\section{Linear Algebra}
\par Before anything else, I strongly recommend watching a series of short videos that will give you a very graphical notion of Linear Algebra. That series of videos is \href{https://www.youtube.com/watch?v=fNk_zzaMoSs&list=PLZHQObOWTQDPD3MizzM2xVFitgF8hE_ab&index=1}{\uline{“Essence of linear algebra” by 3Blue1Brown}}.

\vspace{1cm}
\par Here will be presented a concise analysis of Linear Algebra topics ranging from:
\begin{itemize}
    \item various topics from one of the best resources to learn linear algebra, the MIT professor \textbf{Gilber Strang}'s \href{https://ocw.mit.edu/courses/mathematics/18-06-linear-algebra-spring-2010/video-lectures/}{\uline{lectures}}
    \item a summary of the above course can be found in \href{https://medium.com/sho-jp/towards-understanding-linear-algebra-part-1-d43710535503}{\ul{here}}
    by Sho Nakagome (``A neuroengineer researching Brain Computer Interface (BCI)'');
    \item geometric interpretations on a basic matrix, from \href{https://www.coranac.com/documents/geomatrix/}{\ul{here}};
    \item orthogonality, from MIT \href{https://ocw.mit.edu/courses/mathematics/18-06sc-linear-algebra-fall-2011/least-squares-determinants-and-eigenvalues/orthogonal-vectors-and-subspaces/MIT18_06SCF11_Ses2.1sum.pdf}{\ul{here}};
    \item important information for Signal Processing and various other applications.
\end{itemize}

\subsection{What is a matrix?}
\par We know what a matrix looks like, but what it is exactly?
\par Well, it can be seen as a group of vectors, as an equation and probably as many other things I haven't figured out yet.

\subsubsection{A system of Equations}
\par Let's start as seeing it as means of simplifying the process of solving a set of equations. Imagine that we have the following equations:

\begin{equation}
\begin{cases}
    3x + 5y = 11 \\
    x + 4y = 6
\end{cases}
\end{equation}

\par These can be written in matrix from like this:

\begin{equation}
    \begin{bmatrix}
        1 & 2 \\
        3 & 4
    \end{bmatrix}
    \begin{bmatrix}
        x \\
        y
    \end{bmatrix}
    =
    \begin{bmatrix}
        11 \\
        6
    \end{bmatrix}
\end{equation}

\par And solvable through the Row Echelon Form (REF):
\begin{equation} \label{eq:ref}
    \begin{bmatrix}[cc|c]
        3 & 5 & 11\\
        1 & 4 & 6
    \end{bmatrix}
    =
    \begin{bmatrix}[cc|c]
        1 & 4 & 6\\
        0 & -7 & -7
    \end{bmatrix}
    =
    \begin{bmatrix}[cc|c]
        1 & 4 & 6\\
        0 & 7 & 7
    \end{bmatrix}
\end{equation}

\par Is important to note that to obtain the REF, only \ul{elementary equation operations} can be used. These are the sum/subtraction of two equations, the multiplication of a equation by a scalar different from 0 and change the place of the equations. In the particular case of \eqref{eq:ref} the operations that took place were: row1 - 3*row2, switch rows and multiply the last row by -1.
\par From the our new form, is trivial to go back to the equation formula and directly attribute values to x and y. However, a few calculations are still required. The absolute best way is using the Reduced Row Echelon Form (RREF). This consists of using the rows with less elements to ``cut out'' elements from the other rows, leading to a very simplified matrix (see \eqref{eq:rref})

\begin{equation}\label{eq:rref}
    \begin{bmatrix}[cc|c]
        1 & 4 & 6\\
        0 & 7 & 7
    \end{bmatrix}
    =
    \begin{bmatrix}[cc|c]
        1 & 4 & 6\\
        0 & 1 & 1
    \end{bmatrix}
    =
    \begin{bmatrix}[cc|c]
        1 & 0 & 2\\
        0 & 1 & 1
    \end{bmatrix}
\end{equation}

\par Note that this RREF is unique and characterised by 1's in the diagonal and in stairs, i.e the only non-zero entry in that column starting with the leftmost column. In this form, all results can be obtained immediately.
\par However, putting a matrix in this form isn't always possible. For instance, is impossible to do so if two rows are \bb{linearly dependent} meaning that is possible to multiply a constant to one to obtain the other - seeing rows as equations, linear dependency can be thought of an equation that adds absolutely no other constraint to the solution set or, in other words, does the exact same as one equation that already exists thus can be discarded hence ending with more unknowns than equations.

\par Before further analysing the concept of linear dependency and all that derives from that, is pertinent to have yet another look at the matrix. A geometric interpretation is often useful.

\subsubsection{Vectors in Space}
\par Exactly, have you thought your matrix could be vectors in space?
\par Well, maybe this decomposition helps to thing about it:

\quickimage{./Images/algebra/1.jpeg}{.3}

\par Thus we can imagine the vectors (5,4) and (3,1) is space. And one solution to obtain the vector (11, 6) is by multiplying 2 by the first vector and 1 by the second.

\par Note that we broke the matrix in half and gave it a meaning: ``What do you have to multiply to this vector and to this vector to obtain the vector you want?'' Where the vectors were the columns of the matrix. And the solution were the x and the y that were going to scale those vectors.

\par One can also think, despite being a bit more complicated, that what we want is to write (11, 6) in the basis of those two vectors (3,1) and (5,4). This is how the matrix represents a transformation. We are transforming the "normal" into the space defined by those two vectors. Further note that that space is given by the column vectors of the matrix! This will be important in the future.
\par Let's have a look at basis and spaces.

\subsection{Basis, Spaces and Subspaces}

\par A space is nothing more than a set of vectors that can be obtained from a linear combination from vectors in the basis.

\par If we want to take a subset of a space that is also a space we call that a subspace.

\par About basis: these are the vectors which when linearly combined generate a certain space. Note that one space can have infinite many basis. Actually, any set of N linearly independent vectors from a space with dimension N is a basis of that space. A set of vectors is only considered a basis if it spans a space (all linear combinations of its vectors create a space) and the vectors in it are linearly independent.

\par A good image to describe what "span" is:

\quickimage{./Images/algebra/3.jpeg}{.3}

\subsubsection{Column Space or Range}

\par The range of A (ran(A)) is the space spanned by the columns of A.

\quickimage{./Images/algebra/2.jpeg}{.3}

\par As expected, the row space is nothing more than the exact same thing for the rows.

\subsubsection{Row Nullspace or Kernel}

\par The kernel of A (ker(A)) is the space created by the vectors that when A is applied to them the result is 0.
\par Mathematically, the nullspace of a is nothing more than the vectors $x$ that lead to $A x = 0$.
\par Note that that thinking from before as "what vectors should be multiplied to get a certain solution" will now have a problem: there can be more than one answer to the null result. This only happens if there is a problem with the transformation. If the transformation is well done (if the matrix has full rank), then the column subspace will be the full space and anything multiplied to the matrix will have one and only one solution. If the problem/matrix is ill-conditioned (the rank is less than the dimension of the vectors of the columns), then there can be more than one solution to a give problem.

\Vhrulefill
From an answer in \href{https://math.stackexchange.com/questions/987146/why-null-space-and-column-space/987657#987657}{\uline{math.stackexchange.com}}:
``Let's suppose that the matrix A represents a physical system. As an example, let's assume our system is a rocket, and A is a matrix representing the directions we can go based on our thrusters. So what do the null space and the column space represent?

Well let's suppose we have a direction that we're interested in. Is it in our column space? If so, then we can move in that direction. The column space is the set of directions that we can achieve based on our thrusters. Let's suppose that we have three thrusters equally spaced around our rocket. If they're all perfectly functional then we can move in any direction. In this case our column space is the entire range. But what happens when a thruster breaks? Now we've only got two thrusters. Our linear system will have changed (the matrix A will be different), and our column space will be reduced.

What's the null space? The null space are the set of thruster instructions that completely waste fuel. They're the set of instructions where our thrusters will thrust, but the direction will not be changed at all.''

\Vhrulefill

\par If you are someone with some linear algebra background you might have spotted some kind of connection between the null space and the column space. So it is worth to talk now about the rank and the relation these spaces.

\subsection{Rank and Spaces relationships}

\par The rank of the matrix is nothing more than the number of pivots in the Reduced Row Echelon Form.
\par Seeing a matrix as a set of equations with N variables, a full rank matrix has rank N meaning that is possible to discover the N variables without ambiguity. If the matrix is rank deficient or ill-ranked, that means we have too many unknowns for our equations.

\par Is common sense that if a matrix has more columns than rows, it won't have full rank as this is exactly the same as saying it will have more unknowns than equations.

\par In terms of the relations between the spaces: was it evident so far that the less precise is the matrix (the less rank it has compared to full rank), the more it will nullify vectors, in other words, take away their identity and the more vectors would the space that gets to zero have.

\par Therefore, the sum of the dimensions of the column span and nullsubspace should equal the rank that the matrix needs to be full rank, i.e the number of unknowns or simply the number of columns.

(there are a few more subspaces and we still need to explain the question that is asked every time.)


\documentclass[master.tex]{subfiles}
\setcounter{section}{1}

\newcommand{\poly}[3]{\sum_{#1=0}^#3 {#2}_{#1}x^{#1}}
\newcommand{\polyex}[2]{{#1}_#2 x^{#2} + {#1}_{#2-1}x^{#2-1} + \ldots + {#1}_1 x + {#1}_0}

\begin{document}
\section{Ring Theory}
\subsection{Basic Definitions}
\newcommand{\F}{\mathbb{F}} \newtheorem*{notation}{Notation}
% Lecture 10/27/2016

\begin{defn*}
  A \emph{ring} is set \(R\) together with two binary operations \(+\) and \(\cdot\) satisfying
  \begin{enumerate}[label=(\roman*)]
  \item \((R,+)\) is an abelian group (denote the additive identity by \(0\))
  \item \(\cdot\) is associative, \((xy)z=x(yz)\) for all \(x,y \in R\)
  \item There exists a multiplicative identity (denoted \(1 \in R\)).
  \item Distribution laws hold:
    \begin{align*}
      x(y+z) &= xy + xz\\
      (x+y)z &= xz+yz
    \end{align*}
  \end{enumerate}
\end{defn*}

\begin{defn*}
  A \emph{commutative ring} is a ring with the additional property that \(xy=yx\) for all \(x,y \in R\).
\end{defn*}
Notice that if multiplication is commutative either distribution law implies the other. One of the most basic
observations one can make is that \(R\) is the trivial ring \(\iff 1=0\).

\begin{example*}
  A few familiar rings: \[\Z,\Z_n,\Q,\R,\C\] A non-commutative ring:
  \[M_n(\F), n \ge 2\] or more generally take any ring \(R\).
\end{example*}

\begin{defn*}
  A \emph{skew field (or division ring)} is a ring \(R\) such that \(R \neq \{0\}\) and \(R \setminus \{0\}\) is a group
  under multiplication.
\end{defn*}

\begin{defn*}
  A \emph{field} is a commutative skew field.
\end{defn*}

\begin{example*}
  An example of a skew field is
  \[\H = \R + \R i + \R j + \R k\]
\end{example*}

One may form direct products of rings in the usual manner.

\begin{defn*}
  A \emph{ring homomorphism} is map \(\varphi \colon R \to S\) between rings \(R\) and \(S\) satisfying
  \begin{enumerate}[label=(\arabic*)]
  \item \(\varphi(x+y)=\varphi(x)+\varphi(y)\)
  \item \(\varphi(xy)=\varphi(x)\varphi(y)\)
  \item \(\varphi(1_R)=1_S\)
  \end{enumerate}
\end{defn*}

In keeping with our demand that all of rings have unity, we also force our homomorphisms to respect the unital
structure. In particular our ring homomorphisms are morphisms in the category of commutative rings.

\begin{example*}
  For us a map \funcdeclaration{\varphi}{R}{R \times R}{r}{(r,0)} is not a ring homomorphism as
  \(1_{R \times R} = (1,1)\) while \(\varphi(1)=(1,0)\).
\end{example*}

\begin{defn*}
  A subset \(S\) of a ring \(R\) is a \emph{subring} of \(R\) if
  \begin{enumerate}[label=(\arabic*)]
  \item \(S\) is closed under both operations
  \item \(1_R \in S\)
  \end{enumerate}
\end{defn*}

\begin{example*}
  Under this definition \(R \times \{0\}\) is not a subring of \(R \times R\) as \(1_R \not \in R \times R\) as long as
  \(R\neq\{0\}\).
\end{example*}

\begin{defn*}
  An element \(x \in R\) is said to be a \emph{zero divisor} of \(R\) if there exists an element \(y \in R\) such that
  \(y \neq 0\) and
  \[xy = 0 \qquad \text{ or } \qquad yx = 0.\]
\end{defn*}

\begin{defn*}
  The commutative ring \(R\) is an \emph{integral domain} if its only zero divisor is \(0\).
\end{defn*}

\begin{example*}
  \(\Z_n\) integral domain \(\iff n\) is prime
\end{example*}

\begin{prop*}
  \(R\) finite integral domain \(\implies\) \(R\) is field.
\end{prop*}

\begin{defn*}
  A \(x \in R\) is a \emph{unit} if \(xy=1\) and \(yx=1\).
\end{defn*}

\begin{defn*}
  The group of units \(R^\times\) of a ring is
  \[R^\times = \{x \in R \mid x\text{ is a unit}\}.\]
\end{defn*}

\begin{example*}
  \begin{align*}
    \Z^\times &= \{-1,1\}\\
    \Z_n^\times &= \{\bar{a} \mid (a,n)=1\}
  \end{align*}
\end{example*}

\begin{prop*}
  If \(\varphi \colon R \to S\) is a homomorphism and \(x \in R^{\times}\) then \(\varphi(x) \in S^\times\). In
  particular this means \(\varphi(R^\times) \le S^\times\).
\end{prop*}

Even if \(\varphi \colon R \twoheadrightarrow S\) the image \(\varphi(R^\times)\) might not equal \(S^\times\).

\begin{example*}
  Consider the surjective function \funcdeclaration{\varphi}{\Z}{\Z_n}{a}{\bar{a}} but \(|\Z_n^\times|=\varphi(n)>2\) if
  \(n \ge 7\)
\end{example*}

\begin{notation}
  From this point onwards \(R\) denotes a \textbf{commutative ring}.
\end{notation}

\begin{defn*}
  A non-empty subset \(I \subset R\) is an \emph{ideal} if
  \begin{enumerate}[label=(\roman*)]
  \item \(x,y \in I \implies x+y \in I \)
  \item \(x \in I, r \in R \implies rx \in I\)
  \end{enumerate}
\end{defn*}
Condition one may be rephrased as \((I,+)\) forms an abelian group.
\begin{prop*}
  An ideal \(I=R \iff 1 \in R \iff I \cap R^\times \neq \emptyset\)
\end{prop*}

\begin{notation}
  If \(I\) is an ideal of \(R\) we denote it as \(I \unlhd R\).
\end{notation}

\begin{prop}
  A ring homomorphism \(\varphi \colon R \to S\) if \(I \unlhd R\), \(J \unlhd S\) then
  \[\varphi(I) \unlhd S \iff \varphi \text{ is surjective }\]
  while
  \[\varphi^{-1} \unlhd R \text{ is always true.}\]
\end{prop}

\begin{defn*}
  Let \(I,J \unlhd R\) then we define
  \begin{align*}
    I+J &:= \{x+y \mid x \in I, y \in J\} \unlhd R\\
    IJ  &:= \left\{\sum_{l=0}^nx_l y_l \mid n \in \N, x_l \in I, y_l \in J\right\}.
  \end{align*}
\end{defn*}
We have defined \(IJ\) in the above manner to force \(IJ\) to be an abelian group, and hence an ideal.

\begin{defn*}
  Given an ideal \(I \unlhd R\) we may form the \emph{quotient ring} denote \(R/I\) as follows
  \[R/I = \{a+I\mid a \in R\}.\] This forms a ring under addition and multiplication by representatives.
\end{defn*}

\begin{thm}[Isomorphism Theorems For Rings] Given a ring homomorphism \(\varphi \colon R \to S\). Then
  \begin{enumerate}[label=(\alph*)]
  \item \(\varphi(R)\) is a subring of \(S\) and \(\ker(\varphi)=\{r \in R \mid \varphi(r)=0\} \unlhd R\)
  \item \(R/\ker \varphi \isom \varphi(R)\)
  \item \(I,J \unlhd R\) with \(I \subset J \implies\)
    \[J/I\unlhd R/I\] and
    \[(R/I)/(J/I) \isom R/S.\]
  \end{enumerate}
\end{thm}

\begin{prop}{Correspondence Theorem}
  Let \(I \unlhd R\) define \funcdeclaration{\pi}{R}{R/I}{a}{\bar{a}} Then there is a bijection
  \[\{J \unlhd R \mid I \subset J\} \longleftrightarrow \{\text{Ideals of } R/I \}\] given by
  \[J \longmapsto J/I\] and
  \[L \longmapsto \pi^{-1}(L).\]
\end{prop}

\begin{proof}
  First \(\bar{J}=J/I=\pi(J)\unlhd \bar{R}\) since \(\pi\) is surjective \(\pi^{-1}(L) \unlhd R\) and contains
  \(I=\pi^{-1}(O)\). Claim: \(gf(J)=\pi^{-1}(J/I)=J\). Assume \(x \in R\) with \(x \in \pi^{-1}(J/I)\) then
  \(\pi(x) \in J/I\). Then \(x+I=y+I\) for some \(y \in J\). Thus \(x \in y + I \subset J\). Lastly
  \(fg(L)=\pi(\pi^{-1}(L))\) since \(\pi\) is surjective.
\end{proof}

\begin{defn}
  A proper ideal \(I \lhd R\) is called
  \begin{enumerate}
  \item a \emph{prime ideal} if
    \[xy \in I \implies x \in I \text{ or } y \in I.\]
  \item a \emph{maximal ideal} if
    \[\forall J \lhd R,\ I \subseteq J \implies I=J.\]
  \end{enumerate}
\end{defn}

\begin{prop}
  For every \(I \lhd R\) there exists a maximal ideal \(M\) such that \(I \subseteq M\) and \(M \lhd R\).
\end{prop}

\begin{proof}[Short Proof]
  This follows from Zorn's Lemma.
\end{proof}

Here we will be pedantic and write out the proof in its entirety as it sets the flavor of proof for the existence of
other maximal entities.

\begin{lem*}[Zorn's Lemma]
  If \(A\) is a nonempty partially ordered set such that every chain in \(A\) has an upper bound in \(A\), then \(A\)
  contains a maximal element.
\end{lem*}

\begin{proof}[Detailed Proof]
  Define set \(S=\{J \lhd R \mid I \subset J\} \neq \emptyset\). This set is never empty as \(I \in S\) by
  construction. The set \(S\) is partially ordered \(j \le J' \iff J \subseteq J'\). Now check that every chain in \(S\)
  has an upper bound. Let \((I_\alpha)_{\alpha in A}\) be a chain in \(S\) where \(\alpha, \beta \in A\) then
  \(J_\alpha \subseteq J_\beta\) or \(J_\beta \subseteq J_\alpha\). Here we can compare any two elements. The candidate
  for an upper bound is
  \[J=\bigcup_{\alpha \in A} J_\alpha.\] We must check the following requirements:
  \begin{enumerate}[label=(\arabic*)]
  \item \(I \subset J\)
  \item \(J \unlhd R\)
  \item \(J \neq R\).
  \end{enumerate}
  The condition (1) is immediate as \(I \subset J_\alpha\) for each \(\alpha \in A\). To see (2) let \(x,y \in J\) and
  \(r \in R\). Then there exists \(\alpha, \beta \in A\) such for \(x \in I\) and \(y \in J_\beta\) without loss of
  generality \(J_\alpha \subseteq J_\beta\). Then \(x+y \in J_\beta \subseteq J\). Since \(J_\alpha\) is an ideal for
  \(x \in J_\alpha\) we have \(rx \in J_\alpha \subset J\). Thus \(J\) is an ideal of \(R\). Lastly to see (3) notice
  \(1 \not \in J\) since \(1 \not \in J_\alpha\) for all \(\alpha \in A\) as each of these ideals is proper. Recall an
  ideal is the whole ring if and only if it contains unity, thus we have \(J \neq R\). We have shown that the conditions
  of Zorn's Lemma hold, hence \(S\) has a maximal element.
\end{proof}

\begin{prop}
  \(I \unlhd R\)
  \begin{enumerate}[label=(\alph*)]
  \item \(I\) is a prime ideal \(\iff\) \(R/I\) integral domain.
  \item \(I\) is a maximal ideal \(\iff\) \(R/I\) is a field.
  \end{enumerate}
\end{prop}

\begin{proof}
  \begin{enumerate}[label=(\alph*)]
  \item For \(x,y \in R\), the following are equivalent:
    \[xy \in I \implies x \in \text{ or } y \in I\\\] \[\iff\]
    \[\bar{x}\bar{y}=\bar{0} \implies \bar{x}=\bar{0} \text{ or } \bar{y}=\bar{0}\] \[\iff\] \[\text{R/I is an
        integral domain}\]
  \item \(I\) is maximal \(\iff I + Rx = \{a+rx \mid r \in R\} \unlhd R\)
    \[\iff\]
    \[\bar{R}\bar{x}=\bar{R} \ \forall \bar{x} \neq \bar{0} \in \bar{R}\]
    \[\iff\]
    \[\text{All non-zero elements of \(\bar{R}\) are units.}\]
  \end{enumerate}

  \begin{cor*}
    Every maximal ideal is prime.
  \end{cor*}
\end{proof}

\begin{rmk}
  Recall from the Correspondence Theorem that there is a bijection between ideals of \(R\) that contain an ideal \(I\)
  and the ideals of \(R/I\). This bijection may be restricted to either the prime ideals or the maximal ideals. Yielding
  a bijection between the prime/maximal ideals of \(R\) containing \(I\) and the prime/maximal ideals of \(R/I\).
\end{rmk}

\begin{defn*}
  Given \(S \subseteq R\) the \emph{ideal generated by \(S\) in \(R\)} denoted \((S)\) is the smallest ideal of \(R\)
  containing \(S\). More specifically it is defined to be
  \[(S)=\bigcap_{S \subset I \unlhd R} I\]
\end{defn*}

\begin{notation}
  Given a finite set \(S=\{x_1,\ldots,x_n\} \subset R\) we write \((x_1,\ldots,x_n)\) for
  \(\left(\{x_1,\ldots,x_n\}\right)\) which is exactly the set of all linear combinations of the elements of \(S\) with
  coefficients from \(R\).
\end{notation}

\begin{defn*}
  For \(x \in R\) the ideal \((x)=Rx=\{rx \mid r \in R\}\) is called the principal ideal generated by the element \(x\).
\end{defn*}

\begin{defn}
  An integral domain \(R\) is called a \emph{principal ideal domain (PID)} if every ideal of \(R\) is principle.
\end{defn}

\begin{examples}
  \(Z\), \(\F\), \(\F[x]\)
\end{examples}

\begin{notation}
  \(a,b \in R\) we say \emph{\(a\) divides \(b\)} or \(b\)is a multiple of \(R\) if \(\exists c \in R\) such that
  \(ac=b\) denoted \(a \mid b\).
\end{notation}

\begin{rmk} Let \(a \in R\)
  \begin{enumerate}[label=(\alph*)]
  \item \(\{b \in R \mid a \mid b\}=(a)\)
  \item \(a \mid 0\) since \(0=a \cdot 0 \)
  \item \(u \in R^\times \implies u \mid a\) since \(u(u^{-1}a)=a\)
  \item \(ac=b\) should not be written as \(c=\frac{b}{a}\)since in general \(\frac{b}{a}\) is ambiguous. Ex in \(\Z_6\)
    \(2 \times 2 = 4\) but \(2 \times 5 = 4\) also so is \(\frac{4}{2}=2\) or 5.
  \end{enumerate}
\end{rmk}

\begin{defn}
  Two ideals \(I, J \unlhd R\) are called \emph{comaximal} if \(I+J=R\) (\(\iff \exists a \in I, b \in J\) such that
  \(a+b=1\))
\end{defn}

\begin{lem}
  Given finitely many ideals \(I_1,\ldots, I_n\) that are pairwise comaximal, then \(I_1 \cdots I_{n-1}\) and \(I_n\)
  are comaximal and \(\bigcap_{j=1}^n I_J = I_1 \cdots I_n\)
\end{lem}

\begin{proof}
  We proceed by induction on \(n\). Consider when \(n=2\). One must show that that \(I_1,I_2\) comaximal
  \(\implies I_1 \cap I_2 \subset I_1I_2\). The other inclusion is obvious. If \(I_1\) and \(I_2\) are comaximal then
  there exists \(a \in I_1\) and \(b \in I_2\) such that \(a+b=1\). Take \(x \in I_1 \cap I_2\) then \(x=x \cdot 1 =
  x(a+b)=xa+xb\). Since \(xa,xb \in I_1 I_2\) we have that \(x \in I_1 I_2\) as desired.

  Now we consider the case when \(n \ge 3\). If \(I_j,I_n\) are comaximal for \(1 \le j \le n-1\) then there must exist
  \(a_j \in I_j\) and \(b_j \in I_n\) with \(a_j+b_j = 1\). Now
  \[1=1 \cdots 1 = \prod_{j=1}^{n=1}{a_j + b_j}\]
  Expanding and we see
  \[\prod_{j=1}^{n-1}(a_j+b_j) \in a_1 \cdots a_{N=1}+I_n\]
  Then \((I_1 \ldots I_{n-1}I_n)=I_1 \ldots I_{n-1} \cap I_n\)
  which by the inductive hypothesis is exactly \(\bigcap_{j=1}^n I_J\).
\end{proof}

\begin{prop}[Chinese Remainder Theorem]
  Let \(I_1, \ldots, I_n \unlhd R\) and
  \funcdeclaration{\varphi}{R}{\bigtimes_{j=1}^n}{r}{(r+I_j)_{1 \le j \le n}}
  \begin{enumerate}[label=(\alph*)]
  \item \(\varphi\) is a ring homomorphism with \(\ker \varphi = \bigcap I_j\)
  \item If \(I_1, \ldots I_n\) are pairwise comaximal then \(\ker \varphi = \prod_{j=1}^n I_n\) and if \(\varphi\) is
    surjective then
    \[\sfrac{\varphi}{ \prod_{j=1}^n I_j} \cong \bigtimes_{j=1}^n R/I_j\]
  \end{enumerate}
\end{prop}

\begin{proof}
  \begin{enumerate}[label=(\alph*)]
  \item trivial
  \item \(\ker \varphi = \prod_{j=1}^n I_j\) follows (a) and 2.1.12.
    By 2.1.12 we get \(\forall 1 \le l \le n\) that the ideals \(\hat{I_l}=\prod_{j\neq l, j=1} I_j\) and \(I_l\) are
    comaximal. Then there exists \(x_l \in \hat{I_l}\)and \(y_l \in I_l\) such that \(x_l + y_l = 1\). Then \(x_l \equiv
    0 \pmod{I_j \forall j \neq l}\) (this means that \(\bar{x_l} \equiv 1 \pmod{I_l}\) (or \(x_l + I_l = 1 I_l\))).

    Given \((a_j + I_j)_{1 \le j \le n} \in \bigtimes_{j=1}^n{R/I_j}, (a_j \in R)\). We set \(x=sum_{l=1}^n{a_l x_l} \in
    R\). Now let \(\bar{\phantom{}}\) denote mod \(I_j\) for some fixed \(j\).

    \begin{align*}
      \bar{x} &= \sum_{l=1}^n \bar{a_l}\bar{x_l}\\ \tag{\(\bar{x_l}=\bar{0}\) if \(\l \neq j\)}
              &= \bar{a_j}\bar{x_j}
              &= \bar{a_j}\bar{1}\\
              &= a_j + I_j.
    \end{align*}
    This argument may be made for each \(1 \le j \le n\). This means that \(\varphi(x)=(\bar(a_j)_{1 \le j \le n})\). We
    have thus shown our map to be surjective.
  \end{enumerate}
\end{proof}
  \begin{example*}[Special Case \(R = \Z\)]
    \begin{enumerate}[label=(\alph*)]
    \item \(n=2\), \(I_1=(m)\), \(I_2=(n)\) with \((m,n)=1 \implies\)
      \[\sfrac{\Z}{mn} \cong \sfrac{\Z}{m} \times \sfrac{\Z}{n}\]
      See 1.2.3 where we already derived this fact using more elementary means.
    \item \(n\) arbitrary \(p_1 \ldots p_n\) are distinct primes, \(l_1, \ldots, l_n \in \N\), \(I_j = (p_j^{e_j})_{1
        \le j \le n} \implies\) \[\sfrac{\Z}{\primedecomposition{p}{e}{n}} \cong \bigtimes_{j=1}^n
        \sfrac{\Z}{p_j^{e_j}}.\]
      This means there is always a solution to the system of congruences \(x \equiv a_j \pmod{p_j^{ej}}\). The injection
      is uniquely determined modulo the product.
    \end{enumerate}
  \end{example*}
  Notice that the above follows from the fact \(a,b \in R \implies (a)(b)=(ab)\).

  \subsection{Ring of Fractions}
  One may ask if there is a canonical way to embed every ring \(R\) into some larger field. If \(R\) is not an integral
  domain it can not be embedded into a field, because then the field would contain zero divisors. However the answer is
  always yes for integral domains.  We generalize the construction of \(\Q\) from \(\Z.\) Consider the embedding
  \[\Z \hookrightarrow \Q.\]
  The elements of \(\Q\) can be viewed as equivalence classes of \(\Z \times Z \setminus \{0\}\) under the relation
  \[(a,b) \sim (c,d) \iff ad=bc.\]

  Main motivations for introducing the rings of fractions:
  \begin{enumerate}
  \item Embedding integral domains into fields
  \item The concept of localization (a way to add inverses to a ring)
  \end{enumerate}

  Compare with [DF] sections 7.5 and 15.4.

  \begin{defn}
    A subset \(D\) of \(R\) is called \emph{multiplicatively closed} if
    \begin{enumerate}[label=(\arabic*)]
    \item \(d,d' \in D \implies dd' \in D\)
    \item \(1_R \in D\)
    \end{enumerate}
  \end{defn}

  \begin{example*}
    \begin{enumerate}[label=(\alph*)]
    \item \(R\) is integral domain \(\implies R \setminus \{0\}\) is multiplicatively closed. (This is in fact a
      characterization of integral domains)
    \item Any ring \(R\) with prime ideal \(P \lhd R \leadsto D = R \setminus P\). Notice that (a) is a consequence of
      this. Since \(\{0\}\) is prime \(\iff R\) is an integral domain.
    \item \(x \in R \leadsto D= \{x^n \mid n \in \N_0\}\)
    \end{enumerate}
  \end{example*}

  The goal is to invert the elements of \(D\) inside some larger ring. We will denote the ring \(D^{-1}R\). Following
  the construction of \(\Q\) from \(\Z\) one would think that equivalence relation \((r,d)\sim (r',d')\) would do the
  trick, however this relation fails to be transitive for \(R\) that are not integral domains (one would be required to
  cancel at a certain step). The correct equivalence relation is given by
  \[(r,d) \sim (r',d') \iff \exists e \in D \text{ s.t. } e(rd'-r'd)=0. \] It is tedious to check that this is
  transitive, however it is. Notice that in the case that \(R\) is an integral domain and \(0 \neq \in D\) this reduces
  to the naive relation as \(e(rd'-r'd)=0\) implies \(rd'-r'd=0\) since there are no zero divisors and \(e\) by
  assumption is nonzero.

  \begin{notation}
    In this context \(\frac{r}{d}\) denotes the equivalence class with representative \((r,d)\).
  \end{notation}

  Now we define
  \[D^{-1}R= \left\{\frac{r}{d} \mid r \in R, d \in D\right\}.\] We endow it with the operations
  \begin{align*}
    \frac{r}{d}+\frac{s}{e} &\coloneqq \frac{re+sd}{de}\\
    \frac{r}{d}\cdot\frac{s}{e} &\coloneqq \frac{rs}{de}.
  \end{align*}
  Since we are working with equivalence classes one must check the well-definedness of these operations. One may do this
  by using the definition of the equivalence relation. Finally one may check that \((D^{-1}R,+,\cdot)\) forms a
  commutative ring with unity \(1=\frac{1_R}{1_R}\). Further we have accomplished are goal as each \(d \in D\) is a unit
  in \(D^{-1}R\) with inverse \(\frac{1}{d}\).

  \begin{rmk*}
    \[D^{-1}R = \{0\} \iff 0 \in D\\\]
    \[D^{-1}R = \{0\} \iff \frac{1}{1}=\frac{0}{1} \iff \exists d \in D \text{ s.t. } d(1-0)=0 \iff d=0\]
  \end{rmk*}
  Dummit and Foote over restrictive by excluding all zero divisors from being included in \(D\). Rather one must exclude
  both a zero divisor and its partner from being in \(D\) as then \(D\) would contain zero, however there is nothing
  wrong with having one of the pair. However one must exclude nilpotent elements as we saw that
  \(\{x^n \mid n \in \N_0\}\) is multiplicatively closed meaning \(D\) would also contain zero.
  \begin{example*}
    An important example of \(D\) containing zero divisors, but still being non-trivial is
    \[D=R \setminus P\] where \(P\) is a prime ideal of \(R\). The ideal ideal \(P\) must contain one of each pair of
    the zero divisors of \(R\) otherwise \(R/P\) would not be an integral domain, but \(R/P\) is an integral domain
    since \(P\) is a prime ideal.
  \end{example*}
  We have a canonical map: \funcdeclaration{j}{R}{D^{-1}R}{r}{\frac{r}{1}} If \(R\) is not an integral domain then \(j\)
  is not injective (even if \(0 \not \in D\)). One may see this by realizing
  \[\ker j = \{r \in R \mid dr = 0\}.\]
  We summarize our construction and its properties in the following proposition:
  \begin{prop}Given a commutative ring \(R\) with unity.
    \begin{enumerate}[label=(\alph*)]
    \item For any multiplicatively closed subset \(D \subseteq R\), \(\left(D^{-1}R,+,\cdot\right)\) is a commutative ring with unity
      called the ring of fractions with respect to \(D\).
    \item \(D^{-1}R=\{0\}\iff 0 \in D\)
    \item There is a canonical map: \funcdeclaration{j}{R}{D^{-1}R}{r}{\frac{r}{1}} under which
      \(j(D) \subseteq D^{-1}R^\times\).
    \item If \(R\) is an integral domain and \(0 \not \in D\) then \(j\) is injective.
    \item If \(R\) is an integral domain and \(D=R \setminus \{0\}\) then \(D^{-1}R\) is a field containing a copy of
      \(R\), namely \(j(R)\). In this case \(D^{-1}R\) is called the field of fractions of \(R\).
    \end{enumerate}
    \begin{notation}
      \[\FieldFrac{R}=(R\setminus\{0\})^{-1}R.\]
    \end{notation}
  \end{prop}
  Notice that in the above definition we referred to the resultant construction with the article ``the''. This hints at
  some uniqueness floating around. We make this rigorous by characterizing the universal property of our construction.
  \begin{prop}[Universal Property of \(D^{-1}R\)]
    For any ring \(S\) and any ring homomorphism \(\varphi \colon R \to S\) which satisfies
    \(\varphi(D) \subset S^\times\), then there exists a unique ring homomorphism
    \(\tilde{\varphi} \colon D^{-1}R \to S\) making the following diagram commute
    \begin{figure}[h]
      \centering
      \begin{tikzcd}
        R \arrow[r,"\varphi"] \arrow[d,"j"]& S\\
        D^{-1}R \arrow[ru,dashed,"\tilde{\varphi}"]
      \end{tikzcd}
    \end{figure}

    Note that we required $\phi(D) \subset S^\times$ because each $d \in D$ is invertible in $D^{-1}R$, and we need it to remain invertible in $S$.
  \end{prop}
  \begin{prop}
    Let \(R\) be an integral domain with field of fractions \(F=D^{-1}R\). If \(\varphi \colon R \to K\) is an injective
    ring homomorphism, where \(K\) is a field, then \(K\) contains an isomorphic copy of \(F\).
  \end{prop}
  In this sense \(F\) is the ``smallest'' field that contains \(R\).
  \begin{proof}
    The injectivity of \(\varphi\) implies that \(\varphi(D) \subset K \setminus \{0\} = K^\times\). Thus we may invoke
    the universal property of the ring of fractions, hence there exists \(\tilde{\varphi} \colon F \to K\) with
    \(\tilde{\varphi} \circ j = \varphi\). This map is not the trivial map.  \(\tilde{\varphi}\) is injective because $\varphi$ is injective and \(\tilde{\varphi} \circ j = \varphi\).  So we have our embedding.
  \end{proof}
  Now we examine the ideal structure of \(D^{-1}R\) where \(R \neq 0\) and \(0 \not \in D\).
  \begin{rmk} \mbox{}
    \begin{enumerate}[label=(\alph*)]
    \item \[I \unlhd R \leadsto D^{-1}I = \left\{\frac{a}{d} \mid a \in I, d \in D\right\}\]
    \item \[D^{-1}I = D^{-1}R \iff D \cap I \neq \emptyset\]
    \end{enumerate}
  \end{rmk}

  \begin{prop}
    Define the map
    \begin{align*}
      \{I \lhd R \mid D \cap I = \emptyset\} &\longrightarrow \{\text{proper ideals of } D^{-1}R\}\\
      I &\longmapsto D^{-1} I.
    \end{align*}
    \begin{enumerate}[label=(\alph*)]
    \item The map is surjective. In general it is not injective.
    \item If \(P \lhd R\) is a prime ideal of \(R\) and \(P \cap D = \emptyset\), then \(j(D^{-1}P)=P\).
    \item The map restricted to the prime ideals of \(R\) is a bijection.
    \end{enumerate}
  \end{prop}

  \begin{defn}
    Observe that if \(P \lhd R\) is a prime ideal, then \(D = R \setminus P\) is multiplicatively closed (To prove this, use the fact that a prime ideal is generated by a prime element).  In this case, the ring of fractions \(D^{-1}R\)
    is denoted \(R_P\) and called the \emph{localization} of \(R\) at \(P\).
  \end{defn}

  \begin{cor}
    The map
    \begin{align*}
      \{Q \lhd R \mid Q \text{ prime and } Q \subset P\} &\longrightarrow \{\text{prime ideals of } R_P \}\\
      Q& \longmapsto D^{-1}Q
    \end{align*}
    is an inclusion preserving bijection.
  \end{cor}
  Consequence \(D^{-1}P=PR_P\) is the unique maximal ideal of \(R_P\).

  \begin{defn*}
    A commutative ring is called a \emph{local ring} if it has a unique maximal ideal.
  \end{defn*}
  \begin{example}
    \(R=\Z, P=(p)\). Then
    \[\Z_{(P)}=\left\{\frac{a}{b} \mid a,b \in \Z, p \;\text{does not divide}\; b\right\} \subseteq \Q = \Z_{(0)}\]
    By the previous result, \(\Z_{(P)}\) has two ideals: \(\{0\}\) and \((p)\Z_{(p)}\). Notice that
    \[(p)\Z_{(p)}=\left\{\frac{a}{b} \mid p \text{ does not divide } b, p \mid a\right\}\]
  \end{example}
  \subsection{Polynomial Rings}
  How \textbf{not} to define the polynomial ring \(R[x]\).
  \begin{align*}
    R[x] = \left\{f \colon R \to R \mid \exists a_{i} \in R : f(x)=\sum_{i=1}^na_ix^i\right\}
  \end{align*}
  i.e. as functions that admit a representation as a polynomial.
  \begin{example}
    \(R = \Z_p = \F_p\) consider \(x, x^p \in \F_p[x]\). Problem: \(x\) and \(x^p\) define the same function but have
    different representations.
  \end{example}

  \begin{defn}
    The \emph{polynomial ring} (in one variable over \(R\)) \((R[X],+,\cdot)\) is the set
    \begin{align*}
      R[X] \coloneqq \left\{(a_i)_{i \in \N_0} \mid a_i \in R, \text{ with all but finitely many entries zero}\right\}
    \end{align*}
    with operations
    \begin{align*}
      (a_i) + (b_i) &\coloneqq (a_i + b_i)\\
      (a_i)(b_i) &\coloneqq \left(\sum_{i=0}^k a_ib_{k-i}\right)_{k \in \N_0}.
    \end{align*}
  \end{defn}
  One may form this checks a commutative ring with identity \(1=(1,0,0,\ldots)\). What requires the most work is
  checking that the multiplication is associative.
  \begin{rmk*}
    Elements of \(R[x]\) are called polynomials. There is a natural embedding
    \begin{align*}
      R &\hookrightarrow R[X]\\
      a &\mapsto (a,0,0,\ldots)
    \end{align*}.
    There is a distinguished element called \(x\) in \(R[X]\), namely we let
    \[x = (0,1,0,\ldots).\] For \(a=(a_i)_{i \in \N_0}\) one checks
    \begin{align*}
      (xa)_0 &= 0\\
      (xa)_i &= (a_{i-1})
    \end{align*}.
    In other words this element \(x\) has the property that it shifts the coefficients.
  \end{rmk*}

\begin{defn}
  Any element \(0 \neq a \in R[x]\) can be uniquely written in the form \(\poly{i}{a}{d}\) with all \(a_i \in R\) and
  \(a_d \neq 0\). The integer \(d\) is called the \emph{degree} and is denoted \(\deg(a)\). Note that
  \[deg(a) = 0 \iff a \in R \setminus \{0\}\] The element \(a_d\) is called \emph{the leading coefficient} of \(a\) and
  is denoted by \(\ell(a)\). The polynomial \(a\) is \emph{monic} if \(\ell(a)=1\). We also define
  \(\ell(0) \coloneqq 0\) and \(\deg(0) \coloneqq - \infty\). This representation admits the operations in the follow
  form:
  \begin{align*}
    \poly{i}{a}{d}+\poly{i}{b}{e} &= \sum_{i=0}^{\max\{d,e\}}(a_i+b_i)x^i\\
    \poly{i}{a}{d}\poly{j}{b}{e}  &= \sum_{k=0}^{d+e}\left(\sum_{i=0}^k a_i b_{k-i}\right)x^k
  \end{align*}
  where \(a_i \coloneqq 0\) for \(i > d\) and \(b_j \coloneqq 0\) for \(j > e\). In expanded form:
  \begin{align*}
    \poly{i}{a}{d}\poly{j}{b}{e} &= a_0 b_0 + (a_0 b_1 + a_1 b_0)x + \ldots + a_db_e x^{d+e}
  \end{align*}
\end{defn}
I have omitted a very tedious verification of the uniqueness of the representation.
\begin{rmk}
  In a similar way we define the \emph{power series ring} denoted \(R[[x]]\) as follow
  \[R[[x]] \coloneqq \left\{(a_i)_{i \in \N_0}\} \mid a_i \in R\right\}.\] Here we have simply dropped the requirement
  that all but a finite amount of terms must be zero. We define the operations in the same manner. Further notice that
  there are no infinite sums being carried out. Also there is a natural inclusion
  \[R[x] \hookrightarrow R[[x]]\]
\end{rmk}

\begin{lem}
  Let \(f,g \in R[x]\).
  \begin{enumerate}[label=(\alph*)]
  \item \(\deg(f+g) \le \max \{\deg f, \deg g\}\)
  \item If \(\ell(f)\) is not a zero divisor of \(R\) we have
    \[\deg(fg) = \deg(f)+\deg(g)\]
  \end{enumerate}
\end{lem}

\begin{example*}
  If \(l(f)\) is a zero divisor we might have \(\deg f \ deg g < \deg f + \deg g\). Consider \(R = \Z_6\) then
  \begin{align*}
    (1+2x)(1+3x) = (1+5x)
  \end{align*}
\end{example*}

\begin{prop}
  Let \(R\) be an integral domain. Then
  \begin{enumerate}[label=(\alph*)]
  \item \(f,g \in R[x]\), \[\deg(fg)=\deg(f)+deg(g)\]
  \item \(R[x]\) is an integral domain
  \item \(R[x]^\times = R^\times\)
  \end{enumerate}
\end{prop}

\begin{proof}
  \begin{enumerate}[label=(\alph*)]
  \item Assume \(f \neq 0\) and \(g \neq 0\). Then since \(R\) is an integral domain \(\ell(f)\) and \(\ell(g)\) are not
    zero divisors. Then by lemma 2.3.4b we have that \(\deg(fg)=\deg(f)+\deg(g)\).
  \item \(f \neq 0 \neq g \implies \deg(fg)=\deg(f)+\deg(g)\) thus \(\deg(fg) \ge 0\), hence \(fg \neq 0\)
  \item \(R \hookrightarrow R[x] \implies R^\times \subseteq R[x]^\times\). Suppose \(f,g\) are units in \(R[x]\), and
    then use the previous part to show \(\deg(f)+\deg(g)=0\), and hence \(f,g \in R\).
  \end{enumerate}
\end{proof}

\begin{rmk}
  \begin{enumerate}
  \item \(\polyex{a}{d}{i} \in R[x]^\times \iff a_1, \ldots, a_d\) are nilpotent.
  \item Power Series Ring \(R[[x]]\) is defined the same was a polynomial ring, but we remove the requirement that all
    but a finite amount of terms are zero.
  \end{enumerate}
\end{rmk}

\begin{prop}
  Let \(\varphi \colon R \to S\) be a ring homomorphism, and a choice for where \(x \mapsto a\) there exists a unique
  \begin{figure}[h] \centering
    \begin{tikzcd}
      R \arrow[r,"\varphi"] \arrow[rd,hook]& S \\
      & R[x] \arrow[u,dashed,"\exists! \tilde{\varphi}_a"]
    \end{tikzcd}
  \end{figure}
\end{prop}

\end{document}
%%% Local Variables:
%%% mode: latex
%%% TeX-master: "master.tex"
%%% End:


\documentclass{article}
\usepackage[margin=1in]{geometry}
\setlength{\parindent}{0in}

\usepackage[utf8]{inputenc}

\usepackage{latexsym,amsfonts,amssymb,amsthm,amsmath,mathtools,commath}

\DeclareMathOperator{\Tr}{Tr}
\DeclareMathOperator{\Id}{Id}
\DeclarePairedDelimiter\floor{\lfloor}{\rfloor}

\usepackage{braket}
\usepackage{mathrsfs}

\newtheorem{theorem}{Theorem}[section]
\newtheorem*{lemma}{Lemma}
\newtheorem*{corollary}{Corollary}

\title{Quantum Computing - Assignment 4}
\author{Kishlaya Jaiswal}

\begin{document}

\maketitle

\subsection*{Exercise 1}

Let $x \in \mathbb{Z}_N^*$ where $N = p_1^{\alpha_1} \ldots p_l^{\alpha_l}$.

Let $r$ be the order of $x \pmod{N}$ and $r_i$ be the order of $x \pmod{p_i^{\alpha_i}}$. Notice that $r$ is the lcm of $r_1, r_2, \ldots, r_l$

Denote by $\nu_2(n)$ the largest power of $2$ dividing $n$.

Note that $r_i \mid r$ for each $1 \leq i \leq l$. So if $r$ is odd then so are $r_i$; otherwise if $x^{r/2} \equiv -1 \pmod{N}$ then $x^{r/2} \equiv -1 \pmod{p_i^{\alpha_i}}$ and so $r_i \nmid (r/2) \implies$ $\nu_2(r) = \nu_2(r_i)$ for each $1 \leq i \leq l$. We get

$$P(r \text{ is odd or } x^{r/2} \equiv -1 \pmod{N}) \leq P(\text{largest power of 2 that divides each } r_i \text{ is same})$$

Now we quote a lemma (from Nielsen and Chuang) which uses the fact that $\mathbb{Z}_{p^{\alpha}}^*$ is cyclic for odd prime $p$, to estimate the fraction of elements with particular largest power of $2$ in the order of any element of $\mathbb{Z}_{p^{\alpha}}^*$:
\begin{lemma}
Let $p$ be an odd prime. Let $\nu_2\left(\abs{\mathbb{Z}_{p^{\alpha}}^*}\right) = d$. Then
$$P(2^d \text{ divides order of a randomly chosen element of } \mathbb{Z}_{p^{\alpha}}^*) = \frac12$$
\end{lemma}

As a corollary, we immediately get that if $y$ is chosen randomly from $\mathbb{Z}_{p^{\alpha}}^*$ then for any $n$

$$P(\nu_2(y) = n) \leq \frac12$$

Using Chinese Remainder Theorem and that $|\mathbb{Z}_N^*| = |\mathbb{Z}_{p_1^{\alpha_1}}^*| \ldots |\mathbb{Z}_{p_l^{\alpha_l}}^*|$, we get that choosing $x$ at random from $\mathbb{Z}_N^*$ is equivalent to choosing $x_i$ at random from $\mathbb{Z}_{p_i^{\alpha_i}}^*$ independently for each $1 \leq i \leq l$. We argue by induction on $l \geq 2$, that $P(\text{largest power of 2 that divides each } r_i, 1 \leq i \leq l, \text{ is same}) = P(\nu_2(r_1) = \cdots = \nu_2(r_l)) \leq \frac{1}{2^{l-1}}$

If $l=2$, then set $m = \nu_2\left(\abs{\mathbb{Z}^*_{p_2^{\alpha_2}}}\right)$
\begin{align*}
    P(\nu_2(r_1) = \nu_2(r_2)) &= \sum_{k=0}^m P(\nu_2(r_1) = \nu_2(r_2), \nu_2(r_2) = k) \\
    &= \sum_k P(\nu_2(r_1) = k) P(\nu_2(r_2) = k) \\
    &\leq \frac12 \sum_k P(\nu_2(r_1) = k) \\
    &\leq \frac12 P(\nu_2(r_1) \geq 0) \\
    &= \frac{1}{2}
\end{align*}

Suppose it is true for some $l-1 \geq 2$, then set $m = \nu_2\left(\abs{\mathbb{Z}^*_{p_l^{\alpha_l}}}\right)$
\begin{align*}
    P(\nu_2(r_1) = \cdots = \nu_2(r_l)) &= \sum_{k=0}^m P(\nu_2(r_1) = \cdots = \nu_2(r_l), \nu_2(r_l) = k) \\
    &= \sum_k P(\nu_2(r_1) = \cdots = \nu_2(r_{l-1}) = k) P(\nu_2(r_l) = k) \\
    &\leq \frac12 \sum_k P(\nu_2(r_1) = \cdots = \nu_2(r_{l-1}) = k) \\
    &\leq \frac12 P(\nu_2(r_1) = \cdots = \nu_2(r_{l-1})) \\
    &\leq \frac12 \left(\frac{1}{2^{l-2}}\right) \text{ (by inductive hypothesis)} \\
    &= \frac{1}{2^{l-1}}
\end{align*}

Therefore, we get
\begin{align*}
    P(x \text{ is good}) &= 1 - P(x \text{ is not good}) \\
    &= 1 - P(r \text{ is odd or } x^{r/2} \equiv -1 \pmod{N}) \\
    &\geq 1 - P(\text{largest power of 2 that divides each } r_i \text{ is same}) \\
    &\geq 1 - \frac{1}{2^{l-1}}
\end{align*}

\subsection*{Exercise 2}

Let $a_0, a_1, \ldots$ be a sequence of positive reals then denote by
$$[a_0, \ldots a_n] = a_0 + \frac{1}{a_1+\frac{1}{a_2 + \frac{1}{\cdots + \frac{1}{a_n}}}}$$

We have the following lemma (from Nielsen and Chuang):
\begin{lemma}
Let $a_0, a_1, \ldots $ be a sequence of positive reals and sequences $p_n, q_n$ defined inductively by $p_0 = a_0, p_1 = 1 + a_0a_1$ and $q_0 = 1, q_1 = a_1$ and for all $n \geq 2$
$$p_n = a_n p_{n-1} + p_{n-2}$$
$$q_n = a_n q_{n-1} + q_{n-2}$$
then $\frac{p_n}{q_n} = [a_0, \ldots, a_n]$
\end{lemma}

As a corollary we immediately get the following results
\begin{corollary}
Let $a_0, a_1, \ldots$ be a sequence of positive integers and $\frac{p_n}{q_n} = [a_0, \ldots, a_n]$ then $\forall n\geq 0$
\begin{itemize}
    \item $p_n, q_n$ are positive integers
    \item $q_n p_{n-1} - p_n q_{n-1} = (-1)^n$
    \item $(p_n, q_n) = 1$
    \item Both $p_n$ and $q_n$ are strictly increasing sequence
\end{itemize}
\end{corollary}

\begin{proof}
Clearly $p_0 = a_0, p_1 = 1 + a_0a_1$ and $q_0 = 1, q_1 = a_1$ are integers. Now using strong induction we get that $p_n = a_np_{n-1} + p_{n-2}, q_n = a_nq_{n-1} + q_{n-2}$ are integers. \\

For $n=1$, $q_1 p_0 - p_1 q_0 = a_0a_1 - (1 + a_0a_1) = (-1)$. Assume $q_{n-1} p_{n-2} - p_{n-1} q_{n-2} = (-1)^{n-1}$, then we have

$$q_n p_{n-1} - p_n q_{n-1} = (a_n q_{n-1} + q_{n-2})p_{n-1} - (a_n p_{n-1} + p_{n-2})q_{n-1} = -(q_{n-1} p_{n-2} - p_{n-1} q_{n-2}) = (-1)^n$$

If $d \mid p_n$ and $d \mid q_n$ then $d \mid q_n p_{n-1} - p_n q_{n-1} \implies d \mid (-1)^n$. Hence $(p_n, q_n) = 1$.

As $p_n$ and $q_n$ are both strictly positive sequence and $a_n$ is a positive integer, we get $p_n = a_n p_{n-1} + p_{n-2} > a_n p_{n-1} \geq p_{n-1}$. Similarly $q_n > q_{n-1}$.
\end{proof}

Now suppose $x \in \mathbb{Q}$ and that $\abs{x - \frac{p}{q}} < \frac{1}{2q^2}$

We can assume $(p,q) = 1$ because otherwise write $p/q = p'/q'$ where $(p', q') = 1$ and note that $\abs{x - \frac{p'}{q'}} < \frac{1}{2q^2} < \frac{1}{2q'^2}$ and so we can replace $p/q$ with $p'/q'$. \\

Let $[a_0, \ldots, a_n]$ be the continued fraction for $\frac{p}{q}$ and $[a_0, \ldots, a_i] = \frac{p_i}{q_i}$, $\forall 0 \leq i \leq n$. Then $p_n = p$ and $q_n = q$ as both $(p,q) = (p_n,q_n) = 1$ \\

If $x = \frac{p}{q}$, then $[a_0, \ldots, a_n]$ is the continued fraction expansion for $x$ and so $p/q$ is a convergent of the continued fraction expansion of $x$.

If $\frac{p}{q} = [a_0]$ then $p=a_0, q=1$. So $\abs{x-a_0}$ is a rational less than $\frac12$.

If $x > a_0$ then $0 < x-a_0 < 1 \implies x-a_0 = [0,b_0,\ldots, b_m] \implies x = [a_0,b_0,\ldots, b_m]$

Otherwise if $x < a_0$ then in this case we first note that $p/q = [a_0] = [a_0 - 1, 1]$ and since $\frac12 < x-a_0 + 1 < 1 \implies x - a_0 + 1 = [0,1,b_1\ldots, b_m] \implies x = [a_0-1,1,b_1,\ldots, b_m]$ and so in both the cases, $p/q$ is a convergent of the continued fraction expansion of $x$ \\

Otherwise let $x = [a_0, \ldots, a_n, y]$ ($n>0$) and we solve for $y$ as follows:
$$x = \frac{yp_n + p_{n-1}}{yq_n + q_{n-1}} \text{ (by above lemma)}$$ $$\implies y = \frac{p_{n-1}-xq_{n-1}}{xq_n - p_n} = \frac{q_np_{n-1}-p_nq_{n-1}}{q_n^2(x - \frac{p_n}{q_n})} - \frac{q_{n-1}}{q_n} = \frac{(-1)^n}{q_n^2(x - \frac{p_n}{q_n})} - \frac{q_{n-1}}{q_n}$$

Now if $a_n = 1$, then we can re-write $[a_0, \ldots, a_{n-1}, a_n] = [a_0, \ldots, a_{n-1} + 1]$. Otherwise, we can re-write $[a_0, \ldots, a_{n-1}, a_n] = [a_0, \ldots, a_{n-1}, a_n-1, 1]$. Therefore, we can appropriately modify $n$ such that $(-1)^n\left(x - \frac{p_n}{q_n}\right) > 0$. Hence we get
$$y = \frac{1}{q_n^2\abs{x - \frac{p_n}{q_n}}} - \frac{q_{n-1}}{q_n} > 1$$
because $q_n^2\abs{x - \frac{p_n}{q_n}} < \frac12$ and $q_n > q_{n-1}$ as $q_n$ is increasing.

Finally, since $x$ is rational and $p_n, q_n$ are integers, we get that $y$ is a positive rational and we can find a continued fraction expansion for $y = [b_0, \ldots, b_m]$. Therefore, we get $x = [a_0, \ldots a_n, b_0, \ldots b_m]$ as required.

\subsection*{Exercise 3}
Let $X$ be the set of all search elements (needles) and $\ket \beta = \frac{1}{\sqrt x} \sum_{i \in X} \ket i$ where $x = |X|$

And let $\ket \alpha = \frac{1}{\sqrt{N-x}} \sum_{i \not \in X} \ket i$ where $N$ is the total number of items.

Denote by $\ket \psi$ the uniform superposition of all states, that is
$$\ket \psi = \frac{1}{\sqrt N} \sum \ket i = \sqrt{1 - \frac x N} \ket \alpha + \sqrt{\frac x N} \ket \beta = \cos \theta \ket \alpha + \sin \theta \ket \beta$$

where $\cos \theta = \sqrt{1-x/N}$. We define three operators:
\begin{itemize}
    \item Oracle operator $O$ where $O\ket i = - \ket i$ if $i \in X$ otherwise $O\ket i = \ket i$
    \item Diffusion operator $D$ where $D = 2 \ket \psi \bra \psi - I$
    \item Grover operator $G = DO$
\end{itemize}

Note that $O\ket \alpha = \ket \alpha$ and $O\ket \beta = -\ket \beta$

Next note that, $\braket{\psi | \alpha} = \cos \theta$ and $\braket{\psi | \beta} = \sin \theta$ and so $D\ket \alpha = 2\cos \theta \ket \psi - \ket \alpha$ and $D\ket \beta = 2\sin \theta \ket \psi - \ket \beta$. Let $\ket \phi = \cos x \ket \alpha + \sin x \ket \beta$ be any general vector in the plane $P$ of $\ket \alpha$ and $\ket \beta$, then we have:

\begin{align*}
    G \ket \phi &= (\cos x) G \ket \alpha + (\sin x) G \ket \beta \\
    &= (\cos x) D \ket \alpha - (\sin x) D \ket \beta \\
    &= \cos x (2 \cos \theta \ket \psi - \ket \alpha) - \sin x (2 \sin \theta \ket \psi - \ket \beta) \\
    &= (2 \cos x \cos \theta - 2 \sin x \sin \theta) \ket \psi - \cos x \ket \alpha + \sin x \ket \beta \\
    &= (2 \cos x \cos^2 \theta - 2 \sin x \sin \theta \cos \theta - \cos x) \ket \alpha + (2 \cos x \cos \theta \sin \theta - 2 \sin x \sin^2 \theta + \sin x) \ket \beta \\
    &= cos (2\theta + x) \ket \alpha + \sin (2\theta + x) \ket \beta \\
    \\
    \implies G \ket{\psi} &= cos (3\theta) \ket \alpha + \sin (3\theta) \ket \beta
\end{align*}

Therefore, $G$ is a counter-clockwise rotation (by $2\theta$) operator in $P$. And so it suffices to apply $G$ on $\ket \psi$ $k$ times such that $$2k\theta \sim \frac{\pi}{2} - \theta \implies k = \floor*{\frac{\pi}{4}\left(\frac{1}{\theta}\right) - \frac12} \leq  \frac{\pi}{4\theta}$$

And using $\theta \geq \sin \theta = \sqrt{x/N}$, we get $\boxed{k \leq \frac{\pi}{4}\sqrt{\frac{N}{x}}}$

Hence after $O(\sqrt{N/x})$ oracle queries, with high probability, we can find one of the search elements.

\end{document}


\problemname{Cooking Water}
``A watched pot never boils'', as the saying goes.
Chef Edward has been cooking for ages, and empirically the saying seems to be true in his kitchen -- he has yet to see a pot actually start boiling.
His wife Gunilla is a bit suspicious of Edward's claim though.
She knows how he often loses focus after a little while, and thinks that it is very likely Edward gets tired of watching after about the same period of time starting when he puts it on the stove.

Being scientifically minded, Gunilla quickly designed an experiment which could help Edward gain more insight into the boiling of pots.
Every time during the last week when Edward boiled a pot of water, he wrote down the intervals of time when he was not watching the pot.
Now, he has a large log of these intervals, and wonders whether Gunilla is right (i.e. it may be the case Edward just happened to watch away every time the pot started boiling), or if his hypothesis is correct.

Given this data, is it possible that the pot actually starts boiling after the same amount of time, every time?

\section*{Input}
The first line of the input contains an integer $1 \le N \le 1\,000$, the number of times Edward boiled water in the last week.
Then, $N$ descriptions of a boiling follow.
Each description contains two numbers $0 \le a \le b \le 1\,000$.
This means that Edward looked away during seconds $[a, b]$ (i.e. from the start of second $a$, to the end of second $b$), and that Edward first saw the pot boiling once he looked back.

\section*{Output}
If it is impossible that all the pots actually started boiling at the same point in time, output \texttt{edward is right}.
Otherwise, output \texttt{gunilla has a point}.


\color{black}
\subsection*{Learning a Markov model}

Given a state sequence $\vec{s}$ such as the one you just created, we may use maximum likelihood estimation techniques to estimate or ``learn'' a Markov model $\lambda_{MLE}$ that is most likely to have produced $\vec{s}$.

Maximum likelihood estimates of the entries of the corresponding matrix $\mat{P}_{\lambda_{MLE}}$ are given by
\begin{equation*}
\bigl( \mat{P}_{\lambda_{MLE}} \bigr)_{ji} = \frac{n_{ji}}{\sum_j n_{ji}}
\end{equation*}
where the quantity $n_{ji}$ counts how often the transition $s_i \rightarrow s_j$ occurs in sequence $\vec{s}$.

Given the ``training'' sequence $\vec{s}$ you created above, compute the entries of $\mat{P}_{\lambda_{MLE}}$. Round your results to two decimals.
\color{blue}
%%%%%
%%%%% enter your answer after the '=' sign
%%%%%
\begin{equation*}
\mat{P}_{\lambda_{MLE}} = \begin{bmatrix} 0.3 & 0.2 & 0.5 \\ 0.5 & 0.3 & 0.2 \\ 0.2 & 0.5 & 0.3 \end{bmatrix}
\end{equation*}
%%%%%
%%%%%
%%%%%
\color{black}


\mychapter{15}{Lesson 15} %181116
\section{Public key encryption (cont'd)}

\subsubsection{\textsc{Cca}-security, revisited}

\begin{cryptogame}
    {pkecca}
    {Chosen ciphertext attacks, revisited for \pke{} schemes}
    {cca2}

    \receive{$(\pk, \sk) \pickUAR \keygen(1^\lambda)$}{$pk$}{}

    \cseqdelay
    \cseqbeginloop

    \send{}{$c'$}{}
    \receive{$m' = \Dec(\sk, c)$}{$m'$}{}

    \cseqendloop
    \cseqdelay

    \send{}{$m_0, m_1$}{}

    \receive{\shortstack[l]{
        $b \pickUAR \binary$ \\
        $c \pickUAR \Enc(\pk, m_b)$
    }}{$c$}{}

    \cseqdelay
    \cseqbeginloop

    \send{}{$c'$}{}
    \receive{$m' = \Dec(\sk, c)$}{$m'$}{}

    \cseqendloop
    \cseqdelay

    \send{}{$b'$}{\textsc{Output 1 iff} $b' = b$}
\end{cryptogame}

\subsection{Trapdoor permutations}

Let us consider the following scheme $\Pi$, which is an adaption of the old \cpa-secure \ske{} to public keys:
\begin{itemize}
    \item $\Enc(\pk, m) = (r, f_\pk(m \oplus r))$, where $r \sim \unifdist(\binary^\lambda)$
    \item $\Dec(\sk, (c_0, c_1)) = g_\sk(c_1) \oplus c_0$
    \item Correctness: $g_\sk(c_1) \oplus c_0 = g_\sk(f_\pk (m \oplus r)) \oplus r = m \oplus r \oplus r = m$
\end{itemize}

A \emph{trapdoor permutation} (or \tdp) is a \owp{} having the following features:

\begin{itemize}
    \item A key pair is chosen \uar{} by a key generator algorithm:
    \[
        (\pk, \sk) \pickUAR \keygen(1^\lambda)
    \]
    \item There is a function family $F \in \Xi_\pk \to (V_{\pk} \to V_{\pk})$ such that:
    \begin{itemize}
        \item Computing $f_{\pk}$ is efficient
        \item Domain sampling ($x \pickUAR V_{\pk}$) is efficient
    \end{itemize}
    \item There is an efficient function $g_{\sk}$ that efficiently \emph{inverts} $f_{\pk}$, where $sk$ is the ``trapdoor'':
    \[
        g(\sk, f(\pk, x)) = x
    \]
    \item No efficient adversary is able to invert $f_{\pk}$ without knowing $\sk$
\end{itemize}

Note that because $\pk$ is public, an adversary can perform any polynomial number of encryptions with $\pk$, and see the corresponding ciphertext. This is the same characteristic of \pke{} schemes we described just a while ago. It entails that, if left deterministic, a \tdp{} is not \cpa-secure.

Also, the scheme described above is not \cpa-secure form the start: the adversary, by choosing two messages for the challenge, and receiving the ciphertext $(c_0 = r, c_1)$, along with the public key, has everything needed to reconstruct the encryption and check whichever message was encrypted, much like the problem of \ufcma against a deterministic \mac scheme.

%The idea is to reuse the message as part of the randomness, or more in detail, use its hardcore predicate. The resulting scheme would then look like this:
Here, in this scheme, we combine randomness and the notion of hardcore predicate $\hc$:

% AP190123 - IMPORTANT NOTE: This scheme is intended to work for single-bit messages
\begin{itemize}
    \item $(pk, sk) \pickUAR \keygen(1^\lambda)$
    \item $r \pickUAR \Xi_{pk}$
    \item $c := \Enc(\pk, m) = (f_{\pk}(r), \hc(r) \oplus m)$
    \item Correctness: $\Dec(\sk, c) = \hc(g_{\sk}(c_1)) \oplus c_2$
    % Exercise: If obscure, do the petty algebra on paper
\end{itemize}

\begin{theorem}
    If $F$ is a \tdp{} and $\hc$ is hardcore for $f$, then the above scheme is \cpa-secure.
\end{theorem}

\begin{proof} The proof is left as exercise
    \todo{Apparently, the reduction here is not easy at all, some hints are needed.}
\end{proof}

\subsection{\textsc{Tdp} examples}

One example stems form the factoring problem: let's look again at $\integer_n^\times$, where $n$is the product of two prime numbers $p$, and $q$:

\begin{theorem}[Chinese remainder theorem]
    The following isomorphisms to $\integer_n^\times$ are true:

    \begin{itemize}
        \item $\integer_n \simeq \integer_p \times \integer_q$
        \item $\integer_n^\times \simeq \integer_p^\times \times \integer_q^\times$
    \end{itemize}

    Note that the theorem is more general, and holds for any two numbers $p$ and $q$ that are coprime.
\end{theorem}

How to use this theorem for constructing a \pke{} scheme:

\begin{theorem}[Euler's totient theorem]
    Let $x$, $n$ be two coprime numbers. Then $x^{\varphi(n)} \equiv_n 1$
\end{theorem}

Also, remember that $\forall p, q \in \primenum \implies \varphi(pq) = (p - 1)(q - 1)$

So let $a$ be the public key such that $\gcd(a, \varphi(n)) = 1$, then $\exists! b \in \integer_n : ab \equiv_{\varphi(n)} 1$; $b$ will be our private key. Define encryption as $f(a, m) = m^a \mod n$, and then decryption as $g(b, c) = c^b \mod n$. Observe that
\[
    g(b, f(a, m)) = (m^a)^b = m^{ab} = m^{k \varphi(n) + 1} = (m^{\varphi(n)})^k m \equiv_n m
\]
because $ab = 1 \mod \varphi(n)$.

So we conjecture that the above is a valid \tdp-based \pke{} scheme. This is actually referred to as the \emph{\rsa{} assumption}, and is depicted in figure \ref{cryptogame:rsaass}

\begin{cryptogame}
    {rsaass}
    {The \rsa{} assumption}
    {rsa}

    \receive{\shortstack[l]{
        $b \pickUAR \binary$ \\
        $c \pickUAR \textrm{Enc}(pk, m_b)$
    }}{$n, pk, m^{pk}$}{}

    \cseqdelay

    \send{}{$m'$}{\textsc{Output 1 iff} $m' = m$}

\end{cryptogame}

Relation to the factoring problem: $\rsa \implies \textsc{fact}$

Proof: Given $p, q$, an adversary can compute $\varphi(n) = (p - 1)(q - 1)$, and then find the inverse of the public key in $\integer_{pq}^\times$.

It hasn't been proven that $\textsc{fact} \implies \rsa$

\section{Textbook \rsa}

This is an insecure toy example of the more complex \rsa{} (Rivest Shamir Adleman) scheme:

\begin{itemize}
    \item Setup: $(\pk, \sk) \pickUAR \keygen(\integer_n^\times) : \sk \equiv_{\varphi(n)} \pk^{-1}$
    \item Encryption: $\Enc(\pk, m) = m^{\pk} \mod n$
    \item Decryption: $\Dec(\sk, c) = c^{\sk} \mod n$
    \item Correctness: $\Enc(\pk, \Dec(\sk, m)) = m^{\pk \cdot \sk} \equiv_n m$
\end{itemize}

Again, since the encryption routine is deterministic, the scheme is not \cpa-secure. However, a hardcore predicate can be inserted to the routine: $\hat{m} = r||m$, where $r \pickUAR \binary^l$. Now the encryption is pseudorandom.

Some interesting facts:
\begin{enumerate}
    \item $l \in \omega(log(\lambda))$ otherwise a brute-force attack becomes viable.
    \item If $m \in \binary$, then the scheme is \cpa-secure under \rsa{} assumption, just use the standard \tdp{}
    \item If $m$ is ``in the middle'': $\binary \leq m \leq \binary^l$; then \rsa{} is believed to be secure (standard PKCS\#1, 5)
    \item However, this construct is not \cca-secure.
    \todo{Counterexample?}
\end{enumerate}

\subsection{Trapdoor Permutation from Factoring}

Here is an attempt to build a \tdp{} over the group $\quadres(n)$: let's look at $f(x) \equiv_n x^2$ where $f \in \integer_n^\times \to \quadres_n (\subset \integer_n^\times)$. Notice that this is not a permutation in general, so let's consider their \textsc{crt}'s representation\footnotemark, in order to restrict $f$'s domain:

\footnotetext{Those well-versed in number representation in computers may know this representation as the \emph{residue number system}}

\[
    x = (x_p \equiv_p x, x_q \equiv_q x), f(x) \equiv_p x^2, x \in \integer_p^\times
\]

Since $\integer_p^\times$ is cyclic:

\begin{align*}
    \integer_p^\times   &= \{g^0, g^1, g^2, \ldots  &&, g^{\frac{p - 1}{2} - 1}              &&, g^{\frac{(p-1)}{2}}                    &&, \ldots, g^{p-2}         &&\} \\
    \quadres_p          &= \{g^0, g^2, g^4, \ldots  &&, g^{2(\frac{p - 1}{2} - 1) = p - 3}   &&, g^{2(\frac{p-1}{2}) = p - 1 \equiv 0}  &&, \ldots, g^{2(p - 2)}    &&\} \\
\end{align*}

Because of this, $|\quadres_p| = \frac{p - 1}{2}$. Moreover, since $g^{2\frac{p-1}{2}} \equiv_p 1$ and $g^{\frac{p-1}{2}}$ cannot be 1 (since $g^0 \neq g^{\frac{p - 1}{2}} \neq g^{p - 1}$ ) but must be one of the $p-1$ elements of $\integer_p^\times$, then $g^{\frac{p-1}{2}} \equiv_p -1$.

Now it's possible to show that $f: \quadres_p \to \quadres_p$ is a permutation, and we are going to show how to find $f^{-1}$.

Assume $p \equiv_4 3$, meaning $\exists t : p = 4t + 3 \implies t = \frac{p - 3}{4}$); then squaring modulo $p$ becomes a permutation. Given $y \equiv_p x^2$, observe the following:

\begin{gather*}
    (y^{t + 1})^2 = y^{2t + 2} = y^{2\frac{p - 3}{4} + 2} = y^{\frac{p - 1}{2} + 1} = (x^2)^{\frac{p - 1}{2} + 1} = x^{p - 1} x^2 \equiv_p x^2 \\
    \Downarrow \\
    x = \pm y^{t + 1}
\end{gather*}

But only one among $\pm y^{t + 1}$ is a square: the positive one. Therefore:
\[
    p = 4t + 3 \implies \frac{p - 1}{2} = \frac{4t + 2}{2} = 2t + 1
\]
so $\frac{p - 1}{2}$ is odd.

Now, since we are considering just the elements of $\quadres_p$, and we can write each $x \in \integer_p^\times$ as $g^{z}$ for a $z \in \integer_p$:
\[
    y = x^2  = (g^z)^2
\]

So, $y = g^{z'} \in \quadres_p \Leftrightarrow z'$ is even. If $z'$ is odd, then $y \notin \quadres_p$.

Since $\frac{p - 1}{2}$ is odd, then $g^{\frac{p - 1}{2}} \notin \quadres_p$, and since it is possible to generate all of the other numbers with odd exponents
\[
    g^{odd}=g^{\frac{p-1}{2} \pm even} = g^{\frac{p-1}{2}}g^{ \pm even} \implies -1(g^{\pm even})
\]
and $g$ powered to odd exponents will have this form. From here, it's possible to state the following:

\begin{lemma}
    $\forall z \in \quadres_p \implies -z \notin \quadres_p$
\end{lemma}

\subsection{Rabin's Trapdoor permutation}

Now we study a one-way function built on previous deductions about number theory and modular arithmetic. The \emph{Rabin trapdoor permutation} is defined as:
\[
    f(x) = x^2 \mod n
\]
where $n = pq$ for primes $p, q \equiv_4 3$.

We can observe that the image of this function is $\quadres_n$, a subset of $\integer_n^\times$.

Because of \textsc{crt}, it is possible to state that $f$ maps as follows:
\[
    x = (x_p, x_q) \implies x^2 = (x^2_p, x^2_q)
\]
since each element of $\integer_n$ has always two different forms, in $\integer_p$ and in $\integer_q$. So
\[
    y \in  \quadres_n \Leftrightarrow y_p \in \quadres_p \wedge y_q \in \quadres_q
\]

As before, the image of $f$ is exactly
\[
    \quadres_n = \{ y : \exists x : y \equiv_n x^2\}
\]

If we try to invert the function $f$, even without applying the previous inversion algorithm, we easily note that among the 4 possible values:

\[
    f^{-1}(y) = \{(x_p, x_q),(-x_p, x_q),(x_p, -x_q)(-x_p, -x_q)\}
\]

only 1 is a quadratic residue since we said, in the last lemma, that only one out of $-x_k, x_k$ is a quadratic residue for $k = q,p$.

Therefore, we have that the Rabin's \tdp{} is a permutation in $\quadres_n$, and that the cardinality of $\quadres_n$ is $\frac{|\integer_n^\times|}{4}$. Furthermore, with the following claim we can state that the Rabin cryptosystem is a \owf{} thanks to the \textsc{fact} assumption.

\begin{claim}
    Given $x$ and $z$ such that $x^2 \equiv_n z^2 \equiv_n y$:
    \[
        x \neq \pm z \implies n \text{\textup{ is factorizable}}
    \]
\end{claim}

\begin{proof}
    Since $f^{-1}(y)$ has only one value out of four, $x \neq \pm z$ and $z$ is either $\{(x_p, x_q), (-x_p, -x_q)\}$, then:
    \[
        x \in \{(x_p, -x_q), (-x_p, x_q)\} \implies x + z \in \{(0, 2x_q), (2x_p, 0)\}
    \]
    Now assume $x + z = (2x_p, 0)$ without loss of generality, since the proof for the other case is the same. We have that $x + z \equiv_q 0$ and $x + z \not\equiv_p 0$. But then $\gcd(x + z, n) = q$, and we obtain $q$.
\end{proof}

\begin{theorem}
    Squaring mod $n$, where $n$ is a \emph{Blum integer}\footnotemark is a trapdoor permutation under the factoring assumption.
\end{theorem}

\footnotetext{a Blum integer $n$ is the product of two numbers $p$ and $q$ such that $p, q \equiv_4 3$, as the definition of Rabin's \tdp}

Since we have already shown that Rabin's function is a permutation since it is invertible, we have to show that Rabin's function is also \owf:

\begin{proposition}
\[
    \textsc{fact} \implies f(x) \in \owf \qedhere
\]
\end{proposition}

\begin{proof}
    The proof is by contradiction. Assume there is an adversary \adversary{} who, given $y \equiv_n x^2$, can find an integer $z \in \integer_n$ such that $z^2 \mod n = y$ while $z \neq \pm x$. We can build a reduction as the one in figure \ref{cryptoredux:blumtdp} to show that \adversary{} chooses $x$, here $\mathcal{B}lum$ is a sampler for Blum integers:

    % AP190902: The adversary had a "fact" subscript, is it important?
    \begin{cryptoredux}
        {blumtdp}
        {---}
        {fact}
        {rabin}[1.8]

        \receive{$(p, q, n) \pickUAR \mathcal{B}lum$}{$n = pq$}{}

        \cseqdelay

        \invoke{\shortstack[l]{
            $x \pickUAR \integer_n^\times$ \\
            $y \equiv_n x^2$
        }}{$n, y$}{}

        \cseqdelay

        \return{}{$z$}{$f(z) = f(x)$}

    \end{cryptoredux}

    Once obtained $z\neq \pm x$ which $z^{2}=y$ we can use \textbf{Claim 1}(just summing $x$ and $z$ and analyzing the result) to factorize $n$ in polynomial time. But factorizing $n$ in polynomial time is not possible.
\end{proof}


\chapter{BACKGROUND STUDY}
\section{What is an algorithm?}An algorithm is a process or set of rules to be followed in calculations or other problem-solving operations, especially by a computer.Broadly,it is a step-by-step procedure for solving a problem or accomplishing some end especially by a computer.\\
\section{Classification of algorithms.}Based on various criteria, algorithms are divided into:-\\
ON THE BASIS OF SEQUENCE OF THE INTERNAL EXECUTIONS\\
\subsection{Deterministic algorithms.}Deterministic algorithms can be defined in terms of a state machine: a state	describes what a machine is doing at a particular instant in time.If the machine is deterministic, this means that from this point onwards, its current state determines what its next state will be its course through the set of states is predetermined.This type of algorithms are such which, given a particular input, will always 	produce the same output, with the underlying machine always passing through the same sequence of states.In simple words, deterministic algorithms produce on a given input the same results following the same computation steps.\\
Although real programs are rarely purely deterministic, it is easier for humans as 	well as other programs to reason about programs that are.To solve real time problems if we use deterministic algorithm its time complexity increases exponentially when dimension increases.Example - if you are sorting elements that are strictly ordered(no equal elements) the output is well defined and so the algorithm is deterministic.\\
\subsection{Non-Deterministic algorithms.}A randomized or non-deterministic algorithm is an algorithm that, even for the same input, can exhibit different behaviors on different runs. It is different from its more familiar deterministic counterpart in its ability to arrive at outcomes using various routes. In other words, a non-deterministic algorithm represents a single path stemming into many paths, some of which may arrive at the same output and some of which may arrive at unique outputs.
Example – Evolutionary algorithms.\\
In computational complexity theory, non-deterministic algorithms are ones that, at every possible step, can allow for multiple continuations (imagine a man walking down a path in a forest and, every time he steps further, he must pick which fork in the road he wishes to take). These algorithms do not arrive at a solution for every possible computational path; however, they are guaranteed to arrive at a correct solution for some path (i.e., the man walking through the forest may only find his cabin if he picks some combination of "correct" paths).\\
TYPES OF RANDOMIZED ALGORITHMS:-\\
1. \textbf{Las Vegas type algorithms}\\
A Las Vegas algorithm will always produce the same result on a given input.Randomization will only affect the order of the internal executions.Example- Quick sort\\
2.\textbf{ Monte Carlo type algorithms}\\
In the case of Monte Carlo algorithms, the result may might change, even be wrong.However, a Monte Carlo algorithm will produce the correct result with a certain probability. Example- PSO\\
\includegraphics[width=0.8\textwidth]{./pic}\\[1cm]
ON THE BASIS OF availability OF INPUT:-\\
\subsection{Online algorithms.}Online algorithms are algorithms that do not know their input at the beginning; it is 	given to them online. Such algorithms are DYNAMIC in nature.Example - ski problem. A skier must decide every day she goes skiing, whether to rent or to buy skis, unless or until she decides to buy them. The skier does not know how many days she can ski, because the weather is unpredictable.\\
\subsection{Offline algorithms.}Offline algorithms are algorithms know their input at the beginning, i.e. input is predetermined.Such algorithms are STATIC in nature.\\
\section{Types of problems.}The total defined problem sphere has been divided into four classes - \textbf{P, NP, NP-complete and NP-Hard problems}.\\
\subsection{ P and NP class.}\textbf{P} is set of problems that can be solved by a deterministic algorithm in Polynomial time.\\
\textbf{NP} is set of decision problems that can be solved by a non-deterministic algorithm in Polynomial time.P is subset of NP (any problem that can be solved by deterministic machine in polynomial time can also be solved by non-deterministic machine in polynomial time).\\
\subsection{ NP-complete.}\textbf{NP-complete} problems are the hardest problems in NP set. A decision problem is NP-complete if:\\
1) L is in NP (Any given solution for NP-complete problems can be verified quickly, but there is no efficient known solution).\\
2) Every problem in NP is reducible to L in polynomial time.\\
\subsection{NP-hard.}\textbf{NP-Hard }- A problem is NP-Hard if it follows property 2 mentioned above, doesn’t need to follow property 1.This means a problem K is NP-Hard if every problem in NP is reducible to K in polynomial time but the problem may or may not be in NP. Therefore, NP-Complete set is also a subset of NP-Hard set.\\
\section{Why non-deterministic algorithm?}In algorithm design, non-deterministic algorithms are often used when the problem solved by the algorithm inherently allows multiple outcomes (or when there is a single outcome with multiple paths by which the outcome may be discovered, each equally preferable.
As we know that increasing dimension or input size increases the complexity of problem and using a deterministic algorithm under such situations, increases the time complexity exponentially. So, we use non-deterministic algorithms for such problems. The class of NP-complete and NP-hard problems falls under this category. Such problems can be solved using a deterministic algorithm, but then it would require huge amount of time, may be a day, an year or even more,which is not feasible in real-time.So,we use some non-determinism i.e. randomicity while solving such problems.Hence, to solve problems corresponding to NP-complete and NP-hard class we use non-deterministic algorithms.\\


\documentclass[12pt]{article}
\usepackage{amsmath}
\usepackage[margin=2cm]{geometry}

\begin{document}

\tableofcontents

\newpage
\section{Signing algorithm}

\noindent
Consider two certificates $P$ and $Q$ where $P$ is signed by $Q$.
Let $s$ be the signature in $P$ and let $k$ be the public
key in $Q$.

\begin{center}
\begin{tabular}{|c|}
\hline
$\quad P\quad$\\
\\
\\
\\
\\
\\
\hline
$s$\\
\hline
\end{tabular}
\qquad
\begin{tabular}{|c|}
\hline
$\quad Q\quad$\\
\\
\\
\hline
$k$\\
\hline
\\
\\
\\
\hline
\end{tabular}
\end{center}

\noindent
By necessity $s$ and $k$ are compatible.
For example, if $k$ is RSA 2048 then $s$ is a PKCS\footnote{RFC 3447 Public-Key Cryptography Standards (PKCS)}
signature that is 2048 bits in length (256 bytes).

\bigskip
\noindent
A hash digest of $P$ is contained in $s$.
For example, the following unencrypted signature $s$ is for RSA 2048 and hash digest SHA256.
(Numerals are in hexadecimal.)

\begin{center}
\begin{tabular}{|c|c|}
\hline
{\footnotesize\tt 00 01 ff $\cdots$ ff 00 30 31 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00 04 20} & HASH\\
\hline
\end{tabular}

\medskip
Signature $s$ (plaintext)
\end{center}

\noindent
The length of HASH is 32 bytes because SHA256 is used.
The 19 byte sequence starting with $\tt 30$ is from
``Abstract Syntax Notation One.''
The {\tt ff} bytes are pad bytes that are added to make the total length of the signature 2048 bits (256 bytes).
Hence there are $256-3-19-32=202$ pad bytes.

\bigskip
\noindent
Note that the above signature is the unencrypted value of $s$.
In the actual certificate, $s$ is encrypted using the private key associated with $k$.
After encryption, $s$ is still 256 bytes long.

\begin{center}
\begin{tabular}{|c|}
\hline
{\footnotesize\tt
76 b6 97 82 0f 06 b7 48 59 02 a0 2c f4 $\cdots$
fe c3 61 25 5b 1c da 77 9a a1 63 d4 49 cd}\\
\hline
\end{tabular}

\medskip
Signature $s$ (encrypted)
\end{center}

\noindent
To prove that $P$ is signed by $Q$, $s$ is decrypted using $Q$'s public key $k$.
Then if HASH matches a digest of $P$, the signing of $P$ by $Q$ is proven.

\bigskip
\noindent
Proving ``$P$ signed by $Q$'' proves that $s$ was encrypted using the private key associated with $k$.
Only the owner of $Q$ knows the private key.
No one can change the contents of $P$ without breaking the hash digest in $s$,
and no one can change $s$ without knowing the private key.
Hence we can trust the contents of $P$ if we trust $Q$.

\newpage
\section{RSA functions}

\bigskip
\bigskip
\begin{verbatim}
void rsa_encrypt_signature
          (uint8_t *sig, int len, struct keyinfo *key)
\end{verbatim}

\noindent
Encrypts signature {\tt sig} in situ using the private key in {\tt key}.
Argument {\tt len} is the length of the signature in bytes.
This function is used to sign a certificate.

\bigskip
\bigskip
\begin{verbatim}
uint8_t *rsa_decrypt_signature
          (struct certinfo *p, struct certinfo *q)
\end{verbatim}

\noindent
Decrypts the signature in certificate {\tt p} using the public key in {\tt q} and returns the result.
On success, the result is returned in a malloc'd buffer that the caller should free.
The length of the buffer is the same as the signature length.
Returns NULL on error.

\newpage
\section{Elliptic curve functions}

\subsection{prime256v1}

\bigskip
\bigskip
\begin{verbatim}
void ec256_encrypt
          (struct keyinfo *key, uint8_t *hash, int len, uint8_t *sig)
\end{verbatim}

\noindent
Encrypts {\tt hash} using the private key in {\tt key}.
The 64 byte result is returned in {\tt sig}.
This function is used to sign a certificate.

\bigskip
\begin{tabular}{ll}
{\tt key} & Pointer to a private key.\\
{\tt hash} & Pointer to a hash digest value.\\
{\tt len} & Byte length of hash digest value (32 bytes maximum).\\
{\tt sig} & Pointer to a 64 byte buffer.
\end{tabular}

\bigskip
\bigskip
\begin{verbatim}
int ec256_verify
          (struct certinfo *p, struct certinfo *q)
\end{verbatim}

\noindent
Returns 0 if certificate {\tt p} is signed by {\tt q}
where the public key type of {\tt q} is prime256v1.

\bigskip
\subsection{secp384r1}

\bigskip
\bigskip
\begin{verbatim}
void ec384_encrypt
          (struct keyinfo *key, uint8_t *hash, int len, uint8_t *sig)
\end{verbatim}

\noindent
Encrypts {\tt hash} using the private key in {\tt key}.
The 96 byte result is returned in {\tt sig}.
This function is used to sign a certificate.

\bigskip
\begin{tabular}{ll}
{\tt key} & Pointer to a private key.\\
{\tt hash} & Pointer to a hash digest value.\\
{\tt len} & Byte length of hash digest value (48 bytes maximum).\\
{\tt sig} & Pointer to a 96 byte buffer.
\end{tabular}

\bigskip
\bigskip
\begin{verbatim}
int ec384_verify
          (struct certinfo *p, struct certinfo *q)
\end{verbatim}

\noindent
Returns 0 if certificate {\tt p} is signed by {\tt q}
where the public key type of {\tt q} is secp384r1.

\newpage
\section{Hash functions}

\bigskip
\bigskip
\begin{verbatim}
void md5(uint8_t *buf, int len, uint8_t *out)
void sha1(uint8_t *buf, int len, uint8_t *out)
void sha224(uint8_t *buf, int len, uint8_t *out)
void sha256(uint8_t *buf, int len, uint8_t *out)
void sha384(uint8_t *buf, int len, uint8_t *out)
void sha512(uint8_t *buf, int len, uint8_t *out)
\end{verbatim}

\noindent
The hash value of {\tt buf} is returned in {\tt out}.
Argument {\tt len} is the length of {\tt buf} in bytes.
The following table shows the byte length of each result.

\bigskip
\noindent
\begin{tabular}{|l|l|}
\hline
Digest & Length\\
\hline
MD5 & 16 bytes\\
SHA1 & 20\\
SHA224 & 28\\
SHA256 & 32\\
SHA384 & 48\\
SHA512 & 64\\
\hline
\end{tabular}

\bigskip
\noindent
The hash value of a certificate is encrypted in the certificate signature.

\newpage
\section{ASN.1 Encodings}

\noindent
Encoded integers may have an extra leading 00 byte added due to encoding rules.
Encoding rules add the 00 byte if the first byte of the unencoded integer is greater than 127.

\bigskip
\noindent
For example, a 256 byte RSA modulus that begins with hex 80 is encoded as 257 bytes.

\newpage
\subsection{RSA}

\subsubsection{Public key}

\noindent
The following example is for RSA 1024 which has a 128 byte modulus.
The two integers in the encoding are the modulus followed by the exponent.

\begin{verbatim}
134 159:     SEQUENCE {
137  13:       SEQUENCE {
139   9:         OBJECT IDENTIFIER rsaEncryption (1 2 840 113549 1 1 1)
150   0:         NULL
       :         }
152 141:       BIT STRING, encapsulates {
156 137:         SEQUENCE {
159 129:           INTEGER
       :             00 C4 B9 4C 7D 39 E6 64 4E 66 88 92 60 24 AC C8
       :             C7 80 19 3D B9 05 A9 0D 56 EE 2D B6 DB D9 73 C2
       :             0C 97 6F E8 08 FE DC 5B 55 0A 5E FA B0 66 F7 B2
       :             EA 78 31 45 4C 58 3D 49 F2 09 AF C8 37 81 86 7D
       :             C1 55 1F 9F EA 8C DB ED 5B 28 2E 2D 7B CD 84 77
       :             4D 06 9D 57 E7 BE 23 6F 39 08 73 F4 3C 89 35 AF
       :             65 FE B1 C0 5B 19 A3 60 78 80 DB 07 6D 36 28 C8
       :             A0 EB CA 2D 5C 1D B2 A0 9C 59 0F 6E E2 AA 9D B5
       :             27
291   3:           INTEGER 65537
       :           }
       :         }
       :       }
\end{verbatim}

\subsubsection{Signature}

\noindent
The signature is the bit string field at the end of the certificate.
The length of the signature is the same as the unencoded RSA modulus.
In this case (RSA 1024) the length is 128 bytes.

\begin{verbatim}
296  13:   SEQUENCE {
298   9:     OBJECT IDENTIFIER sha256WithRSAEncryption (1 2 840 113549 1 1 11)
309   0:     NULL
       :     }
311 129:   BIT STRING
       :     7E 97 8C BA 48 9D 89 C8 98 E4 77 27 E4 01 54 4D
       :     65 BB 96 04 46 43 C2 4A F4 6C B3 19 9A 4B 56 28
       :     10 99 4C 5F 12 D9 3D 36 5F BC C7 C9 F2 28 1A 24
       :     5D 09 05 AA 85 17 18 E6 B0 1D C9 C6 CD 8A AE 10
       :     6F AA 9E 6E 09 B6 C5 85 54 2D CF 7B A0 B8 72 67
       :     86 9C 51 35 8D ED 17 8A 48 23 A4 82 53 3C BE 29
       :     5A 7D DA 00 B5 D3 9F EC 9A 6F 3D 95 B7 B4 64 72
       :     56 D1 3C DA 62 BD 4B 45 81 C2 D4 35 E1 06 DB 24
\end{verbatim}

\newpage
\subsection{prime256v1}

\subsubsection{Public key}

\noindent
Bit string data is the byte sequence $(04\mid X\mid Y)$.
The length of $X$ is 32 bytes and the length of $Y$ is 32 bytes.

\begin{verbatim}
162  89:     SEQUENCE {
164  19:       SEQUENCE {
166   7:         OBJECT IDENTIFIER ecPublicKey (1 2 840 10045 2 1)
175   8:         OBJECT IDENTIFIER prime256v1 (1 2 840 10045 3 1 7)
       :         }
185  66:       BIT STRING
       :         04 AB AA 1E 30 A0 41 00 05 C5 7F 32 E3 99 B8 BE
       :         3B 8A C1 4A A2 A3 4C CB 3C 44 97 04 4D D2 99 F1
       :         E9 CD FE 63 B3 C4 B7 05 99 1B 94 1B 87 3B 47 BA
       :         3A 76 AA 37 96 2F 89 47 31 53 EB 77 E6 43 17 D2
       :         3B
       :       }
\end{verbatim}

\subsubsection{Signature}

\noindent
The two integers in the encoding are $R$ followed by $S$.
The unencoded length of $R$ is 32 bytes and the unencoded length of $S$ is 32 bytes.

\begin{verbatim}
253  10:   SEQUENCE {
255   8:     OBJECT IDENTIFIER ecdsaWithSHA256 (1 2 840 10045 4 3 2)
       :     }
265  72:   BIT STRING, encapsulates {
268  69:     SEQUENCE {
270  33:       INTEGER
       :         00 9F 3F A9 AE 97 A0 48 52 AA AA AF 3E CA BA 62
       :         5F 6C 2C 46 BB 29 D0 19 A6 14 EA C0 5D 0E B9 B8
       :         D5
305  32:       INTEGER
       :         16 76 0A FC 4D 9C 6F 65 BD D2 8B CA EF C5 6E 07
       :         76 46 13 1D CF 39 A8 E3 80 D8 BD 2E B2 F9 89 0D
       :       }
       :     }
\end{verbatim}

\newpage
\subsection{secp384r1}

\subsubsection{Public key}

\noindent
Bit string data is the byte sequence $(04\mid X\mid Y)$.
The length of $X$ is 48 bytes and the length of $Y$ is 48 bytes.

\begin{verbatim}
163 118:     SEQUENCE {
165  16:       SEQUENCE {
167   7:         OBJECT IDENTIFIER ecPublicKey (1 2 840 10045 2 1)
176   5:         OBJECT IDENTIFIER secp384r1 (1 3 132 0 34)
       :         }
183  98:       BIT STRING
       :         04 42 62 D9 F6 76 24 10 AE 1B 60 1F 59 45 C5 7D
       :         69 89 A3 A7 29 92 40 E6 BF FD F0 D0 20 55 BD 97
       :         5E 2B D8 BB 14 56 30 08 6E F0 02 A8 DB F4 DD C5
       :         BD DD 69 AB 39 B9 32 FC 55 D4 D5 8C 70 8E 27 3C
       :         AA A0 72 67 22 AB 1D DF 41 B5 D4 99 6D 32 7C 06
       :         ED 48 9F 31 E5 BD 10 AA 09 E7 5B 19 B6 8D 23 43
       :         27
       :       }
\end{verbatim}

\subsubsection{Signature}

\noindent
The two integers in the encoding are $R$ followed by $S$.
The unencoded length of $R$ is 48 bytes and the unencoded length of $S$ is 48 bytes.

\begin{verbatim}
283  10:   SEQUENCE {
285   8:     OBJECT IDENTIFIER ecdsaWithSHA256 (1 2 840 10045 4 3 2)
       :     }
295 104:   BIT STRING, encapsulates {
298 101:     SEQUENCE {
300  48:       INTEGER
       :         33 30 98 0F AA 4C 83 A1 0C 17 F9 3F 2F 05 F7 92
       :         2B 97 E9 2E E5 63 33 26 29 36 10 4F 65 2F E4 BA
       :         FF 14 09 0E 6B 07 BC 3D 8C 62 E0 4E 9C 4E B4 37
350  49:       INTEGER
       :         00 F6 6E EC 4F F9 5B 37 DC 8D E3 E9 B3 CA 13 0C
       :         5A BE F4 72 E4 4B 7A B4 BF C7 05 F1 71 83 77 68
       :         DF CF F3 CA B2 3E C5 8F E6 7E 34 B7 B4 AB 6F D5
       :         4F
       :       }
       :     }
\end{verbatim}

\newpage
\section{References}

\noindent
Certicom Corp., ``Standards for Efficient Cryptography 1 (SEC 1: Elliptic Curve Cryptography)''

\bigskip
\noindent
FIPS Publication 180-4, Secure Hash Standard

\bigskip
\noindent
Kaliski B., ``A Layman's Guide to a Subset of ASN.1, BER, and DER''

\bigskip
\noindent
NIST, ``Mathematical routines for the NIST prime elliptic curves''

\bigskip
\noindent
RFC 1321 The MD5 Message-Digest Algorithm

\bigskip
\noindent
RFC 3447 Public-Key Cryptography Standards (PKCS)

\end{document}