Factorization, Ideals and More Euclid!

Factorization, Ideals and More Euclid!
Page content

The previous entry ended with a bit of a cliffhanger. We explained the math of the Euclidean Algorithm and then followed that up with a Python implementation for the integers. However, we didn’t prove that the algorithm actually returns a greatest common divisor. We’ll do that right now.

Theorem: Correctness of The Euclidean Algorithm

The Euclidean Algorithm returns the greatest common divisor of the two input elements.

Proof

We’ll be referencing the Euclidean Algorithm as implemented in the previous entry. Follow the above link for definitions of the variables we’ll be using.

We noted in the previous entry that

xi+2=xifixi+1

which, when combined with this mini-lemma “divisor across a sum” tells us that if d|xi and d|xi+1, then d|xi+2.

Applying induction, we see that anything which divides x0 and x1 will also divide all the other xi’s.

Let j+2 be the index such that xj+2=0. Then the algorithm returns xj+1. From what we said in the previous paragraph, xj+1 is a multiple of the gcd of the input, a and b.

Now we show that xj+1 divides the gcd of a and b, so they are equal (up to multiplication by units).

Since xj+2=0 and

xj+2=xjfjxj+1

We see that xj+1 divides xj and, again, by the “divisor across a sum” lemma, we have xj+1 divides xi for all of the i’s down to i=0. Thus, xj+1 divides a and b, and therefore will divide their greatest common divisor.

QED


In the previous entry, we gave a definition for irreducible element and ring norm. We then showed that having a ring norm implies that we can factor elements into irreducibles. Now we’re going to show that having a norm map does not guarantee unique factorization. This will also provide us an example of irreducible elements which are not prime.

This is a classic example; it’s fairly simple and is found in many text books.

Example: Irreducibles which aren’t prime

Let R=Z[5], the set of complex numbers of the form

{a+b5|a,bZ}

We can then define N:RZ0 such that

N(a+b5):=a2+5b2

Notice that

N(a+b5)=(a+b5)(ab5)

so if

x=a+b5

and we let

x¯=ab5

then

N(x)=xx¯

Now we want to show that

xy=x¯y¯

which can be done by calculating the left-hand and the right-hand side of the above equation. If

x=a+b5y=c+d5

then both sides evaluate to

ac5bd(ad+bc)5

so the result holds. Now we can more easily prove that N(xy)=N(x)N(y), because

N(xy)=(xy)(xy)=(xy)(x¯y¯)=(xx¯)(yy¯)=N(x)N(y)

Finally, we have to show that N(x)=1 if and only if x is a unit. It’s clear that N(1)=1. Suppose that xy=1. Then we’ve shown that N(x)N(y)=1. Therefore, N(x)=1. So if x=a+b5, then we have

a2+5b2=1

Thus, b=0 and a=1. This means that 1 is the only unit in R.

This means that N is, indeed, a norm map, so every element of R can be factored into irreducibles.

We will now show that 2, 3, 1+5 and 15 are all irreducible.

Notice that

N(2)=4N(3)=9N(1+5)=6N(15)=6

so if an element is a proper divisor of any of them, then its norm must either be 2 or 3. However, it’s not difficult to see that no element has either value as its norm, because then we’d have a2+5b2=2 or 3.

Finally, notice that

6=23=(1+5)(15)

so we’ve factored 6 into irreducibles in two distinct ways. From this we see that, for example, 2 cannot be prime, since it divides 6=(1+5)(15), but 21+5 and 215.


One of the most important lessons to take away from that example is that we have to be careful with factorization. We cannot assume unique factorization, even if we have a norm map (and thus factorization into irreducibles).

You should also note that our proof that N:Z[5]Z0 is a norm map works for every square-free negative integer, n. I.e.

N:Z[n]Z0

where

N(a+bn)=a2+nb2

is a norm map.

We’re now going to introduce a kind of ring which always has unique factorization (by definition).

Definition: Unique Factorization Domain

Let R be a commutative integral domain such that every element of R can be factored into irreducibles. Further suppose that for any element xR, if we have

x=qSUqandx=qTVq

where each element of S and T is irreducible and each element of U and V is a unit, then there exists a bijection

f:ST

where f(q)uq, for all qS. What this means is that the elements of S and T are the same “up to multiplication by units.”

When this happens, R is said to be a Unique Factorization Domain.

Unique Factorization Domains are often abbreviated as “UFD’s”.

Lemma: Factorization into Primes is Unique

Lat R be a commutative integral domain with identity, such that every element can be factored into units and prime elements. Then R is a UFD.

Proof

The proof is little more than induction applied to the definition of a prime element. Let

x=ui=1mqi=vj=1npj

be two factorizations of an arbitrary non-zero non-unit element x, where u and v are units and qi and pj are prime elements. Then we have q1|pj for some j.

q1|pj implies q1d=pj, and since pj is prime, we know that either pj|d or pj|q1. Suppose that pj|d. Then

d|pj|d

so pjud, which means that q1 is a unit. This contradict our assumption that q1 is prime.

Then, a similar argument shows that d must be a unit, so q1upj. We can continue this for q2, q3, … , qm. When we’ve done this, we have to have m=n, otherwise we would have a product of primes equal to a unit, which cannot happen.

Thus, we see that each qi is equal to some pj times a unit.

QED

Definition: Principal Ideal Domain

Let R be a commutative integral domain with identity such that for any ideal, IR, we have I=x, for some xR. Then R is said to be a Principal Ideal Domain.

I.e. every ideal of R is generated by a single element of R.

Principal Ideal Domains are often abbreviated as “PID’s”.

Theorem: A PID is a UFD

Let R be a Principal Ideal Domain, then R is a Unique Factorization Domain.

The proof will involve several steps. We would typically break them down into lemmas and “mini-lemmas”, but here we’ll simply include them as different parts of one proof.

Proof

Part 1: Let {In}i=1, where IiIi+1 be an increasing sequence of ideals of R, then J:=i=1Ii is an ideal of R. (This result holds for an arbitrary ring)

Proof: Let x and y be in J, then there are indices m and n, such that xIm and yIn, so x+yImax(m,n), and thus x+yJ. We can similarly show that for any xJ and rR, we have rxJ. So part 1 holds.

Part 2: Since R is a PID, any infinite increasing sequence of ideals, {Ii}i=1 will have an NN, such that jN implies that Ij=IN.

Proof: By the previous paragraph’s result, we know that i=1Ii is an ideal of R. Since R is a PID, i=1=x, for some xR. Then there must be an NN, such that xIN. This establishes part 2.

Part 3: Every non-zero, non-unit element of R can be factored into irreducible elements.

Proof Suppose not, then let r0=r1y1, where at least one of r1 and y1 is neither a unit nor irreducible. Without loss of generality, let’s let that be y1. Then, we can repeat this process and express y1=r2y2, where we can let y2 be neither a unit nor irreducible. We can repeat this process arbitrarily often, so that we get

r0=(i=1m+1ri)ym+1

for any mN>0

but this generates a sequence of strictly increasing ideals, {Im}m=1, where

Im:=r0i=1mri

which contradict part 2. This establishes part 3.

Part 4: Let rR be irreducible, then rI implies either I=r or I=R. (This means that r is a maximal ideal).

Proof: Since R is a PID, we know that I=x for some xR. That means that r=yx, for some yR (because rx). Since r is irreducible, x is either a unit or irreducible. If x is a unit, then x=R. On the other hand, if x is not a unit, then y must be a unit, so x=ry1, which implies that xr. This implies that x=r. This establishes part 4.

Part 5: Irreducible elements of R are prime.

Proof: Suppose r is an irreducible element of R and that r=xy. Further, suppose that rx. Since rx, we know that xr, so x,rr. By part 4, this means that x,r=R, so we have

1=sx+tr

for some elements, s,tR. Multiplying through by y, we get

y=sxy+try

and since r=xy, this is equivalent to

y=sr+try

which means that

y=r(s+ty)

Thus, r|y and r is prime. This establishes part 5.

Since we’ve shown that every element of R can be factored into primes, we have unique factorization.

QED

Theorem: A Euclidean Domain is a PID

Let R be a Euclidean Domain, then R is a Principal Ideal Domain.

Proof

Let N:RZ0 be the map, such that for any pair of non-zero elements, a,bR, we have a=bq+r, where N(r)<N(b), for some q and r in R. We are guaranteed such a map, since R is a Euclidean Domain

Let I be an arbitrary ideal of R. Let x be an element of I, such that

yIN(x)N(y)

We claim that I=x. Suppose, for a contradiction, that xI, and let zI, but zx. Then there are elements q and rR, such that z=qx+r, and N(r)<N(x). However, if xI and zI, then r=zqx is also in I, but that’s impossible, since N(r)<N(x). This contradicts the minimality of N(x) in I.

QED

Combining the last two theorems, we see that every Euclidean Domain has unique factorization.

Letting N:ZZ0, where N(n)=|n|, we immediately see that Z is a Euclidean Domain… Whew! It’s a good thing, too, because our implementation of the Euclidean Algorithm depended on that!


RSA Encryption Algorithm

We’re now going to take a slight detour for the remainder of this entry to discuss the RSA encryption algorithm. Don’t worry, we’ll actually develop a little bit more ring theory along the way.

It works by starting with two distinct prime numbers, let’s call them p and q. Then we consider the ideal, pqZ. That ideal is the kernel of a homomorphism,

ψ(n):=nmodpqZ

where n represents an entire coset of the ideal. The image of ψ is a finite ring of order pq, it is often written,

Z/pqZ

or more succinctly as Zpq. Since Z is commutative, Z/pqZ is also commutative. However, it is not an integral domain. For example, notice that ψ(p) and ψ(q) are both zero divisors, since ψ(p)ψ(q) is equal to

ψ(pq)=pqmodpqZ=0

So, clearly, not every element of Z/pqZ is a unit. However, there are some units.

Let xZ/pqZ. We want to find a yZ/pqZ, such that xy=1Z/pqZ. Notice that if we use our Extended Euclidean Algorithm, and set a=pq and b=x, then we get s, t, and gcd(pq,x), where

spq+tx=gcd(pq,x)

so, if gcd(pq,x)=1, then

tx1modpqZ

This means that x is a unit exactly when gcd(pq,x)=1. We showed that the set of units of a ring is a group under multiplication. We’ll denote it, “U.”

Let’s figure out how many elements there are in U. We’ll do it by first counting all of the elements which aren’t units. Suppose wZ/pqZ is not a unit. Then gcd(w,pq)>1, which means there are three possibilities.

  1. gcd(w,pq)=p
  2. gcd(w,pq)=q
  3. gcd(w,pq)=pq

How many elements satisfy 1? The only possible elements are: p, 2p, 3p, …, (q1)p. I.e. there are q1 such elements.

A similar count shows that there are p1 elements that satisfy 2.

There is exactly one element, pq=0modpqZ that satisfies 3.

Adding them all up, we have

(p1)+(q1)+1=p+q1

non-units. Which means that everything else is a unit. I.e. there are

pq(p+q1)=(p1)(q1)

units. That is, |U|=(p1)(q1). This is a crucial calculation for the RSA algorithm.

Here’s how RSA works. There are two communicators, “Alice” and “Bob” (They’re pretty much always given those names).

  1. Before they start communicating, Alice picks two “large” prime numbers, p and q. Then she multiplies them together to get N=pq. She then calculates m=(p1)(q1), and chooses a third number, e, such that gcd(e,m)=1 (e needs to be larger than 1. It can be fairly large, but doesn’t have to be absolutely huge). She also calculates t, such that

et1modm

with the extended euclidean algorithm. This means that

et=mk+1

for some integer, k.

  1. She then publishes N=pq and e. However, she keeps, t and m a secret!

If Bob wants to communicate a secret with Alice, he then somehow encodes it as a number, c, which should really be thought of as an element of Z/pqZ. This means that 0c<pq. Then,

  1. Bob then calculates ce mod N and communicates it to Alice somehow.

  2. Alice receives the message and computes

(ce)tmodN

Let’s see what that gets her. Recall that cU, the group of units of Z/pqZ. Therefore, c, the subgroup generated by c (defined in an earlier entry) will have an order which divides the size of U by Lagrange’s Theorem.

Let’s call the order of cU, h. We then have h|m=|U| (By Lagrange’s Theorem), so hd=m, for some integer, d. This means that

cm=chd=(ch)d=1d=1

which means that

(ce)t=cet=cmk+1=cmkc=(cm)kc=1kc=c

Thus, Alice get’s Bob’s message back!

There’s just one fairly large detail we haven’t addressed, and that is this: what happens if t is huge? There’s a trick that can be used, and it’s Repeated Squaring. It allows Alice to calculate (ce)t with roughly log2(t) multiplications. We’ll cover it in the next entry. We’ll also go into more of the math of why RSA seems to be a good Public Key Encryption system for sending small payloads.

That’s all for this entry. Thanks for reading!!