2

I would like to find small $b$ such that $$ b^e\equiv1\pmod m $$ for a given $e$ and $m$. (In my application, $m$ is the square of a prime.) How can I find such $b$? (Say, the first 10 or 100.)

I'm interested in something practical for $e$ with 10-20 digits and $m$ with 20-40 digits.

Feel free to close this as a duplicate if you can find the right question!

Bill Dubuque
  • 272,048
Charles
  • 32,122
  • Probably hard to find small $b$ with this property, for general $e.$ Even the case $e=2$ seems to require a prime factorization of $m,$ and even then seems to require you to compute most of the $2^k$ different values, where $k$ is the number of prime factors of $m.$ – Thomas Andrews Jul 13 '22 at 20:06
  • Are you familiar with Euler's theorem: $b^{\phi(m)}=1 \pmod m, \gcd(b,m)=1$ (https://en.wikipedia.org/wiki/Euler%27s_theorem)? – Steven Clark Jul 13 '22 at 20:18
  • @ThomasAndrews I have a factorization of $m$ (and for $m$ so small, it's not hard to factor it without knowledge). For this particular application, $m=p^2$ for a prime $p$. – Charles Jul 13 '22 at 20:20
  • You should add the $m=p^2$ comment to the question, that greatly reduces the question. But I’m still suspicious that there wont be a good solution other than enumerating most values – Thomas Andrews Jul 13 '22 at 20:22
  • @ThomasAndrews I did mention it in the question, though I am also interested in the general composite case. – Charles Jul 13 '22 at 20:23
  • For the case $m=p^2$, $\phi(m)=p^2 \left(1-\frac{1}{p}\right)$. More generally $\phi(m)=m \prod_{p|m} \left(1-\frac{1}{p}\right)$. If $gcd(b,m)\ne 1$ there is no solution. If $gcd(b,m)=1$ then $e=\phi(m)$ is always a solution, and sometimes divisors of $\phi(m)$ are also a solution. – Steven Clark Jul 13 '22 at 20:31
  • @StevenClark $m$ and $e$ are given, not $b$. – Charles Jul 13 '22 at 20:33
  • Let me give an example with small numbers. Say $m=19^2$ and $e=18$. Then the $b$ that work are 1, 28, 54, 62, 68, 69, 99, 116, 127, 234, 245, 262, 292, 293, 299, 307, 333, 360 mod $19^2$. – Charles Jul 13 '22 at 20:35
  • For $m=19^2=361$, $\phi(m)=342$ and $342=18\times19$, so $e=18$ will work for some but not all values of $b$ where $gcd(b,361)=1$. All divisors of $342$ have some solutions, but $e=342$ works for every $b$ where $gcd(b,361)=1$. – Steven Clark Jul 13 '22 at 20:47
  • @StevenClark The whole question is: how to find the (small instances of) "some but not all" when $m$ and $e$ are relatively large? – Charles Jul 13 '22 at 20:48
  • My point is that first you need to understand the necessary conditions for $b^e\equiv1\pmod m$. You can't just select random values of $e$ and $m$ and expect to find solutions. – Steven Clark Jul 13 '22 at 20:51
  • @StevenClark I do, and the given $m$ and $e$ meet the conditions. (If they didn't, the question would be trivial: no solutions exist.) I'm just trying to find the possible values of $b$ when $m$ is too large to checking all values. – Charles Jul 13 '22 at 20:53
  • I kinda want to be cheeky and say that the answer is always $1$, but seriously, I can't really think of a way to make this simpler than iterating over possible values of $b$. It's the same difficulty as finding the order mod $m$, and I don't think we have tools much better than iteration for that.----Of course there are some "common sense" things to note. $b^e>p^2 \implies \log_b e>2log_b p$, so small bases require larger exponents in general. You can skip checking $b=2$ for any $e$ with fewer bits than $p$, etc. – Eric Snyder Jul 20 '22 at 20:55

0 Answers0