\:$, that $\rm\; x^2 = 1\;$ has a "nontrivial" square root $\rm\: b\ne \pm1\:$. Then $\;\rm gcd(m,b\pm 1)\;$ yields a proper factor of $\rm\: m\:$ when $\rm\: m\:$ is odd. This idea lies at the heart of many integer factorization algorithms.

The above proof easily extends to yield a proof of the following

Theorem $\ $ Ring $\rm\: R\:$ is a domain $\iff\:$ every $\rm 0 \ne f\in R[x]\:$ has at most $\rm\: deg\ f\:$ roots in $\rm R$

Proof $\ $ $(\Rightarrow)\;$ Employ induction on the polynomial degree, as in the proof of the above Theorem. $(\Leftarrow)\ \ $ If $\rm\; a \ne 0\;$ then the polynomial $\rm\: a\,x\:$ has only the root $\rm\; x = 0,\:$ hence $\rm\ ab = 0 \ \Rightarrow\ b = 0\:,\:$ therefore $\rm\: R\:$ has no zero divisors.