WEBVTT 00:00:00.000 --> 00:00:00.500 align:middle line:90% 00:00:00.500 --> 00:00:02.000 align:middle line:90% [SQUEAKING] 00:00:02.000 --> 00:00:03.500 align:middle line:90% [RUSTLING] 00:00:03.500 --> 00:00:05.000 align:middle line:90% [CLICKING] 00:00:05.000 --> 00:00:11.655 align:middle line:90% 00:00:11.655 --> 00:00:13.280 align:middle line:84% ANKUR MOITRA: So here, the way to think 00:00:13.280 --> 00:00:16.760 align:middle line:84% about modular arithmetic is that it's about relationships 00:00:16.760 --> 00:00:18.480 align:middle line:90% between numbers. 00:00:18.480 --> 00:00:20.620 align:middle line:84% So some of these, you've already seen before 00:00:20.620 --> 00:00:21.660 align:middle line:90% and are pretty familiar. 00:00:21.660 --> 00:00:23.760 align:middle line:84% So, for example, if I take an even number 00:00:23.760 --> 00:00:26.680 align:middle line:84% and add an odd number to it, then I definitely 00:00:26.680 --> 00:00:28.440 align:middle line:90% get an odd number. 00:00:28.440 --> 00:00:31.060 align:middle line:84% And if I take an even number and add an even number, 00:00:31.060 --> 00:00:32.960 align:middle line:90% I get an even number. 00:00:32.960 --> 00:00:35.360 align:middle line:84% So even though these things are familiar, even, 00:00:35.360 --> 00:00:37.880 align:middle line:84% from elementary school, we're going 00:00:37.880 --> 00:00:39.960 align:middle line:84% to talk about generalizations and go 00:00:39.960 --> 00:00:42.480 align:middle line:90% a lot further with these ideas. 00:00:42.480 --> 00:00:45.000 align:middle line:84% Really, the way to think about this simple example 00:00:45.000 --> 00:00:49.760 align:middle line:84% is it's what's called arithmetic modulo 2. 00:00:49.760 --> 00:00:52.140 align:middle line:84% So by that, I mean you're doing arithmetic, 00:00:52.140 --> 00:00:54.560 align:middle line:84% but you're only keeping track of the remainders 00:00:54.560 --> 00:00:57.200 align:middle line:90% when you divide by 2. 00:00:57.200 --> 00:00:59.160 align:middle line:84% So for today's lecture, we're going 00:00:59.160 --> 00:01:01.170 align:middle line:84% to have the following key definition that's 00:01:01.170 --> 00:01:04.170 align:middle line:84% going to take this idea much further, 00:01:04.170 --> 00:01:13.450 align:middle line:84% which is we're going to say that two integers, a and b, 00:01:13.450 --> 00:01:17.690 align:middle line:84% well, we're going to write the following expression 00:01:17.690 --> 00:01:21.930 align:middle line:90% a congruent to b mod n. 00:01:21.930 --> 00:01:25.930 align:middle line:84% So this is pronounced as a congruent to b mod n. 00:01:25.930 --> 00:01:28.730 align:middle line:84% And we'll write this expression if and only 00:01:28.730 --> 00:01:37.110 align:middle line:84% if a and b differ by a multiple of n. 00:01:37.110 --> 00:01:43.050 align:middle line:90% 00:01:43.050 --> 00:01:44.230 align:middle line:90% So that's it. 00:01:44.230 --> 00:01:47.352 align:middle line:84% That's our key definition that we're going to explore today. 00:01:47.352 --> 00:01:48.810 align:middle line:84% But we're going to see that there's 00:01:48.810 --> 00:01:52.490 align:middle line:84% a lot of meat to this in terms of understanding how to work 00:01:52.490 --> 00:01:54.930 align:middle line:90% with modular arithmetic. 00:01:54.930 --> 00:01:56.610 align:middle line:84% So another way that you'll sometimes 00:01:56.610 --> 00:02:00.610 align:middle line:84% hear modular arithmetic described is as clock math. 00:02:00.610 --> 00:02:03.570 align:middle line:84% So I'll explain what that metaphor means in a minute. 00:02:03.570 --> 00:02:06.010 align:middle line:84% But let me tell you the key result 00:02:06.010 --> 00:02:11.290 align:middle line:84% that we're going to use to reason about modular arithmetic. 00:02:11.290 --> 00:02:16.690 align:middle line:84% And this will also be something that's familiar from long ago. 00:02:16.690 --> 00:02:19.310 align:middle line:84% But we're going to state this a little bit precisely. 00:02:19.310 --> 00:02:22.170 align:middle line:84% This is, really, a corollary of what 00:02:22.170 --> 00:02:25.210 align:middle line:84% you learned in elementary school, namely, 00:02:25.210 --> 00:02:27.250 align:middle line:90% long-form division. 00:02:27.250 --> 00:02:43.690 align:middle line:84% So what I claim is that, for any integers a and n where n is 00:02:43.690 --> 00:02:46.850 align:middle line:84% strictly positive because it's our divisor, 00:02:46.850 --> 00:02:58.620 align:middle line:84% what I claim is that there is a unique pair of, again, 00:02:58.620 --> 00:03:06.220 align:middle line:84% integers q and r-- and these are suggestively chosen because q is 00:03:06.220 --> 00:03:08.380 align:middle line:84% the quotient, and r is the remainder-- 00:03:08.380 --> 00:03:11.380 align:middle line:90% with the following property-- 00:03:11.380 --> 00:03:16.980 align:middle line:84% we can write a as q times n plus r. 00:03:16.980 --> 00:03:21.300 align:middle line:84% And the crucial thing is that this remainder, r, 00:03:21.300 --> 00:03:24.940 align:middle line:84% is between 0 and n and cannot be as large as n. 00:03:24.940 --> 00:03:27.980 align:middle line:84% So it's really between 0 and n minus 1. 00:03:27.980 --> 00:03:29.740 align:middle line:84% So this is really the corollary of what 00:03:29.740 --> 00:03:33.900 align:middle line:84% we learned in elementary school about long-form division. 00:03:33.900 --> 00:03:37.500 align:middle line:84% I can take any integer and some divisor n, 00:03:37.500 --> 00:03:41.060 align:middle line:84% and I can write a as q multiples of n 00:03:41.060 --> 00:03:43.300 align:middle line:84% and then whatever I have left over. 00:03:43.300 --> 00:03:45.300 align:middle line:84% And the crucial thing is what I have left over 00:03:45.300 --> 00:03:48.940 align:middle line:84% is an integer between 0 and n minus 1. 00:03:48.940 --> 00:03:50.620 align:middle line:84% So these are just the basic facts 00:03:50.620 --> 00:03:53.940 align:middle line:84% that will help us make sense of modular arithmetic. 00:03:53.940 --> 00:03:59.340 align:middle line:84% And let's go over some basic facts about digesting 00:03:59.340 --> 00:04:01.540 align:middle line:90% what this expression means-- 00:04:01.540 --> 00:04:04.100 align:middle line:84% what are all the equivalent ways to think 00:04:04.100 --> 00:04:06.120 align:middle line:84% about what this expression is saying, 00:04:06.120 --> 00:04:08.323 align:middle line:90% that a is congruent to b? 00:04:08.323 --> 00:04:09.740 align:middle line:84% So what we're going to do is we're 00:04:09.740 --> 00:04:12.760 align:middle line:84% going to learn the language of modular arithmetic. 00:04:12.760 --> 00:04:15.580 align:middle line:84% It's a little bit like relearning arithmetic 00:04:15.580 --> 00:04:17.380 align:middle line:84% from scratch but trying to remember 00:04:17.380 --> 00:04:21.700 align:middle line:84% what rules you're still allowed to do and what rules change. 00:04:21.700 --> 00:04:24.580 align:middle line:90% So let's be careful with this. 00:04:24.580 --> 00:04:27.580 align:middle line:84% Let's prove our first key fact, and this will 00:04:27.580 --> 00:04:31.380 align:middle line:90% be an extremely powerful fact. 00:04:31.380 --> 00:04:33.900 align:middle line:84% So what I claim is that this expression, a is 00:04:33.900 --> 00:04:39.980 align:middle line:84% congruent to b mod n, well, we know what this expression means. 00:04:39.980 --> 00:04:42.700 align:middle line:84% a and b differ by a multiple of n. 00:04:42.700 --> 00:04:45.820 align:middle line:84% I claim that this is true if and only 00:04:45.820 --> 00:04:51.020 align:middle line:84% if the remainder of a divided by n 00:04:51.020 --> 00:04:57.790 align:middle line:84% equals the remainder of b when I divide by n. 00:04:57.790 --> 00:05:00.390 align:middle line:84% So this is a very intuitive fact. 00:05:00.390 --> 00:05:03.110 align:middle line:84% This is what was going on right here 00:05:03.110 --> 00:05:07.510 align:middle line:84% is that we think about evens as being a set of numbers 00:05:07.510 --> 00:05:09.430 align:middle line:90% that are congruent mod 2. 00:05:09.430 --> 00:05:12.430 align:middle line:84% And that's if and only if the remainder when I divide by 2 is 00:05:12.430 --> 00:05:13.150 align:middle line:90% zero. 00:05:13.150 --> 00:05:15.350 align:middle line:84% And something is odd if and only if its remainder 00:05:15.350 --> 00:05:17.710 align:middle line:90% is 1 when I divide by 2. 00:05:17.710 --> 00:05:20.310 align:middle line:84% But this is true for modular arithmetic even more 00:05:20.310 --> 00:05:22.150 align:middle line:90% generally than this. 00:05:22.150 --> 00:05:25.230 align:middle line:84% So this gives us a powerful way that we'll 00:05:25.230 --> 00:05:28.310 align:middle line:84% use this fact later to great effect 00:05:28.310 --> 00:05:30.750 align:middle line:84% for talking about the Euclidean algorithm. 00:05:30.750 --> 00:05:32.710 align:middle line:84% But for right now, let's just make sure 00:05:32.710 --> 00:05:37.230 align:middle line:84% that we're on the same page and that we can understand 00:05:37.230 --> 00:05:40.630 align:middle line:90% why this fact is true. 00:05:40.630 --> 00:05:44.390 align:middle line:84% So we can prove both directions of this implication. 00:05:44.390 --> 00:05:48.110 align:middle line:84% So let's prove the backwards direction. 00:05:48.110 --> 00:05:58.310 align:middle line:84% So let's suppose that a is equal to qn plus r 00:05:58.310 --> 00:06:03.190 align:middle line:84% and that b is equal to q prime n plus r. 00:06:03.190 --> 00:06:05.190 align:middle line:84% So r is the remainder, so I'm just 00:06:05.190 --> 00:06:08.390 align:middle line:84% assuming that the remainder of a divided by n 00:06:08.390 --> 00:06:12.350 align:middle line:84% is the same as the remainder of b divided by n because they 00:06:12.350 --> 00:06:16.710 align:middle line:84% both have the same extra term for the remainder. 00:06:16.710 --> 00:06:19.470 align:middle line:84% And now what we can do is we can just remember 00:06:19.470 --> 00:06:21.370 align:middle line:90% what this expression means. 00:06:21.370 --> 00:06:26.190 align:middle line:84% We can look at a minus b, the difference between a and b. 00:06:26.190 --> 00:06:31.230 align:middle line:84% And we can write this as q minus q prime times n. 00:06:31.230 --> 00:06:33.030 align:middle line:90% And the r's cancel. 00:06:33.030 --> 00:06:35.830 align:middle line:84% So this gives us what we're looking for. 00:06:35.830 --> 00:06:39.710 align:middle line:84% The statement that a and b are congruent mod n is equivalent 00:06:39.710 --> 00:06:43.150 align:middle line:84% to the statement right here that their difference is an integer 00:06:43.150 --> 00:06:47.910 align:middle line:84% multiple of n and q minus q prime is an integer. 00:06:47.910 --> 00:06:48.650 align:middle line:90% So we're good. 00:06:48.650 --> 00:06:51.080 align:middle line:90% We proved one direction. 00:06:51.080 --> 00:06:53.360 align:middle line:84% So this proves the first implication, 00:06:53.360 --> 00:06:56.080 align:middle line:84% that if the remainders are the same, then they're congruent 00:06:56.080 --> 00:06:57.520 align:middle line:90% mod n. 00:06:57.520 --> 00:07:01.280 align:middle line:84% And we can prove the converse direction, too. 00:07:01.280 --> 00:07:09.400 align:middle line:84% So conversely, let's suppose that a is equal to qn plus r, 00:07:09.400 --> 00:07:15.680 align:middle line:84% and b is equal to q prime n plus r prime. 00:07:15.680 --> 00:07:22.960 align:middle line:84% Now, since a is congruent to b mod n, we know that a minus b 00:07:22.960 --> 00:07:26.280 align:middle line:84% is supposed to be equal to an integer multiple of n. 00:07:26.280 --> 00:07:31.240 align:middle line:84% And then we can remember what a and b are by assumption. 00:07:31.240 --> 00:07:36.120 align:middle line:84% And we can write this out as q minus q prime times 00:07:36.120 --> 00:07:41.240 align:middle line:90% n plus r minus r prime. 00:07:41.240 --> 00:07:44.080 align:middle line:84% And so now we can just focus on this expression. 00:07:44.080 --> 00:07:46.920 align:middle line:84% We know that a minus b is a multiple of n. 00:07:46.920 --> 00:07:50.410 align:middle line:84% And we can write the expression alternatively this way. 00:07:50.410 --> 00:07:52.330 align:middle line:84% But the key point is what's happening 00:07:52.330 --> 00:07:57.890 align:middle line:84% right here, that this term right here, r minus r prime, 00:07:57.890 --> 00:08:01.490 align:middle line:84% is an integer that's strictly larger than minus n 00:08:01.490 --> 00:08:04.570 align:middle line:90% and strictly smaller than n. 00:08:04.570 --> 00:08:10.470 align:middle line:84% So if k, if a minus b can be divided through by n-- 00:08:10.470 --> 00:08:13.170 align:middle line:90% we get some integer multiple-- 00:08:13.170 --> 00:08:16.010 align:middle line:84% the only choice-- n divides evenly here, 00:08:16.010 --> 00:08:17.570 align:middle line:90% and we get an integer-- 00:08:17.570 --> 00:08:22.450 align:middle line:84% the only way that a number that's between minus n and n 00:08:22.450 --> 00:08:23.390 align:middle line:90% and is strict-- 00:08:23.390 --> 00:08:25.050 align:middle line:90% these inequalities are strict-- 00:08:25.050 --> 00:08:29.770 align:middle line:84% and it divides through and gets an integer is if r minus r prime 00:08:29.770 --> 00:08:34.610 align:middle line:84% equals 0, in which case the two remainders are the same. 00:08:34.610 --> 00:08:38.330 align:middle line:84% So that's our key fact right here. 00:08:38.330 --> 00:08:41.090 align:middle line:84% It's just that we can use the division algorithm 00:08:41.090 --> 00:08:44.130 align:middle line:84% to connect very nicely with modular arithmetic. 00:08:44.130 --> 00:08:48.370 align:middle line:84% The statement that two numbers are congruent mod n is really 00:08:48.370 --> 00:08:51.490 align:middle line:84% a statement about what happens when we run the division 00:08:51.490 --> 00:08:53.970 align:middle line:90% algorithm on a versus b. 00:08:53.970 --> 00:08:55.350 align:middle line:84% We might get different quotients, 00:08:55.350 --> 00:08:57.690 align:middle line:84% but they better have the same remainder. 00:08:57.690 --> 00:08:58.830 align:middle line:90% So are there any questions? 00:08:58.830 --> 00:09:01.410 align:middle line:90% Does this make sense? 00:09:01.410 --> 00:09:02.090 align:middle line:90% Yeah? 00:09:02.090 --> 00:09:04.370 align:middle line:90% OK. 00:09:04.370 --> 00:09:11.320 align:middle line:84% So now let's think about how we can visualize what's going on. 00:09:11.320 --> 00:09:15.730 align:middle line:90% 00:09:15.730 --> 00:09:23.290 align:middle line:84% So the visual to keep in your head is of a clock. 00:09:23.290 --> 00:09:25.790 align:middle line:84% So we can think about something like 12, 00:09:25.790 --> 00:09:30.530 align:middle line:90% which is congruent to 5 mod 7. 00:09:30.530 --> 00:09:34.560 align:middle line:84% And what's really going on is that we take the integers 0 00:09:34.560 --> 00:09:39.800 align:middle line:84% to 6, and we put them evenly spread out along our clock. 00:09:39.800 --> 00:09:47.140 align:middle line:90% 00:09:47.140 --> 00:09:50.980 align:middle line:84% And now what's going on is when we take an integer like 5, 00:09:50.980 --> 00:09:56.300 align:middle line:84% we start off at 0, and we go around the clock until we hit 5. 00:09:56.300 --> 00:10:00.640 align:middle line:84% And if we take an integer like 12, we go around the clock, 00:10:00.640 --> 00:10:03.780 align:middle line:84% but we're going to loop one full time around, 00:10:03.780 --> 00:10:06.940 align:middle line:84% and we'll end up at the same, exact place. 00:10:06.940 --> 00:10:09.060 align:middle line:84% So that's sometimes why you'll hear it referred to 00:10:09.060 --> 00:10:13.680 align:middle line:84% as clock math is because, unlike ordinary integers here, 00:10:13.680 --> 00:10:17.100 align:middle line:84% we're not actually distinguishing between 12 and 5. 00:10:17.100 --> 00:10:19.740 align:middle line:84% These are in the same equivalence class 00:10:19.740 --> 00:10:21.980 align:middle line:84% because they land on the same position 00:10:21.980 --> 00:10:25.180 align:middle line:90% when we go around the clock. 00:10:25.180 --> 00:10:27.880 align:middle line:84% So this is the basics of modular arithmetic, 00:10:27.880 --> 00:10:31.580 align:middle line:84% but so far, we've only talked about addition. 00:10:31.580 --> 00:10:37.580 align:middle line:84% So the other piece we should talk about is multiplication. 00:10:37.580 --> 00:10:40.140 align:middle line:84% And then we can get to some action. 00:10:40.140 --> 00:10:42.140 align:middle line:84% So when we think about modular arithmetic, 00:10:42.140 --> 00:10:47.020 align:middle line:90% we already know how to add. 00:10:47.020 --> 00:10:54.240 align:middle line:84% And we can also ask how we multiply modulo n. 00:10:54.240 --> 00:11:00.260 align:middle line:90% 00:11:00.260 --> 00:11:03.620 align:middle line:84% So it turns out that you can kind of just do it. 00:11:03.620 --> 00:11:07.580 align:middle line:84% So if I have something like 10 is congruent to 3-- 00:11:07.580 --> 00:11:11.380 align:middle line:90% again, modulo 7-- 00:11:11.380 --> 00:11:18.140 align:middle line:84% I can multiply this by 12, which is congruent to 5 modulo 7. 00:11:18.140 --> 00:11:21.020 align:middle line:84% And one thing you can check is that you can just 00:11:21.020 --> 00:11:24.180 align:middle line:90% do multiplication as usual. 00:11:24.180 --> 00:11:28.580 align:middle line:84% You can multiply 12 by 10, and I get 120. 00:11:28.580 --> 00:11:32.660 align:middle line:84% And on my right-hand side, I get 15. 00:11:32.660 --> 00:11:37.660 align:middle line:84% But really, 15 is congruent to 1 modulo 7 00:11:37.660 --> 00:11:40.740 align:middle line:84% because I can take away two multiples of 7 00:11:40.740 --> 00:11:42.950 align:middle line:90% and get back down to 1. 00:11:42.950 --> 00:11:46.510 align:middle line:84% So basically, when you're doing addition and multiplication, 00:11:46.510 --> 00:11:50.150 align:middle line:84% you can always just multiply and add the way 00:11:50.150 --> 00:11:51.710 align:middle line:90% that you're familiar with. 00:11:51.710 --> 00:11:53.930 align:middle line:84% Just, at the end, after you're done, 00:11:53.930 --> 00:11:58.190 align:middle line:84% you take out as many integer multiples of the modulus 00:11:58.190 --> 00:12:02.350 align:middle line:84% as you need to to get back to an integer that's between 0 00:12:02.350 --> 00:12:04.270 align:middle line:90% and n minus 1. 00:12:04.270 --> 00:12:07.630 align:middle line:84% So a lot of things work out very nicely. 00:12:07.630 --> 00:12:12.910 align:middle line:84% But the way to think about this, really, is if you were to try 00:12:12.910 --> 00:12:16.990 align:middle line:84% and unwrap what's behind this notation, the statement 00:12:16.990 --> 00:12:24.110 align:middle line:84% that 10 times 12 modulo 7 is congruent to 1 00:12:24.110 --> 00:12:36.270 align:middle line:84% is really the statement that a number with remainder 3, all 00:12:36.270 --> 00:12:56.200 align:middle line:84% happening modulo 7, times a number with remainder 5 modulo 7 00:12:56.200 --> 00:13:06.450 align:middle line:84% gives a number with remainder 1, all modulo 7. 00:13:06.450 --> 00:13:12.440 align:middle line:90% 00:13:12.440 --> 00:13:15.680 align:middle line:84% So it's good to not get confused by what's happening 00:13:15.680 --> 00:13:17.960 align:middle line:90% in terms of this expression. 00:13:17.960 --> 00:13:21.230 align:middle line:84% What this expression really means, when I take any number, 00:13:21.230 --> 00:13:26.640 align:middle line:84% like some number like 10, whose remainder is 3 modulo 7, 00:13:26.640 --> 00:13:28.380 align:middle line:90% and I take any number-- 00:13:28.380 --> 00:13:32.680 align:middle line:84% say 12-- whose remainder is 5 mod 7, 00:13:32.680 --> 00:13:34.980 align:middle line:84% and I take the product of those two numbers-- 00:13:34.980 --> 00:13:38.400 align:middle line:84% I get this number on my left-hand side, 120-- 00:13:38.400 --> 00:13:42.080 align:middle line:84% and that number should have remainder 1 when 00:13:42.080 --> 00:13:44.640 align:middle line:90% I take it with the modulus 7. 00:13:44.640 --> 00:13:46.440 align:middle line:84% So that's really what's going on is 00:13:46.440 --> 00:13:50.800 align:middle line:84% it's the same generalization of what I wrote down right here 00:13:50.800 --> 00:13:54.520 align:middle line:84% is that you can forget what the actual even number was. 00:13:54.520 --> 00:13:57.260 align:middle line:84% All that matters is what its modulus is. 00:13:57.260 --> 00:14:00.340 align:middle line:84% Mod 2, I can forget what my odd number is. 00:14:00.340 --> 00:14:04.440 align:middle line:84% All that matters is that it has remainder 1 modulo 2. 00:14:04.440 --> 00:14:06.000 align:middle line:84% And I can still tell you something 00:14:06.000 --> 00:14:09.520 align:middle line:84% about the remainder when I add up those two numbers, even 00:14:09.520 --> 00:14:13.160 align:middle line:84% though I've forgotten the rest of the action of how many times 00:14:13.160 --> 00:14:15.480 align:middle line:90% around the clock I've gone. 00:14:15.480 --> 00:14:17.960 align:middle line:84% So that's the key way to think about it. 00:14:17.960 --> 00:14:21.120 align:middle line:84% So if you've seen it before, this is very easy. 00:14:21.120 --> 00:14:23.920 align:middle line:84% If you haven't seen it, this takes a little bit 00:14:23.920 --> 00:14:25.840 align:middle line:90% of wrapping your head around. 00:14:25.840 --> 00:14:28.360 align:middle line:84% So are there any questions about modular arithmetic, 00:14:28.360 --> 00:14:29.410 align:middle line:90% or does this make sense? 00:14:29.410 --> 00:14:32.360 align:middle line:90% 00:14:32.360 --> 00:14:33.960 align:middle line:90% Good? 00:14:33.960 --> 00:14:35.600 align:middle line:90% OK. 00:14:35.600 --> 00:14:38.210 align:middle line:84% So I'm trying to give you a lot of different ways 00:14:38.210 --> 00:14:39.930 align:middle line:90% to think about it. 00:14:39.930 --> 00:14:42.890 align:middle line:84% I'll also mention that you can think about these things 00:14:42.890 --> 00:14:45.210 align:middle line:90% abstractly, too. 00:14:45.210 --> 00:14:47.990 align:middle line:84% So we'll talk more about this in the next lecture, 00:14:47.990 --> 00:14:51.210 align:middle line:84% but when I'm working modulo 7, then I 00:14:51.210 --> 00:14:53.330 align:middle line:84% can really think about it as something 00:14:53.330 --> 00:14:56.210 align:middle line:84% called a group that we'll talk a lot more about. 00:14:56.210 --> 00:14:59.530 align:middle line:84% And, really, I can just think about the elements of that 00:14:59.530 --> 00:15:02.690 align:middle line:84% as being all of the possible remainders. 00:15:02.690 --> 00:15:04.770 align:middle line:84% And I have this table of how, exactly, 00:15:04.770 --> 00:15:08.450 align:middle line:84% to add up two numbers that belong to this set 00:15:08.450 --> 00:15:12.370 align:middle line:84% because when I add up remainders of 0, I get back to 0. 00:15:12.370 --> 00:15:16.690 align:middle line:84% When I add up 2 with 2, I get back to a remainder of 4. 00:15:16.690 --> 00:15:19.070 align:middle line:84% But see, I have interesting things happening here. 00:15:19.070 --> 00:15:23.370 align:middle line:84% When I take 4 and I add 4, I go back to the element 1 00:15:23.370 --> 00:15:25.050 align:middle line:84% because that's the new remainder I would 00:15:25.050 --> 00:15:28.490 align:middle line:90% get when I take it modulo 7. 00:15:28.490 --> 00:15:30.510 align:middle line:84% And the same type of thing happens here. 00:15:30.510 --> 00:15:33.050 align:middle line:84% This is our multiplication table. 00:15:33.050 --> 00:15:37.670 align:middle line:84% When I take something like 3 times 3, that'll give me 9. 00:15:37.670 --> 00:15:40.390 align:middle line:84% And when I subtract off the multiples of 7, 00:15:40.390 --> 00:15:42.490 align:middle line:90% I'm going to get back to 2. 00:15:42.490 --> 00:15:45.130 align:middle line:84% So, really, what's going on is that we're just 00:15:45.130 --> 00:15:48.810 align:middle line:84% redoing our addition and multiplication tables, just 00:15:48.810 --> 00:15:51.770 align:middle line:84% in the context of only keeping track of what 00:15:51.770 --> 00:15:54.250 align:middle line:90% the remainders are. 00:15:54.250 --> 00:15:56.050 align:middle line:90% Make sense? 00:15:56.050 --> 00:15:58.330 align:middle line:90% All right. 00:15:58.330 --> 00:16:00.250 align:middle line:84% So what I'm going to do is I'm going 00:16:00.250 --> 00:16:05.010 align:middle line:84% to tell you some more basic facts about modular arithmetic, 00:16:05.010 --> 00:16:08.610 align:middle line:84% and then we're going to do a demo just 00:16:08.610 --> 00:16:11.730 align:middle line:84% to give you a bit of a hint about why modular arithmetic is 00:16:11.730 --> 00:16:13.770 align:middle line:90% important. 00:16:13.770 --> 00:16:16.450 align:middle line:84% So, as I promised, many of the things 00:16:16.450 --> 00:16:19.570 align:middle line:84% that you're used to with ordinary arithmetic 00:16:19.570 --> 00:16:22.490 align:middle line:90% go through just the same. 00:16:22.490 --> 00:16:25.690 align:middle line:84% And I'll point out the things that don't. 00:16:25.690 --> 00:16:29.890 align:middle line:84% So one of the properties that we know and love is associativity. 00:16:29.890 --> 00:16:33.700 align:middle line:84% If I have some number modulo 7, I 00:16:33.700 --> 00:16:38.700 align:middle line:84% can add two numbers, b and c, modulo 7. 00:16:38.700 --> 00:16:44.300 align:middle line:84% And then I can add to their result a, all happening mod 7. 00:16:44.300 --> 00:16:47.220 align:middle line:84% And I claim that that's the same thing 00:16:47.220 --> 00:16:51.880 align:middle line:84% as parenthesizing the expression and the other way. 00:16:51.880 --> 00:16:54.900 align:middle line:90% It's the same thing as a plus b. 00:16:54.900 --> 00:17:00.900 align:middle line:84% And then I add c, all happening mod 7. 00:17:00.900 --> 00:17:02.740 align:middle line:84% A lot of the other basic facts we're 00:17:02.740 --> 00:17:05.560 align:middle line:84% used to go through, as well, like commutativity. 00:17:05.560 --> 00:17:11.339 align:middle line:90% 00:17:11.339 --> 00:17:19.220 align:middle line:84% So, in particular, a plus b modulo 7 is equal to b plus a. 00:17:19.220 --> 00:17:21.680 align:middle line:84% That's the same thing as even plus odd. 00:17:21.680 --> 00:17:24.000 align:middle line:84% It doesn't matter what order I add them up. 00:17:24.000 --> 00:17:27.780 align:middle line:84% I still get the same thing, which is an odd number. 00:17:27.780 --> 00:17:34.340 align:middle line:84% And last but not least, we still have the distributive property, 00:17:34.340 --> 00:17:37.300 align:middle line:84% which tells us how multiplication and addition 00:17:37.300 --> 00:17:38.740 align:middle line:90% interact. 00:17:38.740 --> 00:17:45.740 align:middle line:84% So if I'm multiplying over z7 a times the result of b plus c, 00:17:45.740 --> 00:17:55.220 align:middle line:84% That's the same thing as a times b plus a times c. 00:17:55.220 --> 00:17:57.860 align:middle line:84% So almost everything works exactly the way 00:17:57.860 --> 00:17:58.860 align:middle line:90% that you're used to. 00:17:58.860 --> 00:18:01.760 align:middle line:90% 00:18:01.760 --> 00:18:04.500 align:middle line:84% So before we go too far into modular arithmetic, 00:18:04.500 --> 00:18:07.100 align:middle line:84% because we're going to be doing a lot of it today, 00:18:07.100 --> 00:18:08.660 align:middle line:84% I wanted to give you a little bit 00:18:08.660 --> 00:18:11.260 align:middle line:84% of a teaser for later about why we 00:18:11.260 --> 00:18:13.660 align:middle line:90% care about modular arithmetic. 00:18:13.660 --> 00:18:16.940 align:middle line:84% So it's not totally obvious, but modular arithmetic 00:18:16.940 --> 00:18:19.900 align:middle line:84% is a great way to accomplish a lot of things, especially 00:18:19.900 --> 00:18:21.500 align:middle line:90% in computer science. 00:18:21.500 --> 00:18:24.740 align:middle line:84% So we talked a bit about areas like cryptography 00:18:24.740 --> 00:18:27.620 align:middle line:90% in a previous lecture. 00:18:27.620 --> 00:18:30.490 align:middle line:84% Cryptography is based on modular arithmetic, 00:18:30.490 --> 00:18:32.670 align:middle line:84% so this will be a very important application for us 00:18:32.670 --> 00:18:34.230 align:middle line:90% later in the class. 00:18:34.230 --> 00:18:36.790 align:middle line:84% There are also some other really fun applications 00:18:36.790 --> 00:18:40.257 align:middle line:84% that also are from other areas of cryptography, which 00:18:40.257 --> 00:18:42.590 align:middle line:84% have to do with things which were actually invented here 00:18:42.590 --> 00:18:46.110 align:middle line:84% at MIT about zero-knowledge proofs. 00:18:46.110 --> 00:18:49.970 align:middle line:84% So I'm going to need some help from the audience for this one. 00:18:49.970 --> 00:18:54.990 align:middle line:84% But let's imagine that you're home on a weekend, 00:18:54.990 --> 00:18:57.430 align:middle line:84% and you want to watch an embarrassing movie 00:18:57.430 --> 00:18:59.350 align:middle line:90% with your friend. 00:18:59.350 --> 00:19:02.430 align:middle line:84% Now, you have some favorite movies you might want to see, 00:19:02.430 --> 00:19:04.870 align:middle line:84% but you don't want to admit to liking 00:19:04.870 --> 00:19:07.610 align:middle line:84% that movie unless your friend likes it, too. 00:19:07.610 --> 00:19:09.470 align:middle line:90% This is a common problem, right? 00:19:09.470 --> 00:19:12.090 align:middle line:84% Maybe if you both like the same embarrassing movie, 00:19:12.090 --> 00:19:14.590 align:middle line:84% you would then watch it, and that's fine. 00:19:14.590 --> 00:19:18.070 align:middle line:84% But otherwise, if you don't both want to watch the movie, 00:19:18.070 --> 00:19:21.090 align:middle line:84% you want some kind of plausible deniability-- 00:19:21.090 --> 00:19:22.170 align:middle line:90% I don't like that movie. 00:19:22.170 --> 00:19:25.590 align:middle line:84% So what are some examples of embarrassing movies 00:19:25.590 --> 00:19:28.560 align:middle line:84% that you guys actually like that you might be 00:19:28.560 --> 00:19:30.920 align:middle line:90% a little embarrassed to admit? 00:19:30.920 --> 00:19:31.820 align:middle line:90% Don't be shy. 00:19:31.820 --> 00:19:34.877 align:middle line:90% 00:19:34.877 --> 00:19:36.710 align:middle line:84% You guys don't like any embarrassing movies? 00:19:36.710 --> 00:19:39.480 align:middle line:90% 00:19:39.480 --> 00:19:40.456 align:middle line:90% What? 00:19:40.456 --> 00:19:45.400 align:middle line:84% [LAUGHS] We can't move on with the lecture until you 00:19:45.400 --> 00:19:46.860 align:middle line:90% guys give me something here. 00:19:46.860 --> 00:19:49.298 align:middle line:90% 00:19:49.298 --> 00:19:50.840 align:middle line:84% AUDIENCE: I don't have anything else. 00:19:50.840 --> 00:19:51.548 align:middle line:90% ANKUR MOITRA: OK. 00:19:51.548 --> 00:19:54.560 align:middle line:84% What are embarrassing movies your friends like-- 00:19:54.560 --> 00:19:56.413 align:middle line:90% your friends might like? 00:19:56.413 --> 00:19:57.080 align:middle line:90% AUDIENCE: Shrek. 00:19:57.080 --> 00:19:57.913 align:middle line:90% ANKUR MOITRA: Shrek? 00:19:57.913 --> 00:19:58.978 align:middle line:90% AUDIENCE: Shrek is good. 00:19:58.978 --> 00:20:00.020 align:middle line:90% ANKUR MOITRA: Shrek's OK. 00:20:00.020 --> 00:20:00.920 align:middle line:90% All right. 00:20:00.920 --> 00:20:01.920 align:middle line:90% AUDIENCE: Barbie, maybe. 00:20:01.920 --> 00:20:02.540 align:middle line:90% ANKUR MOITRA: Barbie, OK. 00:20:02.540 --> 00:20:04.095 align:middle line:84% AUDIENCE: The Barbie movie's great. 00:20:04.095 --> 00:20:05.720 align:middle line:84% ANKUR MOITRA: [LAUGHS] All right, we're 00:20:05.720 --> 00:20:07.490 align:middle line:90% going to have a fight break out. 00:20:07.490 --> 00:20:08.240 align:middle line:90% AUDIENCE: Morbius. 00:20:08.240 --> 00:20:09.573 align:middle line:90% This is just the correct answer. 00:20:09.573 --> 00:20:10.490 align:middle line:90% ANKUR MOITRA: Morbi--? 00:20:10.490 --> 00:20:12.080 align:middle line:90% I have no idea what that is. 00:20:12.080 --> 00:20:15.297 align:middle line:84% AUDIENCE: It's constantly [INAUDIBLE] because it's so bad. 00:20:15.297 --> 00:20:16.380 align:middle line:90% ANKUR MOITRA: OK, Morbius. 00:20:16.380 --> 00:20:17.200 align:middle line:90% AUDIENCE: Oh, wait. 00:20:17.200 --> 00:20:17.843 align:middle line:90% The Room. 00:20:17.843 --> 00:20:19.010 align:middle line:90% ANKUR MOITRA: The Room, OK-- 00:20:19.010 --> 00:20:20.720 align:middle line:90% The Room. 00:20:20.720 --> 00:20:23.880 align:middle line:84% I was going to go with-- what's this-- 00:20:23.880 --> 00:20:26.680 align:middle line:90% OK, I don't know. 00:20:26.680 --> 00:20:29.080 align:middle line:84% All right, let's go with Morbius. 00:20:29.080 --> 00:20:31.420 align:middle line:84% So can I have two volunteers from the audience, 00:20:31.420 --> 00:20:33.960 align:middle line:90% and then I'll explain the game. 00:20:33.960 --> 00:20:35.520 align:middle line:90% Who's going to come up here? 00:20:35.520 --> 00:20:36.720 align:middle line:90% Don't be shy. 00:20:36.720 --> 00:20:37.640 align:middle line:90% Yeah? 00:20:37.640 --> 00:20:38.760 align:middle line:90% All right, one more. 00:20:38.760 --> 00:20:40.960 align:middle line:90% Let's do it. 00:20:40.960 --> 00:20:44.520 align:middle line:84% So let's explain how modular arithmetic and clock math 00:20:44.520 --> 00:20:47.520 align:middle line:84% is going to help us answer this question. 00:20:47.520 --> 00:20:50.560 align:middle line:84% What I'm going to do is I'm going to take five cards. 00:20:50.560 --> 00:20:51.660 align:middle line:90% Three are red. 00:20:51.660 --> 00:20:52.760 align:middle line:90% Two are black. 00:20:52.760 --> 00:20:57.120 align:middle line:84% Let's pretend that I don't keep track of the fact that it's a 2, 00:20:57.120 --> 00:20:59.360 align:middle line:90% and I just know the color of it. 00:20:59.360 --> 00:21:03.320 align:middle line:84% So what I'm going to do is I'm going to give each of you 00:21:03.320 --> 00:21:06.810 align:middle line:90% one black and one red card. 00:21:06.810 --> 00:21:08.720 align:middle line:84% And then what's going to happen is 00:21:08.720 --> 00:21:11.413 align:middle line:84% I put down this one red card in the middle. 00:21:11.413 --> 00:21:13.080 align:middle line:84% Now, what they're going to do is they're 00:21:13.080 --> 00:21:15.592 align:middle line:84% going to decide whether they like the embarrassing movie 00:21:15.592 --> 00:21:17.800 align:middle line:84% or not, which they want to see on the weekends, which 00:21:17.800 --> 00:21:20.925 align:middle line:84% I guess is Morbius, which I should look up after class. 00:21:20.925 --> 00:21:22.800 align:middle line:84% And if they like it, what they're going to do 00:21:22.800 --> 00:21:25.130 align:middle line:84% is they're going to put their red card closest 00:21:25.130 --> 00:21:27.610 align:middle line:84% to the red card in the middle and their black card 00:21:27.610 --> 00:21:28.953 align:middle line:90% on the outside. 00:21:28.953 --> 00:21:30.370 align:middle line:84% And if they don't like it, they're 00:21:30.370 --> 00:21:32.890 align:middle line:84% going to put their black card next to the red card 00:21:32.890 --> 00:21:35.690 align:middle line:84% and their red card on the outside. 00:21:35.690 --> 00:21:37.810 align:middle line:84% And so what I'm going to do then is 00:21:37.810 --> 00:21:41.010 align:middle line:84% I'm going to stack up the cards on top of each other. 00:21:41.010 --> 00:21:45.130 align:middle line:84% And then I'm going to have them both cut the deck randomly. 00:21:45.130 --> 00:21:47.490 align:middle line:84% So that way, it's a random cyclic shift 00:21:47.490 --> 00:21:49.410 align:middle line:90% when they put it together. 00:21:49.410 --> 00:21:52.890 align:middle line:84% And then, what I claim is that if they both like the movie 00:21:52.890 --> 00:21:55.250 align:middle line:84% Morbius and they want to see it, what's going to happen 00:21:55.250 --> 00:21:59.890 align:middle line:84% is we're going to have two red cards in a row, cyclically. 00:21:59.890 --> 00:22:03.070 align:middle line:84% And if either of them doesn't like it, 00:22:03.070 --> 00:22:05.590 align:middle line:84% then we will not have three red cards in a row. 00:22:05.590 --> 00:22:07.850 align:middle line:84% We will have two red cards in a row. 00:22:07.850 --> 00:22:11.090 align:middle line:84% But even the person who liked it and the other person 00:22:11.090 --> 00:22:13.610 align:middle line:84% didn't, they'll have plausible deniability 00:22:13.610 --> 00:22:17.570 align:middle line:84% because all of those, after the cyclic shifts, 00:22:17.570 --> 00:22:19.370 align:middle line:90% it'll all look the same. 00:22:19.370 --> 00:22:20.470 align:middle line:90% So let's try it out. 00:22:20.470 --> 00:22:24.050 align:middle line:84% Do you guys want to see Morbius over spring break? 00:22:24.050 --> 00:22:25.630 align:middle line:90% So I won't look. 00:22:25.630 --> 00:22:31.530 align:middle line:84% Put down your cards, and then we'll see if we've got a match. 00:22:31.530 --> 00:22:32.690 align:middle line:90% All right. 00:22:32.690 --> 00:22:36.450 align:middle line:84% And just for security purposes, I'm going to ask each of you 00:22:36.450 --> 00:22:38.130 align:middle line:90% just to cut the deck. 00:22:38.130 --> 00:22:40.330 align:middle line:84% So just take up some number of cards, 00:22:40.330 --> 00:22:42.650 align:middle line:90% and put them on the bottom. 00:22:42.650 --> 00:22:44.510 align:middle line:90% Perfect. 00:22:44.510 --> 00:22:46.730 align:middle line:90% And then cut the deck randomly. 00:22:46.730 --> 00:22:49.210 align:middle line:84% We'll pretend we didn't see how they cut them. 00:22:49.210 --> 00:22:53.530 align:middle line:84% And what I'll do is I'll put them out in order. 00:22:53.530 --> 00:22:55.950 align:middle line:84% And unfortunately, we don't have a match. 00:22:55.950 --> 00:22:58.970 align:middle line:84% So can you tell me what you guys answered? 00:22:58.970 --> 00:23:00.667 align:middle line:90% AUDIENCE: Oh, I answered no. 00:23:00.667 --> 00:23:01.250 align:middle line:90% AUDIENCE: Yes. 00:23:01.250 --> 00:23:01.970 align:middle line:90% ANKUR MOITRA: You put yes. 00:23:01.970 --> 00:23:02.610 align:middle line:90% OK. 00:23:02.610 --> 00:23:04.810 align:middle line:84% So even though he put yes, he can save face 00:23:04.810 --> 00:23:07.770 align:middle line:84% and say, I never liked that movie, anyways. 00:23:07.770 --> 00:23:10.030 align:middle line:84% So this is what's called the zero-knowledge proof. 00:23:10.030 --> 00:23:12.370 align:middle line:90% Thanks for your help. 00:23:12.370 --> 00:23:15.890 align:middle line:84% And it uses just clock math types of things. 00:23:15.890 --> 00:23:17.890 align:middle line:84% So it turns out that, once we have 00:23:17.890 --> 00:23:19.870 align:middle line:84% the basics of modular arithmetic, 00:23:19.870 --> 00:23:22.580 align:middle line:84% there'll be some amazing things we can do with it, 00:23:22.580 --> 00:23:25.240 align:middle line:84% like being able to privately compute functions, 00:23:25.240 --> 00:23:27.732 align:middle line:84% be able to execute cryptographic schemes. 00:23:27.732 --> 00:23:29.940 align:middle line:84% But for this lecture, what we're going to be doing is 00:23:29.940 --> 00:23:33.660 align:middle line:84% we're just going to be building up the basic mechanics before we 00:23:33.660 --> 00:23:36.870 align:middle line:84% can apply it in action in some of the later lectures in class. 00:23:36.870 --> 00:23:39.526 align:middle line:90% 00:23:39.526 --> 00:23:43.020 align:middle line:84% So now, let's roll up our sleeves. 00:23:43.020 --> 00:23:46.380 align:middle line:84% All of this stuff was pretty natural. 00:23:46.380 --> 00:23:49.620 align:middle line:84% It works the way you would expect it to. 00:23:49.620 --> 00:23:54.420 align:middle line:84% But now, we're going to get in to one piece of the puzzle that 00:23:54.420 --> 00:23:58.660 align:middle line:84% makes it really interesting and different than ordinary integer 00:23:58.660 --> 00:23:59.980 align:middle line:90% arithmetic. 00:23:59.980 --> 00:24:01.700 align:middle line:84% So let me tell you the key question, 00:24:01.700 --> 00:24:07.420 align:middle line:84% which we're going to spend a few minutes answering. 00:24:07.420 --> 00:24:12.100 align:middle line:84% What I claim is if I look at that table, 00:24:12.100 --> 00:24:15.340 align:middle line:84% I'm going to have some examples of elements that 00:24:15.340 --> 00:24:18.100 align:middle line:90% have multiplicative inverses. 00:24:18.100 --> 00:24:19.990 align:middle line:84% I'll tell you what I mean by that, 00:24:19.990 --> 00:24:22.350 align:middle line:84% but my key question is going to be, 00:24:22.350 --> 00:24:27.550 align:middle line:84% when I'm working, say, mod 7, does every element 00:24:27.550 --> 00:24:30.780 align:middle line:90% have a multiplicative inverse? 00:24:30.780 --> 00:24:37.510 align:middle line:90% 00:24:37.510 --> 00:24:39.270 align:middle line:90% So let me be concrete. 00:24:39.270 --> 00:24:43.950 align:middle line:84% So let's say we're working mod 7 for the time being. 00:24:43.950 --> 00:24:48.070 align:middle line:84% We can take 2 and 4, and we can multiply them. 00:24:48.070 --> 00:24:50.270 align:middle line:84% And, as usual, the way we do modular arithmetic 00:24:50.270 --> 00:24:53.950 align:middle line:84% with multiplication is we just do it and then subtract off 00:24:53.950 --> 00:24:56.150 align:middle line:90% the multiples of 7 later. 00:24:56.150 --> 00:24:58.710 align:middle line:84% So when I take the element 2, and I multiply it 00:24:58.710 --> 00:25:04.710 align:middle line:84% by the element 4, what I get is I get the element 1. 00:25:04.710 --> 00:25:08.270 align:middle line:84% So that's an example of a multiplicative inverse 00:25:08.270 --> 00:25:12.830 align:middle line:84% because what's going on is if I have a number multiplied by 4, 00:25:12.830 --> 00:25:15.310 align:middle line:84% I can get rid of it by multiplying the whole thing 00:25:15.310 --> 00:25:16.630 align:middle line:90% by 2. 00:25:16.630 --> 00:25:20.750 align:middle line:84% The 2 and the 4 will cancel because they multiply to 1. 00:25:20.750 --> 00:25:23.550 align:middle line:84% And then I get back the thing I started with. 00:25:23.550 --> 00:25:25.470 align:middle line:84% So this is the key to a lot of what 00:25:25.470 --> 00:25:28.430 align:middle line:84% we're going to be doing later cryptographically is 00:25:28.430 --> 00:25:33.150 align:middle line:84% because multiplying by a number in modular arithmetic 00:25:33.150 --> 00:25:36.670 align:middle line:84% serves of jumbling up the numbers you started with. 00:25:36.670 --> 00:25:39.350 align:middle line:84% So I might have some secret message, 00:25:39.350 --> 00:25:41.090 align:middle line:90% and then I want to jumble it. 00:25:41.090 --> 00:25:45.590 align:middle line:84% And I could try multiplying by some other number, like 4, 00:25:45.590 --> 00:25:48.710 align:middle line:84% but then I have to have some way of unjumbling it. 00:25:48.710 --> 00:25:51.910 align:middle line:84% And in this case, that's a multiplicative inverse. 00:25:51.910 --> 00:25:54.050 align:middle line:84% Now, that scheme is not literally going to work, 00:25:54.050 --> 00:25:57.150 align:middle line:84% but that's the intuition behind what's going on. 00:25:57.150 --> 00:25:59.470 align:middle line:84% So in this case, I got lucky, or maybe I 00:25:59.470 --> 00:26:02.270 align:middle line:84% didn't, that when I multiplied by 4, 00:26:02.270 --> 00:26:05.950 align:middle line:84% there was a multiplicative inverse, which is 2. 00:26:05.950 --> 00:26:09.630 align:middle line:84% Does 2 have a multiplicative inverse? 00:26:09.630 --> 00:26:10.810 align:middle line:90% What is it? 00:26:10.810 --> 00:26:11.310 align:middle line:90% AUDIENCE: 4. 00:26:11.310 --> 00:26:12.810 align:middle line:90% ANKUR MOITRA: 4-- that's right. 00:26:12.810 --> 00:26:14.750 align:middle line:84% Because of commutativity, it doesn't matter 00:26:14.750 --> 00:26:16.920 align:middle line:90% what order I multiply them in. 00:26:16.920 --> 00:26:21.120 align:middle line:84% So 2 and 4 are each other's multiplicative inverses. 00:26:21.120 --> 00:26:25.720 align:middle line:84% I could look at my table and write down the full table 00:26:25.720 --> 00:26:27.100 align:middle line:90% of all of the elements. 00:26:27.100 --> 00:26:31.640 align:middle line:84% And I could check that every number has some kind 00:26:31.640 --> 00:26:34.280 align:middle line:90% of multiplicative inverse. 00:26:34.280 --> 00:26:37.140 align:middle line:84% Like, 5 has a multiplicative inverse of 3. 00:26:37.140 --> 00:26:39.640 align:middle line:84% And if this table continued, 3 would 00:26:39.640 --> 00:26:42.280 align:middle line:84% be the multiplicative inverse of 5. 00:26:42.280 --> 00:26:45.460 align:middle line:84% But when I get to larger and larger moduli, 00:26:45.460 --> 00:26:49.320 align:middle line:84% it's not always possible to write down this gigantic table 00:26:49.320 --> 00:26:52.000 align:middle line:84% and verify that, in each row, there is 00:26:52.000 --> 00:26:55.440 align:middle line:90% some column where it's got a 1. 00:26:55.440 --> 00:26:58.740 align:middle line:84% And so what I can ask is whether every element-- 00:26:58.740 --> 00:27:00.840 align:middle line:84% and by this, I mean, just to be clear, 00:27:00.840 --> 00:27:04.800 align:middle line:90% I mean every non-zero element-- 00:27:04.800 --> 00:27:06.940 align:middle line:84% 0 won't have a multiplicative inverse-- 00:27:06.940 --> 00:27:12.080 align:middle line:84% but does every non-zero element have a multiplicative inverse? 00:27:12.080 --> 00:27:14.960 align:middle line:84% So this will be a key question which occupies us 00:27:14.960 --> 00:27:17.920 align:middle line:84% for a little bit of the rest of the lecture 00:27:17.920 --> 00:27:20.800 align:middle line:84% is answering this question because we're going to build up 00:27:20.800 --> 00:27:23.200 align:middle line:84% some mathematical theory of not only 00:27:23.200 --> 00:27:27.920 align:middle line:84% why does every element have a multiplicative inverse when we 00:27:27.920 --> 00:27:31.880 align:middle line:84% work modulo a prime, but how exactly I would find it 00:27:31.880 --> 00:27:35.720 align:middle line:84% without actually writing down the entire table. 00:27:35.720 --> 00:27:38.160 align:middle line:90% So that's our plan of action. 00:27:38.160 --> 00:27:42.170 align:middle line:90% And let's go back to-- 00:27:42.170 --> 00:27:45.040 align:middle line:84% we're going to use this fact I mentioned, 00:27:45.040 --> 00:27:47.840 align:middle line:84% the fact that a is congruent to b mod n if 00:27:47.840 --> 00:27:50.720 align:middle line:84% and only if the remainders are equal. 00:27:50.720 --> 00:27:52.900 align:middle line:84% We're going to use this to great effect. 00:27:52.900 --> 00:27:57.580 align:middle line:84% So let's just start with some very natural definitions, 00:27:57.580 --> 00:28:01.800 align:middle line:84% and it'll lead us to the answer to this key question. 00:28:01.800 --> 00:28:03.360 align:middle line:84% So first of all, I'm going to define 00:28:03.360 --> 00:28:06.640 align:middle line:84% another key quantity, which is called the GCD, the Greatest 00:28:06.640 --> 00:28:07.450 align:middle line:90% Common Divisor. 00:28:07.450 --> 00:28:15.730 align:middle line:90% 00:28:15.730 --> 00:28:19.890 align:middle line:84% So if you give me two integers a and b, 00:28:19.890 --> 00:28:23.730 align:middle line:84% well, the greatest common divisor is what you think it is. 00:28:23.730 --> 00:28:32.200 align:middle line:84% It's the largest integer that divides both. 00:28:32.200 --> 00:28:39.010 align:middle line:90% 00:28:39.010 --> 00:28:43.330 align:middle line:84% So it could be 1, for example, if there is no integer larger 00:28:43.330 --> 00:28:44.930 align:middle line:90% than 1 that divides both. 00:28:44.930 --> 00:28:49.290 align:middle line:84% But we'll take this as our definition, the GCD. 00:28:49.290 --> 00:28:52.190 align:middle line:84% And, really, it's not so obvious right now, 00:28:52.190 --> 00:28:55.090 align:middle line:84% but the following question is going 00:28:55.090 --> 00:28:59.010 align:middle line:84% to help us answer this problem about multiplicative inverses. 00:28:59.010 --> 00:29:04.860 align:middle line:84% So I can ask the question, how can we compute the GCD? 00:29:04.860 --> 00:29:10.410 align:middle line:90% 00:29:10.410 --> 00:29:12.470 align:middle line:84% So there's a terrible way to do this, 00:29:12.470 --> 00:29:15.790 align:middle line:84% which is I could just take the smaller of the two integers-- 00:29:15.790 --> 00:29:20.010 align:middle line:84% let's say it's a-- and I could try all the integers between 1 00:29:20.010 --> 00:29:22.330 align:middle line:90% and a and check. 00:29:22.330 --> 00:29:24.390 align:middle line:84% That might work for small numbers, 00:29:24.390 --> 00:29:27.610 align:middle line:84% but you're going to have a very hard time once you start 00:29:27.610 --> 00:29:30.650 align:middle line:84% working with gigantic numbers, things that are, like, 00:29:30.650 --> 00:29:34.450 align:middle line:84% 32 digits because I'll just have to try too many things. 00:29:34.450 --> 00:29:37.330 align:middle line:84% What I claim is that there's a very fast algorithm 00:29:37.330 --> 00:29:39.050 align:middle line:90% for computing the GCD. 00:29:39.050 --> 00:29:41.570 align:middle line:84% In fact, it's one of the first algorithms that 00:29:41.570 --> 00:29:45.530 align:middle line:84% was ever discovered, so it goes back to the ancient Greeks. 00:29:45.530 --> 00:29:49.010 align:middle line:84% And we're going to build up to this algorithm 00:29:49.010 --> 00:29:54.290 align:middle line:84% with a few key structural lemmas about how the GCD works. 00:29:54.290 --> 00:29:56.610 align:middle line:84% So let's start with the first lemma. 00:29:56.610 --> 00:29:59.930 align:middle line:84% So let's assume that b is at least as large as a 00:29:59.930 --> 00:30:01.750 align:middle line:90% without lost generality. 00:30:01.750 --> 00:30:03.650 align:middle line:84% Otherwise, we'd just switch them. 00:30:03.650 --> 00:30:08.170 align:middle line:84% What I claim is that the GCD, the Greatest Common Divisor, 00:30:08.170 --> 00:30:16.060 align:middle line:84% between a and b is actually the same as the GCD between a and b 00:30:16.060 --> 00:30:19.020 align:middle line:90% minus a. 00:30:19.020 --> 00:30:21.280 align:middle line:84% So this is our first notion of progress. 00:30:21.280 --> 00:30:24.460 align:middle line:84% We start off with two huge integers, a and b. 00:30:24.460 --> 00:30:26.540 align:middle line:90% We want to compute their GCD. 00:30:26.540 --> 00:30:30.600 align:middle line:84% And I claim that their GCD is the same as two 00:30:30.600 --> 00:30:34.860 align:middle line:84% not quite as huge integers because now, potentially, 00:30:34.860 --> 00:30:38.220 align:middle line:84% I've made one of the integers smaller. 00:30:38.220 --> 00:30:41.485 align:middle line:84% So this is our first notion of progress. 00:30:41.485 --> 00:30:42.860 align:middle line:84% Once we have this lemma, we'll be 00:30:42.860 --> 00:30:45.660 align:middle line:84% able to make a ton of progress, but let's start 00:30:45.660 --> 00:30:47.620 align:middle line:90% by proving this lemma. 00:30:47.620 --> 00:30:52.340 align:middle line:84% And then we'll prove a souped-up version of this lemma. 00:30:52.340 --> 00:30:54.550 align:middle line:84% So the proof for this is very simple. 00:30:54.550 --> 00:30:57.220 align:middle line:90% 00:30:57.220 --> 00:31:03.620 align:middle line:90% Let's suppose that k divides a-- 00:31:03.620 --> 00:31:07.460 align:middle line:84% this is the expression for k divides a-- 00:31:07.460 --> 00:31:09.410 align:middle line:90% evenly into an integer. 00:31:09.410 --> 00:31:11.870 align:middle line:90% So a is a multiple of k. 00:31:11.870 --> 00:31:16.330 align:middle line:84% And let's assume that k also divides b. 00:31:16.330 --> 00:31:20.070 align:middle line:90% 00:31:20.070 --> 00:31:32.550 align:middle line:84% Then what I claim is that k must also divide b minus a. 00:31:32.550 --> 00:31:34.110 align:middle line:90% Why is that true? 00:31:34.110 --> 00:31:35.530 align:middle line:90% Well, what does this mean? 00:31:35.530 --> 00:31:38.710 align:middle line:84% When I take a divided by k, I get an integer. 00:31:38.710 --> 00:31:41.870 align:middle line:84% When I take b divided by k, I get an integer. 00:31:41.870 --> 00:31:44.590 align:middle line:84% And so, then, if I take k-- if I take b minus a 00:31:44.590 --> 00:31:48.090 align:middle line:84% and divide it by k, I get an integer minus an integer, 00:31:48.090 --> 00:31:51.510 align:middle line:84% so I definitely still get an integer. 00:31:51.510 --> 00:31:53.340 align:middle line:84% But let's think about what this means. 00:31:53.340 --> 00:31:56.710 align:middle line:90% 00:31:56.710 --> 00:32:04.070 align:middle line:84% What this means for us is that the GCD of a and b 00:32:04.070 --> 00:32:11.110 align:middle line:84% is a lower bound for the GCD of a and b minus a. 00:32:11.110 --> 00:32:12.450 align:middle line:90% So this part is easy. 00:32:12.450 --> 00:32:14.950 align:middle line:90% I know that k divides b minus a. 00:32:14.950 --> 00:32:17.830 align:middle line:84% How did I get to this statement right here? 00:32:17.830 --> 00:32:19.750 align:middle line:84% How does interpreting the statement 00:32:19.750 --> 00:32:23.750 align:middle line:84% tell me that whatever the GCD is for a and b, 00:32:23.750 --> 00:32:28.470 align:middle line:84% the GCD of a and b minus a is at least as large? 00:32:28.470 --> 00:32:29.610 align:middle line:90% Can anyone help me out? 00:32:29.610 --> 00:32:33.670 align:middle line:90% 00:32:33.670 --> 00:32:35.910 align:middle line:90% So you're with me up to here. 00:32:35.910 --> 00:32:38.190 align:middle line:90% How did I get this statement? 00:32:38.190 --> 00:32:39.660 align:middle line:90% How did it follow from this? 00:32:39.660 --> 00:32:42.510 align:middle line:90% 00:32:42.510 --> 00:32:43.140 align:middle line:90% Any ideas? 00:32:43.140 --> 00:32:54.070 align:middle line:90% 00:32:54.070 --> 00:32:55.750 align:middle line:90% Let me give you a hint. 00:32:55.750 --> 00:32:58.070 align:middle line:84% So, mechanically-- I'm not telling you 00:32:58.070 --> 00:33:00.830 align:middle line:84% I know what the GCD of a and b is. 00:33:00.830 --> 00:33:04.190 align:middle line:84% I'm telling you, whatever the GCD is-- 00:33:04.190 --> 00:33:07.040 align:middle line:84% let's suppose it's some integer k-- 00:33:07.040 --> 00:33:11.600 align:middle line:84% that the GCD between a and b minus a 00:33:11.600 --> 00:33:14.240 align:middle line:90% must be at least as large. 00:33:14.240 --> 00:33:15.770 align:middle line:90% How can I guarantee that fact? 00:33:15.770 --> 00:33:18.440 align:middle line:90% 00:33:18.440 --> 00:33:20.160 align:middle line:90% Or ask a question. 00:33:20.160 --> 00:33:24.600 align:middle line:84% So either give me an idea or ask me a clarifying question. 00:33:24.600 --> 00:33:25.517 align:middle line:90% But this is important. 00:33:25.517 --> 00:33:27.642 align:middle line:84% AUDIENCE: That anything dividing the left-hand side 00:33:27.642 --> 00:33:28.820 align:middle line:90% by [INAUDIBLE] side. 00:33:28.820 --> 00:33:30.960 align:middle line:90% ANKUR MOITRA: Yes, perfect. 00:33:30.960 --> 00:33:34.240 align:middle line:84% So one way to think about this is, what am I saying here? 00:33:34.240 --> 00:33:39.520 align:middle line:84% Whatever this GCD is-- let's imagine that it's k-- 00:33:39.520 --> 00:33:44.440 align:middle line:84% well, then, I know that k, from the statement, 00:33:44.440 --> 00:33:49.800 align:middle line:84% if k divides both a and b, then k must also divide a and b 00:33:49.800 --> 00:33:50.920 align:middle line:90% minus a. 00:33:50.920 --> 00:33:53.200 align:middle line:84% That's literally what I just proved. 00:33:53.200 --> 00:33:58.520 align:middle line:84% So that means that k also is a candidate for a divisor, 00:33:58.520 --> 00:34:00.640 align:middle line:90% for a and b minus a. 00:34:00.640 --> 00:34:04.000 align:middle line:84% So whatever the greatest common divisor is, 00:34:04.000 --> 00:34:05.620 align:middle line:90% it must be at least as large. 00:34:05.620 --> 00:34:08.679 align:middle line:84% It must be-- maybe there's something even bigger than k, 00:34:08.679 --> 00:34:11.116 align:middle line:90% but I know it's at least k. 00:34:11.116 --> 00:34:12.699 align:middle line:84% So are there any questions about that? 00:34:12.699 --> 00:34:15.880 align:middle line:90% Does that make sense now? 00:34:15.880 --> 00:34:17.280 align:middle line:90% So this is really-- yes? 00:34:17.280 --> 00:34:20.039 align:middle line:84% AUDIENCE: [INAUDIBLE] k is the GCD of everyone, 00:34:20.039 --> 00:34:22.160 align:middle line:90% as sort of this one? 00:34:22.160 --> 00:34:25.199 align:middle line:84% ANKUR MOITRA: I said that this is-- so even though this is just 00:34:25.199 --> 00:34:28.320 align:middle line:90% three lines, it's a bit subtle. 00:34:28.320 --> 00:34:30.520 align:middle line:84% So here, what I said was that if you give me 00:34:30.520 --> 00:34:34.440 align:middle line:84% any integer k that divides both a and b, 00:34:34.440 --> 00:34:37.280 align:middle line:90% it also divides b minus a. 00:34:37.280 --> 00:34:40.080 align:middle line:84% So, in particular, now when I set k 00:34:40.080 --> 00:34:43.960 align:middle line:84% to actually be whatever the GCD is, then 00:34:43.960 --> 00:34:49.239 align:middle line:84% I know that that same k had also better divide b minus a. 00:34:49.239 --> 00:34:53.800 align:middle line:84% So it's a candidate for the GCD of a and b minus a. 00:34:53.800 --> 00:34:55.659 align:middle line:84% So even though this is just a couple lines, 00:34:55.659 --> 00:34:59.200 align:middle line:90% the logic is a bit subtle. 00:34:59.200 --> 00:35:01.440 align:middle line:84% So this proves one direction, but really, we 00:35:01.440 --> 00:35:04.290 align:middle line:84% want to prove that these two things are equal. 00:35:04.290 --> 00:35:06.610 align:middle line:90% So let's prove the converse. 00:35:06.610 --> 00:35:16.130 align:middle line:84% So conversely, let's suppose that k divides a and k divides 00:35:16.130 --> 00:35:18.850 align:middle line:90% b minus a. 00:35:18.850 --> 00:35:24.570 align:middle line:84% Well, then what I claim is that k divides b. 00:35:24.570 --> 00:35:27.630 align:middle line:84% And that's the same proof as before, what happened here. 00:35:27.630 --> 00:35:31.830 align:middle line:84% So if k divides a, that means I take a divided by k, 00:35:31.830 --> 00:35:33.050 align:middle line:90% get an integer. 00:35:33.050 --> 00:35:36.290 align:middle line:84% b minus a divided by k, I get an integer. 00:35:36.290 --> 00:35:39.530 align:middle line:90% And b is just b minus a plus a. 00:35:39.530 --> 00:35:42.170 align:middle line:84% So that is the sum of two integers when I divide 00:35:42.170 --> 00:35:44.490 align:middle line:90% by k, so the statement is true. 00:35:44.490 --> 00:35:47.530 align:middle line:84% And now, this allows me to prove the inclusion 00:35:47.530 --> 00:35:49.530 align:middle line:90% the other direction. 00:35:49.530 --> 00:35:58.290 align:middle line:84% So what this implies is that the GCD of a and b minus a 00:35:58.290 --> 00:36:03.850 align:middle line:84% is a lower bound for the GCD of a and b. 00:36:03.850 --> 00:36:04.890 align:middle line:90% Why? 00:36:04.890 --> 00:36:08.330 align:middle line:84% Because whatever this integer k is, 00:36:08.330 --> 00:36:12.490 align:middle line:84% the largest integer that divides both a and b minus a, 00:36:12.490 --> 00:36:14.890 align:middle line:84% I just proved for you that that same integer 00:36:14.890 --> 00:36:17.490 align:middle line:90% had better divide both a and b. 00:36:17.490 --> 00:36:19.650 align:middle line:90% So it's the same logic as above. 00:36:19.650 --> 00:36:22.290 align:middle line:90% 00:36:22.290 --> 00:36:26.010 align:middle line:84% So this is one of the key proofs for today. 00:36:26.010 --> 00:36:31.576 align:middle line:84% So again, I will ask, are there any questions about this proof? 00:36:31.576 --> 00:36:34.170 align:middle line:90% We good? 00:36:34.170 --> 00:36:38.530 align:middle line:84% Speak now, or hold your peace until the next office 00:36:38.530 --> 00:36:41.130 align:middle line:90% hours or something. 00:36:41.130 --> 00:36:41.630 align:middle line:90% All right. 00:36:41.630 --> 00:36:44.230 align:middle line:84% So let's do a souped-up version of lemma 1 00:36:44.230 --> 00:36:48.450 align:middle line:84% because once we have lemma 1 and we understand this logic, 00:36:48.450 --> 00:36:51.130 align:middle line:90% we're off to the races. 00:36:51.130 --> 00:36:55.810 align:middle line:84% So now we'll be able to get a lot of cool things immediately. 00:36:55.810 --> 00:36:59.620 align:middle line:84% So lemma 1 didn't make that much progress 00:36:59.620 --> 00:37:03.220 align:middle line:84% in the grand scheme of things because I started off 00:37:03.220 --> 00:37:07.020 align:middle line:84% with two integers a and b, and I made 00:37:07.020 --> 00:37:10.860 align:middle line:84% b a little bit smaller because I turned b into b minus a. 00:37:10.860 --> 00:37:13.140 align:middle line:84% That's not a huge amount of progress, 00:37:13.140 --> 00:37:17.620 align:middle line:84% but let's take a leap instead of a step. 00:37:17.620 --> 00:37:22.100 align:middle line:84% What I claim, same assumption, so b is at least a. 00:37:22.100 --> 00:37:28.780 align:middle line:84% Then what I claim is that the GCD of a and b 00:37:28.780 --> 00:37:36.620 align:middle line:84% is equal to the GCD of a and the remainder of taking b 00:37:36.620 --> 00:37:38.880 align:middle line:90% and dividing it by a. 00:37:38.880 --> 00:37:42.660 align:middle line:90% 00:37:42.660 --> 00:37:45.420 align:middle line:90% So now I made a huge leap. 00:37:45.420 --> 00:37:51.340 align:middle line:84% I'm not just subtracting off 1 multiple of a. 00:37:51.340 --> 00:37:55.980 align:middle line:84% I'm actually making b way smaller, potentially, 00:37:55.980 --> 00:37:58.950 align:middle line:84% because I'm dividing by a and just 00:37:58.950 --> 00:38:01.950 align:middle line:84% keeping track of whatever the remainder is. 00:38:01.950 --> 00:38:04.830 align:middle line:84% Does anyone have any intuition for why this kind of statement 00:38:04.830 --> 00:38:06.390 align:middle line:90% should be true? 00:38:06.390 --> 00:38:09.310 align:middle line:84% And my hint is the division algorithm 00:38:09.310 --> 00:38:11.650 align:middle line:84% that's very conveniently right above it. 00:38:11.650 --> 00:38:16.750 align:middle line:90% 00:38:16.750 --> 00:38:18.950 align:middle line:90% Let me give you a hint. 00:38:18.950 --> 00:38:28.430 align:middle line:84% So let's say that we write b as equal to q times a plus 00:38:28.430 --> 00:38:31.470 align:middle line:84% r because that's what we get when we do the division 00:38:31.470 --> 00:38:32.710 align:middle line:90% algorithm. 00:38:32.710 --> 00:38:39.510 align:middle line:84% And so what I'm saying is that I can replace b with r. 00:38:39.510 --> 00:38:42.910 align:middle line:84% So what I'm doing, really, is I'm not subtracting off 00:38:42.910 --> 00:38:48.390 align:middle line:84% one copy of a, but I'm doing something a bit more aggressive. 00:38:48.390 --> 00:38:50.150 align:middle line:84% So does anyone have any hints about how 00:38:50.150 --> 00:38:53.830 align:middle line:90% this proof ought to go? 00:38:53.830 --> 00:38:54.850 align:middle line:90% How should I do it? 00:38:54.850 --> 00:38:58.390 align:middle line:90% 00:38:58.390 --> 00:38:58.950 align:middle line:90% Yes? 00:38:58.950 --> 00:39:00.350 align:middle line:90% AUDIENCE: [INAUDIBLE] 00:39:00.350 --> 00:39:01.710 align:middle line:90% ANKUR MOITRA: Perfect. 00:39:01.710 --> 00:39:03.470 align:middle line:90% That's exactly right. 00:39:03.470 --> 00:39:07.290 align:middle line:84% So it's just a repeated application of lemma 1. 00:39:07.290 --> 00:39:08.710 align:middle line:90% Perfect. 00:39:08.710 --> 00:39:13.070 align:middle line:84% So by the division algorithm, which is conveniently right 00:39:13.070 --> 00:39:22.550 align:middle line:84% above, well, what I can do is that the GCD of a and b is equal 00:39:22.550 --> 00:39:30.150 align:middle line:84% to the GCD of a and b minus a, which is equal to the GCD 00:39:30.150 --> 00:39:37.230 align:middle line:84% of a and b minus 2a, the way down to it's equal to the GCD 00:39:37.230 --> 00:39:44.230 align:middle line:84% of a and b minus qa, which is, of course, the same thing as r, 00:39:44.230 --> 00:39:45.670 align:middle line:90% the remainder. 00:39:45.670 --> 00:39:47.850 align:middle line:84% So it's just the repeated application. 00:39:47.850 --> 00:39:52.070 align:middle line:84% So why do I keep subtracting off one multiple of a per time? 00:39:52.070 --> 00:39:56.680 align:middle line:84% Instead, I can just jump to the end and do division. 00:39:56.680 --> 00:40:01.504 align:middle line:84% And now I make a huge amount of progress 00:40:01.504 --> 00:40:04.180 align:middle line:84% because we won't prove the progress bound, 00:40:04.180 --> 00:40:07.120 align:middle line:90% but it's very easy to prove. 00:40:07.120 --> 00:40:09.800 align:middle line:84% The point is that if a and b are really 00:40:09.800 --> 00:40:12.400 align:middle line:84% close to each other as integers, then 00:40:12.400 --> 00:40:15.160 align:middle line:84% I'm going to make a huge amount of progress 00:40:15.160 --> 00:40:17.160 align:middle line:90% in one of my two steps. 00:40:17.160 --> 00:40:19.860 align:middle line:84% If a and b are very far from each other, all of a sudden, 00:40:19.860 --> 00:40:23.520 align:middle line:84% the larger of the integers goes down to being as small as a. 00:40:23.520 --> 00:40:25.120 align:middle line:84% So either way, what ends up happening 00:40:25.120 --> 00:40:29.720 align:middle line:84% is you get this gigantic speedup in the algorithm. 00:40:29.720 --> 00:40:33.800 align:middle line:84% But let's think about just the numerical example 00:40:33.800 --> 00:40:36.580 align:middle line:84% to see what this algorithm looks like. 00:40:36.580 --> 00:40:39.560 align:middle line:84% And this numerical example is really 00:40:39.560 --> 00:40:42.150 align:middle line:84% just the Euclidean algorithm in action. 00:40:42.150 --> 00:40:44.752 align:middle line:90% 00:40:44.752 --> 00:40:51.240 align:middle line:84% So the Euclidean algorithm works as follows. 00:40:51.240 --> 00:41:00.480 align:middle line:84% All you do is the GCD of ab is equal to the GCD 00:41:00.480 --> 00:41:14.560 align:middle line:84% of a and b1 where b1 is equal to the remainder of b and a. 00:41:14.560 --> 00:41:19.360 align:middle line:84% And then this is equal to the GCD of a1, 00:41:19.360 --> 00:41:24.360 align:middle line:84% b1 where a1 is equal to the remainder 00:41:24.360 --> 00:41:29.840 align:middle line:90% of taking a and dividing by b1. 00:41:29.840 --> 00:41:32.100 align:middle line:84% So we just alternate back and forth. 00:41:32.100 --> 00:41:35.760 align:middle line:84% We divide one of the things by the other, take the remainder. 00:41:35.760 --> 00:41:38.100 align:middle line:84% And now we take the smaller of the two, 00:41:38.100 --> 00:41:40.560 align:middle line:90% which now, in this case, is b1. 00:41:40.560 --> 00:41:44.840 align:middle line:84% And we take a divided by b1, and that gives us our new a1. 00:41:44.840 --> 00:41:50.264 align:middle line:84% So we just keep alternating back and forth until the end. 00:41:50.264 --> 00:41:53.810 align:middle line:84% So let's actually see a numerical example of this, 00:41:53.810 --> 00:41:58.210 align:middle line:84% just to make sure that we're on the same page. 00:41:58.210 --> 00:42:06.570 align:middle line:84% So in action, let's do it for some large integers. 00:42:06.570 --> 00:42:14.730 align:middle line:84% So we could look at something like the GCD of 46 and 360. 00:42:14.730 --> 00:42:17.610 align:middle line:84% Kind of hard to do in your head, but if I 00:42:17.610 --> 00:42:20.410 align:middle line:84% were to do out the division algorithm, 00:42:20.410 --> 00:42:25.790 align:middle line:84% well, the first step is to take 360 and divide it by 46. 00:42:25.790 --> 00:42:29.680 align:middle line:84% And what I'll get, the remainder is going to be 38. 00:42:29.680 --> 00:42:33.610 align:middle line:90% 00:42:33.610 --> 00:42:36.370 align:middle line:84% So I replace b with its remainder 00:42:36.370 --> 00:42:38.250 align:middle line:90% when it's divided by a. 00:42:38.250 --> 00:42:41.450 align:middle line:84% And now I just divide things the other direction. 00:42:41.450 --> 00:42:47.530 align:middle line:84% So if I take 46 divided by 38, I'm going to have 8 left over. 00:42:47.530 --> 00:42:53.220 align:middle line:84% So I'll get that this is equal to the GCD of 8 and 38. 00:42:53.220 --> 00:42:55.560 align:middle line:84% And then I'll divide things the other direction. 00:42:55.560 --> 00:42:59.700 align:middle line:84% I'll get the GCD of 8 and 6 because I'll 00:42:59.700 --> 00:43:03.980 align:middle line:84% have 6 left over when I take 38 and divide it by 8. 00:43:03.980 --> 00:43:09.620 align:middle line:84% And then I'll take the GCD again, and I'll get 2 and 6. 00:43:09.620 --> 00:43:17.860 align:middle line:84% And now I get no remainder, the GCD between 2 and 0. 00:43:17.860 --> 00:43:20.080 align:middle line:84% So my Euclidean algorithm stopped. 00:43:20.080 --> 00:43:22.180 align:middle line:90% But what's my answer? 00:43:22.180 --> 00:43:22.980 align:middle line:90% Two. 00:43:22.980 --> 00:43:24.740 align:middle line:90% That's exactly right. 00:43:24.740 --> 00:43:28.140 align:middle line:84% Because the key point is that what 00:43:28.140 --> 00:43:31.320 align:middle line:84% lemma 2 tells us is that, in each step, 00:43:31.320 --> 00:43:33.660 align:middle line:90% we're not changing the GCD. 00:43:33.660 --> 00:43:37.220 align:middle line:84% And what is the greatest common divisor between 2 and 0? 00:43:37.220 --> 00:43:40.740 align:middle line:84% It's just 2 because 0 gets divided 00:43:40.740 --> 00:43:42.880 align:middle line:90% by everything perfectly fine. 00:43:42.880 --> 00:43:45.740 align:middle line:90% 00:43:45.740 --> 00:43:48.640 align:middle line:84% So that's the Euclidean algorithm, 00:43:48.640 --> 00:43:52.100 align:middle line:90% which we now understand. 00:43:52.100 --> 00:43:54.500 align:middle line:84% And what I claim is that it's actually 00:43:54.500 --> 00:43:57.220 align:middle line:84% going to help us answer that key question. 00:43:57.220 --> 00:43:59.540 align:middle line:84% It's not totally obvious why it does 00:43:59.540 --> 00:44:01.340 align:middle line:90% and what it has to do with it. 00:44:01.340 --> 00:44:03.920 align:middle line:84% The key is, really, taking this algorithm 00:44:03.920 --> 00:44:06.580 align:middle line:90% and doing more bookkeeping. 00:44:06.580 --> 00:44:09.520 align:middle line:84% And that's called the extended Euclidean algorithm. 00:44:09.520 --> 00:44:21.620 align:middle line:90% 00:44:21.620 --> 00:44:25.460 align:middle line:84% So the key point behind this algorithm 00:44:25.460 --> 00:44:31.440 align:middle line:84% is we're going to keep track of how we got here. 00:44:31.440 --> 00:44:36.420 align:middle line:90% 00:44:36.420 --> 00:44:43.820 align:middle line:84% So, for example, when I start off with the state 46, 360, 00:44:43.820 --> 00:44:47.830 align:middle line:84% because I want to compute the GCD between these two things, 00:44:47.830 --> 00:44:52.590 align:middle line:84% instead of just replacing 360 with its remainder, 00:44:52.590 --> 00:44:57.390 align:middle line:84% I'm actually going to keep track of what integer multiple of 46 I 00:44:57.390 --> 00:45:00.390 align:middle line:84% subtracted off to get the remainder. 00:45:00.390 --> 00:45:02.910 align:middle line:84% So that's the key point is that my next state 00:45:02.910 --> 00:45:06.150 align:middle line:84% in this transition, 46 stays the same. 00:45:06.150 --> 00:45:09.310 align:middle line:84% But instead of just having 38, I'm going to keep track of it 00:45:09.310 --> 00:45:14.410 align:middle line:90% as 360 minus 7 times 46. 00:45:14.410 --> 00:45:18.590 align:middle line:90% 00:45:18.590 --> 00:45:19.650 align:middle line:90% Why am I doing that? 00:45:19.650 --> 00:45:22.150 align:middle line:90% We'll get into that in a second. 00:45:22.150 --> 00:45:25.110 align:middle line:84% But now, same thing happens here. 00:45:25.110 --> 00:45:28.590 align:middle line:84% So when I had this number, which is 38, 00:45:28.590 --> 00:45:31.510 align:middle line:84% and I knew that I had to subtract off one copy of it 00:45:31.510 --> 00:45:34.830 align:middle line:84% from 46 to get my remainder 8, so I'm just 00:45:34.830 --> 00:45:36.610 align:middle line:84% going to subtract that off wholesale, 00:45:36.610 --> 00:45:40.030 align:middle line:84% subtract off this entire expression. 00:45:40.030 --> 00:45:46.830 align:middle line:84% And what this will give me is it'll give me 46 minus 360 00:45:46.830 --> 00:45:51.830 align:middle line:90% minus 7 times 46. 00:45:51.830 --> 00:46:01.270 align:middle line:84% And then, on the other side, I still have 360 minus 7 times 46. 00:46:01.270 --> 00:46:03.710 align:middle line:84% So this seems kind of strange because I just 00:46:03.710 --> 00:46:06.990 align:middle line:84% took a beautiful algorithm that's very simple to understand 00:46:06.990 --> 00:46:10.590 align:middle line:84% and analyze, and I just made it a lot uglier by keeping 00:46:10.590 --> 00:46:12.050 align:middle line:90% track of all of these things. 00:46:12.050 --> 00:46:16.230 align:middle line:84% But the key point is if you look in these steps, 00:46:16.230 --> 00:46:18.270 align:middle line:84% the intermediates that I have are 00:46:18.270 --> 00:46:22.030 align:middle line:84% all integer linear combinations of the two things 00:46:22.030 --> 00:46:23.750 align:middle line:90% I started off with. 00:46:23.750 --> 00:46:26.550 align:middle line:90% Originally, I have 46 and 360. 00:46:26.550 --> 00:46:29.910 align:middle line:84% And all of the numbers that I get in between 00:46:29.910 --> 00:46:34.070 align:middle line:84% are some kind of integer times one of the numbers, 46, 00:46:34.070 --> 00:46:37.910 align:middle line:84% plus an integer times the other number, 360. 00:46:37.910 --> 00:46:39.630 align:middle line:84% So at the end of the day, when I get 00:46:39.630 --> 00:46:43.240 align:middle line:84% the answer of 2, what I've really done 00:46:43.240 --> 00:46:46.600 align:middle line:84% is, when I keep track of these integers along the way, 00:46:46.600 --> 00:46:49.040 align:middle line:84% I've found some integers, s and t, 00:46:49.040 --> 00:46:57.760 align:middle line:84% so that 46 times s plus 360 times t is equal to 2. 00:46:57.760 --> 00:47:00.480 align:middle line:84% And my extended Euclidean algorithm will not just 00:47:00.480 --> 00:47:04.960 align:middle line:84% compute that the GCD is 2 but it will find the integers s 00:47:04.960 --> 00:47:09.000 align:middle line:90% and t that make that be true. 00:47:09.000 --> 00:47:11.360 align:middle line:84% And so what's really cool about this expression, 00:47:11.360 --> 00:47:17.720 align:middle line:84% if you think about it, let's say you didn't trust me. 00:47:17.720 --> 00:47:21.000 align:middle line:84% Maybe I'm certainly prone to making algebra mistakes, 00:47:21.000 --> 00:47:22.480 align:middle line:90% like everyone else. 00:47:22.480 --> 00:47:26.120 align:middle line:84% Maybe I made some algebra mistake along the way here, 00:47:26.120 --> 00:47:29.400 align:middle line:84% and I just tell you the answer that I got, 2. 00:47:29.400 --> 00:47:31.840 align:middle line:84% One thing you can do is you can check 00:47:31.840 --> 00:47:36.080 align:middle line:84% that 2 actually is a divisor of the two things I started with. 00:47:36.080 --> 00:47:41.260 align:middle line:84% So if I have 2 as my candidate answer, 00:47:41.260 --> 00:47:46.000 align:middle line:84% I can check that it really does divide both 46 and 360. 00:47:46.000 --> 00:47:49.320 align:middle line:84% But how do I guarantee you that there's not a bigger 00:47:49.320 --> 00:47:52.784 align:middle line:90% divisor of both of them? 00:47:52.784 --> 00:47:55.680 align:middle line:84% And so the key point is right here. 00:47:55.680 --> 00:47:58.440 align:middle line:84% Imagine there were a larger integer that 00:47:58.440 --> 00:48:00.960 align:middle line:90% divided both of them-- 00:48:00.960 --> 00:48:03.420 align:middle line:90% 4, 6, something like that. 00:48:03.420 --> 00:48:07.440 align:middle line:84% Imagine I had some integer K that was larger than 2 00:48:07.440 --> 00:48:10.640 align:middle line:90% that divided both 46 and 360. 00:48:10.640 --> 00:48:14.320 align:middle line:84% I claim this expression proves for me that it cannot be 00:48:14.320 --> 00:48:19.320 align:middle line:84% a divisor of both because if k really did divide both of these 00:48:19.320 --> 00:48:24.000 align:middle line:84% things, 46 and 360, when I take the left-hand side and divide it 00:48:24.000 --> 00:48:28.800 align:middle line:84% by k, I'd get an integer times an integer plus an integer times 00:48:28.800 --> 00:48:29.800 align:middle line:90% an integer. 00:48:29.800 --> 00:48:31.120 align:middle line:90% That's an integer. 00:48:31.120 --> 00:48:34.480 align:middle line:84% But my right-hand side is not an integer. 00:48:34.480 --> 00:48:37.200 align:middle line:84% So this is actually a certificate that your answer 00:48:37.200 --> 00:48:39.490 align:middle line:90% cannot be any smaller. 00:48:39.490 --> 00:48:41.470 align:middle line:84% So you don't even have to trust my work 00:48:41.470 --> 00:48:43.970 align:middle line:84% because, at the end of the day, the s and the t 00:48:43.970 --> 00:48:48.570 align:middle line:84% I find are the proof that I found the largest possible GCD. 00:48:48.570 --> 00:48:51.370 align:middle line:90% Does everyone understand that? 00:48:51.370 --> 00:48:53.010 align:middle line:90% OK. 00:48:53.010 --> 00:48:56.410 align:middle line:84% So now, let's connect it back to our key question. 00:48:56.410 --> 00:49:01.290 align:middle line:84% And I'll just state this as a lemma first. 00:49:01.290 --> 00:49:03.370 align:middle line:84% This is really the thing which came out 00:49:03.370 --> 00:49:13.290 align:middle line:84% of our proof is that, given any integers a and b, what I claim 00:49:13.290 --> 00:49:18.210 align:middle line:84% is there exist integers s and t with the property 00:49:18.210 --> 00:49:25.770 align:middle line:84% that sa plus tb is equal to the GCD of a and b. 00:49:25.770 --> 00:49:28.570 align:middle line:84% And that's just the abstract version of what we just 00:49:28.570 --> 00:49:31.610 align:middle line:90% did in this specific example. 00:49:31.610 --> 00:49:37.095 align:middle line:84% But now we're in good shape to answer this question. 00:49:37.095 --> 00:49:41.000 align:middle line:84% So let's return to this, and let's ask, 00:49:41.000 --> 00:49:54.090 align:middle line:84% why does 4 have a multiplicative inverse mod 7? 00:49:54.090 --> 00:49:57.500 align:middle line:90% 00:49:57.500 --> 00:50:00.380 align:middle line:84% Well, let's think about it in the context of the Euclidean 00:50:00.380 --> 00:50:01.740 align:middle line:90% algorithm. 00:50:01.740 --> 00:50:08.580 align:middle line:84% So the GCD between 4 and 7 is what? 00:50:08.580 --> 00:50:14.940 align:middle line:90% 1 because 7 is prime. 00:50:14.940 --> 00:50:17.380 align:middle line:90% Now I can use this lemma. 00:50:17.380 --> 00:50:27.420 align:middle line:84% If the GCD between 4 and 7 is 1, What it means, by lemma 3, 00:50:27.420 --> 00:50:36.140 align:middle line:84% is that there are integers s and t so that 4s plus 7t is equal 00:50:36.140 --> 00:50:36.800 align:middle line:90% to 1. 00:50:36.800 --> 00:50:40.700 align:middle line:90% 00:50:40.700 --> 00:50:45.260 align:middle line:84% And what I claim is that this implies that 4 00:50:45.260 --> 00:50:47.900 align:middle line:90% has a multiplicative inverse. 00:50:47.900 --> 00:50:49.740 align:middle line:90% We know the answer is 2. 00:50:49.740 --> 00:50:53.420 align:middle line:84% But from this expression, what I claim 00:50:53.420 --> 00:50:58.140 align:middle line:84% is that my multiplicative inverse of 4 is s. 00:50:58.140 --> 00:51:03.740 align:middle line:84% When I take 4 times s, I'm going to get 1 minus 7t. 00:51:03.740 --> 00:51:08.220 align:middle line:84% So it's actually 4 times s is congruent to 1 00:51:08.220 --> 00:51:14.580 align:middle line:84% modulo 7 because all of those integer multiples of 7 go away. 00:51:14.580 --> 00:51:18.380 align:middle line:84% So that's actually the proof of why not just 4 has 00:51:18.380 --> 00:51:21.020 align:middle line:90% a multiplicative inverse mod 7. 00:51:21.020 --> 00:51:23.820 align:middle line:84% Why does every number that's nonzero 00:51:23.820 --> 00:51:26.300 align:middle line:84% have a multiplicative inverse mod 7? 00:51:26.300 --> 00:51:29.580 align:middle line:84% It's just because, for any other number b here, 00:51:29.580 --> 00:51:34.910 align:middle line:84% I know the GCD between b and 7 is 1 because 7 is prime. 00:51:34.910 --> 00:51:38.470 align:middle line:84% And I know that means there's an expression for b-- sorry, 00:51:38.470 --> 00:51:41.910 align:middle line:90% bs plus 7t equals 1. 00:51:41.910 --> 00:51:45.730 align:middle line:84% And in that case, s would be my multiplicative inverse. 00:51:45.730 --> 00:51:50.690 align:middle line:84% So even more generally, the GCD between b and 7 is 1. 00:51:50.690 --> 00:51:53.430 align:middle line:90% This is true for any nonzero b. 00:51:53.430 --> 00:51:59.470 align:middle line:84% And this would then imply by lemma 3 that b times s plus 7t 00:51:59.470 --> 00:52:00.870 align:middle line:90% equals 1. 00:52:00.870 --> 00:52:05.790 align:middle line:84% And that means that this expression right here, s 00:52:05.790 --> 00:52:07.140 align:middle line:90% is the inverse. 00:52:07.140 --> 00:52:12.514 align:middle line:90% 00:52:12.514 --> 00:52:16.190 align:middle line:84% So this actually answers all of our questions. 00:52:16.190 --> 00:52:19.270 align:middle line:84% So we had this question, does every element 00:52:19.270 --> 00:52:21.750 align:middle line:90% have a multiplicative inverse? 00:52:21.750 --> 00:52:26.470 align:middle line:84% That's true, as long as the modulus is prime. 00:52:26.470 --> 00:52:29.110 align:middle line:84% I had this question, how could I compute 00:52:29.110 --> 00:52:30.370 align:middle line:90% the multiplicative inverse? 00:52:30.370 --> 00:52:33.350 align:middle line:84% So if I gave you some large prime p 00:52:33.350 --> 00:52:36.350 align:middle line:84% and I gave you some nonzero element a, 00:52:36.350 --> 00:52:41.510 align:middle line:84% how would I compute the inverse of a mod p? 00:52:41.510 --> 00:52:42.660 align:middle line:90% Does anyone have any ideas? 00:52:42.660 --> 00:52:45.670 align:middle line:90% 00:52:45.670 --> 00:52:48.450 align:middle line:84% The answer is on the board someplace. 00:52:48.450 --> 00:52:54.390 align:middle line:90% 00:52:54.390 --> 00:52:54.910 align:middle line:90% Yeah? 00:52:54.910 --> 00:52:56.853 align:middle line:84% AUDIENCE: Use the extended algorithm. 00:52:56.853 --> 00:52:57.770 align:middle line:90% ANKUR MOITRA: Perfect. 00:52:57.770 --> 00:52:58.950 align:middle line:90% That's right. 00:52:58.950 --> 00:53:01.590 align:middle line:84% So I would use the extended Euclidean algorithm. 00:53:01.590 --> 00:53:06.270 align:middle line:84% I would apply it with not 46 and 360 but a and p. 00:53:06.270 --> 00:53:09.930 align:middle line:84% And my point of doing this isn't to compute the GCD. 00:53:09.930 --> 00:53:11.870 align:middle line:90% I know the GCD is 1. 00:53:11.870 --> 00:53:15.670 align:middle line:84% My point is to find this expression, the s and the t. 00:53:15.670 --> 00:53:19.330 align:middle line:84% And then that s that I find will be the multiplicative inverse. 00:53:19.330 --> 00:53:21.190 align:middle line:90% That's exactly right. 00:53:21.190 --> 00:53:28.190 align:middle line:84% So this answers, basically, all the questions we could want. 00:53:28.190 --> 00:53:30.850 align:middle line:84% In fact, there's even a more subtle question, 00:53:30.850 --> 00:53:33.560 align:middle line:90% which we can answer, too. 00:53:33.560 --> 00:53:38.520 align:middle line:84% If I have a modulus that's not prime, 00:53:38.520 --> 00:53:44.000 align:middle line:84% like 6, it turns out that 5 has a multiplicative inverse 00:53:44.000 --> 00:53:48.880 align:middle line:84% mod 6 because the GCD of 5 and 6 is 1. 00:53:48.880 --> 00:53:51.120 align:middle line:84% So you'll actually have a multiplicative inverse 00:53:51.120 --> 00:53:54.640 align:middle line:84% when you don't have a prime modulus just for the things that 00:53:54.640 --> 00:53:56.170 align:middle line:90% don't share a common factor. 00:53:56.170 --> 00:54:05.426 align:middle line:90% 00:54:05.426 --> 00:54:09.640 align:middle line:84% So this was the main part of lecture, 00:54:09.640 --> 00:54:11.960 align:middle line:84% but now what we're going to do is 00:54:11.960 --> 00:54:15.920 align:middle line:84% we're going to do one last cool application 00:54:15.920 --> 00:54:20.880 align:middle line:84% of modular arithmetic in the last few minutes of class. 00:54:20.880 --> 00:54:24.720 align:middle line:84% And this is another really important topic, 00:54:24.720 --> 00:54:26.380 align:middle line:90% tons and tons of applications. 00:54:26.380 --> 00:54:30.600 align:middle line:84% So I'll tell you the math riddle. 00:54:30.600 --> 00:54:33.000 align:middle line:84% And then I'll tell you some applications 00:54:33.000 --> 00:54:35.900 align:middle line:90% of this once we solve it. 00:54:35.900 --> 00:54:43.840 align:middle line:90% 00:54:43.840 --> 00:54:47.380 align:middle line:84% So let's just start off with a riddle about modular arithmetic. 00:54:47.380 --> 00:54:56.560 align:middle line:90% 00:54:56.560 --> 00:55:05.640 align:middle line:84% So let's say we've got a treasure chest, 00:55:05.640 --> 00:55:07.070 align:middle line:90% and it's got gold coins. 00:55:07.070 --> 00:55:14.520 align:middle line:90% 00:55:14.520 --> 00:55:19.880 align:middle line:84% And let's imagine I promise you that if this treasure is 00:55:19.880 --> 00:55:32.190 align:middle line:84% divided into groups of 5, I'm going to have 4 coins left over. 00:55:32.190 --> 00:55:36.050 align:middle line:90% 00:55:36.050 --> 00:55:38.490 align:middle line:90% And let's imagine same thing. 00:55:38.490 --> 00:55:44.530 align:middle line:84% If it's divided up into groups of 7, what I'll have is 00:55:44.530 --> 00:55:47.140 align:middle line:90% I'll have 1 coin left over. 00:55:47.140 --> 00:55:51.210 align:middle line:90% 00:55:51.210 --> 00:55:53.050 align:middle line:84% So there are many possible answers 00:55:53.050 --> 00:55:55.490 align:middle line:84% to how many gold coins there could be. 00:55:55.490 --> 00:55:59.050 align:middle line:84% But what I'll be interested in is what's the smallest number. 00:55:59.050 --> 00:56:09.360 align:middle line:84% So what is the smallest number of possible coins? 00:56:09.360 --> 00:56:14.690 align:middle line:90% 00:56:14.690 --> 00:56:19.570 align:middle line:84% So that's our key riddle for the rest of lecture. 00:56:19.570 --> 00:56:21.490 align:middle line:84% Of course, this riddle is going to lead 00:56:21.490 --> 00:56:24.540 align:middle line:84% to a very interesting statement in its own right that's 00:56:24.540 --> 00:56:25.040 align:middle line:90% powerful. 00:56:25.040 --> 00:56:30.460 align:middle line:90% 00:56:30.460 --> 00:56:34.540 align:middle line:84% And what I claim, what's really going on here, 00:56:34.540 --> 00:56:37.726 align:middle line:84% is that we have a system of equations. 00:56:37.726 --> 00:56:41.660 align:middle line:90% 00:56:41.660 --> 00:56:44.460 align:middle line:84% But the key point, which is different than the system 00:56:44.460 --> 00:56:48.300 align:middle line:84% of equations you've seen before, is 00:56:48.300 --> 00:56:51.220 align:middle line:84% that these system of equations are really 00:56:51.220 --> 00:56:53.806 align:middle line:90% in modular arithmetic. 00:56:53.806 --> 00:57:04.220 align:middle line:84% So translating this, so we want to solve 00:57:04.220 --> 00:57:06.680 align:middle line:84% for n, which is the smallest number of coins 00:57:06.680 --> 00:57:08.340 align:middle line:90% that could be the answer. 00:57:08.340 --> 00:57:13.860 align:middle line:84% So we know that n is congruent to 4 mod 5. 00:57:13.860 --> 00:57:16.240 align:middle line:84% That's literally just using the definition 00:57:16.240 --> 00:57:20.660 align:middle line:84% because what that means is just that 4 is the remainder when 00:57:20.660 --> 00:57:23.220 align:middle line:90% we divide n by 5. 00:57:23.220 --> 00:57:33.340 align:middle line:84% And the second statement is that n is congruent to 1 mod 7. 00:57:33.340 --> 00:57:36.440 align:middle line:84% So it turns out that we can guess the answer here, 00:57:36.440 --> 00:57:39.820 align:middle line:84% but I'll tell you more formulaically how to find it. 00:57:39.820 --> 00:57:44.380 align:middle line:84% So if you take, for example, 29, then this works. 00:57:44.380 --> 00:57:48.590 align:middle line:84% It solves the system of two equations in different moduli. 00:57:48.590 --> 00:57:52.180 align:middle line:90% 00:57:52.180 --> 00:57:55.120 align:middle line:84% But, actually, there's a much more general result. 00:57:55.120 --> 00:57:58.820 align:middle line:84% I guess today is the day we're doing ancient results. 00:57:58.820 --> 00:58:01.320 align:middle line:84% So this, similarly, like the Euclidean algorithm, 00:58:01.320 --> 00:58:04.500 align:middle line:90% is one of the oldest algorithms. 00:58:04.500 --> 00:58:07.740 align:middle line:84% This is a fairly old statement, too. 00:58:07.740 --> 00:58:13.428 align:middle line:84% It's due to a Chinese mathematician, Sun Tzu 00:58:13.428 --> 00:58:18.310 align:middle line:90% Shuan in the fourth century. 00:58:18.310 --> 00:58:24.190 align:middle line:90% 00:58:24.190 --> 00:58:27.390 align:middle line:84% And what I claim, and we'll prove this, 00:58:27.390 --> 00:58:32.980 align:middle line:84% so suppose a and b are relatively prime. 00:58:32.980 --> 00:58:36.190 align:middle line:90% 00:58:36.190 --> 00:58:39.410 align:middle line:84% By that, I mean they don't both have to be prime, 00:58:39.410 --> 00:58:42.670 align:middle line:84% but they share no common factors besides 1. 00:58:42.670 --> 00:58:45.150 align:middle line:90% Their GCD is 1 between them. 00:58:45.150 --> 00:58:47.650 align:middle line:84% So imagine that a and b are relatively prime. 00:58:47.650 --> 00:58:50.420 align:middle line:84% a and b will play the role of 5 and 7 here. 00:58:50.420 --> 00:58:53.150 align:middle line:90% 00:58:53.150 --> 00:58:57.680 align:middle line:84% So just to be clear, this means GCD of a and b equals 1. 00:58:57.680 --> 00:59:00.670 align:middle line:90% 00:59:00.670 --> 00:59:12.590 align:middle line:84% And we have some unknown n that's between 0 and ab minus 1. 00:59:12.590 --> 00:59:14.510 align:middle line:84% Then what I claim is that if we think 00:59:14.510 --> 00:59:22.630 align:middle line:84% about the system of equations, n is congruent to r mod a and n is 00:59:22.630 --> 00:59:30.310 align:middle line:84% congruent to s mod b, then what I claim 00:59:30.310 --> 00:59:35.620 align:middle line:84% is that there is exactly one solution. 00:59:35.620 --> 00:59:41.790 align:middle line:90% 00:59:41.790 --> 00:59:46.510 align:middle line:84% So this is somehow exactly what you could hope for. 00:59:46.510 --> 00:59:51.750 align:middle line:84% I'm only telling you one out of a possibilities here. 00:59:51.750 --> 00:59:55.830 align:middle line:84% I'm only telling you one out of b possibilities here. 00:59:55.830 --> 00:59:59.590 align:middle line:84% So, at most, I can uniquely determine integers between 0 00:59:59.590 --> 01:00:01.710 align:middle line:90% and ab minus 1. 01:00:01.710 --> 01:00:06.470 align:middle line:84% But I'm claiming that every such integer is uniquely determined 01:00:06.470 --> 01:00:12.670 align:middle line:84% by its pair of residues, modulo a and b. 01:00:12.670 --> 01:00:15.670 align:middle line:84% So really, this is a bijection between all 01:00:15.670 --> 01:00:19.070 align:middle line:84% of these ab possibilities of the integers here 01:00:19.070 --> 01:00:24.840 align:middle line:84% and the possible pairs r and s of what this moduli are. 01:00:24.840 --> 01:00:28.200 align:middle line:84% So are there any questions about the statement? 01:00:28.200 --> 01:00:29.520 align:middle line:90% All right. 01:00:29.520 --> 01:00:31.080 align:middle line:90% So let's prove this. 01:00:31.080 --> 01:00:35.240 align:middle line:90% The proof of this is clever. 01:00:35.240 --> 01:00:39.890 align:middle line:84% Usually, this is called the Chinese remainder theorem. 01:00:39.890 --> 01:00:46.800 align:middle line:90% 01:00:46.800 --> 01:00:48.300 align:middle line:90% And let's prove this fact. 01:00:48.300 --> 01:00:50.120 align:middle line:84% This will use a lot of the properties 01:00:50.120 --> 01:00:53.400 align:middle line:84% about Euclidean algorithm and modular arithmetic 01:00:53.400 --> 01:00:56.180 align:middle line:84% that we've been developing for today's lecture. 01:00:56.180 --> 01:00:57.680 align:middle line:84% And then, if we have time left over, 01:00:57.680 --> 01:01:00.840 align:middle line:84% I'll tell you a cool application, 01:01:00.840 --> 01:01:04.520 align:middle line:84% just to get some intuition for why this Chinese remainder 01:01:04.520 --> 01:01:05.590 align:middle line:90% theorem is so powerful. 01:01:05.590 --> 01:01:12.320 align:middle line:90% 01:01:12.320 --> 01:01:14.560 align:middle line:84% Actually, I guess I could have kept that. 01:01:14.560 --> 01:01:17.080 align:middle line:90% All right. 01:01:17.080 --> 01:01:18.240 align:middle line:90% So let's prove this. 01:01:18.240 --> 01:01:22.730 align:middle line:90% 01:01:22.730 --> 01:01:34.290 align:middle line:84% So as I told you already, there are ab choices for n 01:01:34.290 --> 01:01:43.060 align:middle line:84% and, similarly, ab choices for the pairs s, t. 01:01:43.060 --> 01:01:46.595 align:middle line:90% 01:01:46.595 --> 01:01:54.130 align:middle line:84% So what we want to show is the following, that for-- 01:01:54.130 --> 01:01:56.690 align:middle line:84% I'm going to call this statement star-- 01:01:56.690 --> 01:02:04.690 align:middle line:84% I want to show that, for any choices of x and y 01:02:04.690 --> 01:02:08.450 align:middle line:90% that are between 0 and ab-- 01:02:08.450 --> 01:02:11.970 align:middle line:90% so any possible answers x, y-- 01:02:11.970 --> 01:02:19.130 align:middle line:84% well, what I want is that their pair of remainders 01:02:19.130 --> 01:02:21.250 align:middle line:90% are not both the same. 01:02:21.250 --> 01:02:24.050 align:middle line:84% I take the remainder of x divided by a. 01:02:24.050 --> 01:02:27.650 align:middle line:84% I look at the remainder of x divided by b. 01:02:27.650 --> 01:02:31.770 align:middle line:84% That pair of remainders had better not both 01:02:31.770 --> 01:02:34.690 align:middle line:84% be equal to the pair of remainders 01:02:34.690 --> 01:02:38.530 align:middle line:84% I get when I take y and divide it by a and, 01:02:38.530 --> 01:02:43.090 align:middle line:84% similarly, I take y and divide it by b. 01:02:43.090 --> 01:02:46.550 align:middle line:84% So maybe I have pairs x, y that are different. 01:02:46.550 --> 01:02:50.170 align:middle line:90% I'll assume x not equal to y. 01:02:50.170 --> 01:02:53.570 align:middle line:84% Maybe I have pairs x, y that are different that have one 01:02:53.570 --> 01:02:56.930 align:middle line:84% of their remainders match, but I cannot get different 01:02:56.930 --> 01:03:01.650 align:middle line:84% x's and y's which have both of their remainders match. 01:03:01.650 --> 01:03:02.830 align:middle line:90% So that's the key property. 01:03:02.830 --> 01:03:06.200 align:middle line:90% 01:03:06.200 --> 01:03:08.490 align:middle line:90% So let's show this. 01:03:08.490 --> 01:03:21.940 align:middle line:84% So we're going to show star by assuming it's not true 01:03:21.940 --> 01:03:24.700 align:middle line:90% and creating a contradiction. 01:03:24.700 --> 01:03:27.380 align:middle line:84% So this proof will be short, but the logic 01:03:27.380 --> 01:03:30.020 align:middle line:90% is pretty clever for this. 01:03:30.020 --> 01:03:33.460 align:middle line:84% So let's assume that we have a pair 01:03:33.460 --> 01:03:37.300 align:middle line:84% x, y that are different, that are between 0 01:03:37.300 --> 01:03:41.540 align:middle line:84% and ab, which have both of their pairs of remainders 01:03:41.540 --> 01:03:43.460 align:middle line:90% exactly identical. 01:03:43.460 --> 01:03:46.460 align:middle line:84% And let's produce a contradiction. 01:03:46.460 --> 01:03:53.100 align:middle line:84% So if we have such a pair x, y, then what I claim 01:03:53.100 --> 01:03:56.370 align:middle line:90% is that x minus y-- 01:03:56.370 --> 01:03:59.700 align:middle line:90% 01:03:59.700 --> 01:04:03.460 align:middle line:84% which way do I want to say this? oh, sorry, other way around-- 01:04:03.460 --> 01:04:05.560 align:middle line:90% a divides x minus y. 01:04:05.560 --> 01:04:13.060 align:middle line:90% 01:04:13.060 --> 01:04:16.340 align:middle line:90% Why is that true? 01:04:16.340 --> 01:04:19.340 align:middle line:84% So we're assuming that this statement is false. 01:04:19.340 --> 01:04:23.800 align:middle line:84% Why is it true that the a divides x minus y? 01:04:23.800 --> 01:04:30.260 align:middle line:90% 01:04:30.260 --> 01:04:33.860 align:middle line:84% What does it mean for these two things to be equal? 01:04:33.860 --> 01:04:37.820 align:middle line:84% Definitely, their first components have to be equal. 01:04:37.820 --> 01:04:40.420 align:middle line:84% So if remainder of x divided by a 01:04:40.420 --> 01:04:44.180 align:middle line:84% is equal to the remainder of y divided by a, then 01:04:44.180 --> 01:04:48.340 align:middle line:84% that means that they differ by an integer multiple of a. 01:04:48.340 --> 01:04:50.900 align:middle line:90% So a divides their difference. 01:04:50.900 --> 01:04:53.620 align:middle line:84% This is the same type of thing we did before. 01:04:53.620 --> 01:05:00.740 align:middle line:84% And, similarly, we know that b divides x minus y, as well. 01:05:00.740 --> 01:05:04.220 align:middle line:90% 01:05:04.220 --> 01:05:08.460 align:middle line:90% And now, here's the key idea. 01:05:08.460 --> 01:05:11.750 align:middle line:84% We somehow have to use the fact that a and b are 01:05:11.750 --> 01:05:14.670 align:middle line:90% relatively prime. 01:05:14.670 --> 01:05:22.670 align:middle line:84% We know, by assumption, that the GCD of a and b is equal to 1. 01:05:22.670 --> 01:05:32.230 align:middle line:84% And what this tells us, it means that ab, the pair of them 01:05:32.230 --> 01:05:36.630 align:middle line:90% divides x minus y. 01:05:36.630 --> 01:05:37.930 align:middle line:90% So this is the key thing. 01:05:37.930 --> 01:05:40.430 align:middle line:90% This isn't always true. 01:05:40.430 --> 01:05:41.550 align:middle line:90% If I had two things-- 01:05:41.550 --> 01:05:48.230 align:middle line:90% I had, I don't know, 6 and 9-- 01:05:48.230 --> 01:05:51.747 align:middle line:84% if I knew that 6 divided my integer and 9 divided 01:05:51.747 --> 01:05:57.670 align:middle line:84% my integer, it would not imply that 54 divides my integer 01:05:57.670 --> 01:06:01.710 align:middle line:84% because maybe I only have two powers of 3 sitting in there. 01:06:01.710 --> 01:06:04.990 align:middle line:84% But the key point is that, because both a and b are 01:06:04.990 --> 01:06:10.870 align:middle line:84% relatively prime, the only way that they both divide x minus y 01:06:10.870 --> 01:06:14.965 align:middle line:84% is if their product divides x minus y, as well. 01:06:14.965 --> 01:06:16.590 align:middle line:84% So you can think about this in the case 01:06:16.590 --> 01:06:19.210 align:middle line:84% where a and b are not just relatively prime 01:06:19.210 --> 01:06:22.830 align:middle line:84% but they're prime, like in our example with 5 and 7. 01:06:22.830 --> 01:06:26.250 align:middle line:84% If 5 divides your integer and 7 divides your integer, 01:06:26.250 --> 01:06:27.550 align:middle line:90% there's no choice. 01:06:27.550 --> 01:06:30.110 align:middle line:84% 35 has to divide your integer, too. 01:06:30.110 --> 01:06:33.430 align:middle line:84% That's basically what the statement is saying. 01:06:33.430 --> 01:06:35.590 align:middle line:84% And this is the key step because, now, we're 01:06:35.590 --> 01:06:38.870 align:middle line:90% in good shape. 01:06:38.870 --> 01:06:45.490 align:middle line:84% And so if ab divides x minus y, I claim this is a contradiction. 01:06:45.490 --> 01:06:54.230 align:middle line:90% 01:06:54.230 --> 01:06:56.430 align:middle line:90% So someone make me happy. 01:06:56.430 --> 01:06:58.450 align:middle line:84% Tell me what the statement contradicts. 01:06:58.450 --> 01:07:02.790 align:middle line:84% See, the statements I've made are not very complicated, 01:07:02.790 --> 01:07:05.270 align:middle line:90% but the logic is subtle. 01:07:05.270 --> 01:07:08.960 align:middle line:84% I wanted to prove that star was true, 01:07:08.960 --> 01:07:11.240 align:middle line:90% so I assumed it's not true. 01:07:11.240 --> 01:07:16.200 align:middle line:84% I assumed that there was a different pair x, y where 01:07:16.200 --> 01:07:22.480 align:middle line:84% they were both between 0 and ab where a divides their difference 01:07:22.480 --> 01:07:23.860 align:middle line:90% and b divides their difference. 01:07:23.860 --> 01:07:28.280 align:middle line:84% And I concluded that ab must divide their difference. 01:07:28.280 --> 01:07:30.320 align:middle line:84% But now I claim I'm done, and I've actually 01:07:30.320 --> 01:07:33.520 align:middle line:90% contradicted something. 01:07:33.520 --> 01:07:36.000 align:middle line:84% AUDIENCE: If x and y are different, 01:07:36.000 --> 01:07:38.760 align:middle line:84% than they have to be off by at least ab. 01:07:38.760 --> 01:07:40.400 align:middle line:84% ANKUR MOITRA: That's exactly right. 01:07:40.400 --> 01:07:41.320 align:middle line:90% That's right. 01:07:41.320 --> 01:07:46.480 align:middle line:84% If x and y are different and are between 0 and ab, 01:07:46.480 --> 01:07:50.000 align:middle line:84% they cannot differ by a multiple of ab. 01:07:50.000 --> 01:07:51.840 align:middle line:90% That's impossible. 01:07:51.840 --> 01:07:54.520 align:middle line:84% That's the same type of logic we used earlier. 01:07:54.520 --> 01:07:58.000 align:middle line:84% So this contradicts what we started off with. 01:07:58.000 --> 01:08:01.400 align:middle line:84% And what this means is that, hence, 01:08:01.400 --> 01:08:06.640 align:middle line:84% the Chinese remainder theorem is true, so very, very clever 01:08:06.640 --> 01:08:07.140 align:middle line:90% proof. 01:08:07.140 --> 01:08:10.390 align:middle line:90% 01:08:10.390 --> 01:08:11.040 align:middle line:90% Make sense? 01:08:11.040 --> 01:08:14.987 align:middle line:90% 01:08:14.987 --> 01:08:17.029 align:middle line:84% And if you have any questions about these things, 01:08:17.029 --> 01:08:18.569 align:middle line:84% you should sit down and make sure 01:08:18.569 --> 01:08:21.410 align:middle line:84% that you can reconstruct the logic yourself. 01:08:21.410 --> 01:08:25.990 align:middle line:84% This proof and the proof of lemma 1 are not hard. 01:08:25.990 --> 01:08:29.569 align:middle line:84% But, really, one of the things with doing proof-based math 01:08:29.569 --> 01:08:34.410 align:middle line:84% is it's one thing to be able to verify, line by line, the steps 01:08:34.410 --> 01:08:36.569 align:middle line:84% as someone is giving them to you. 01:08:36.569 --> 01:08:41.850 align:middle line:84% But to really understand it deeply, 01:08:41.850 --> 01:08:44.689 align:middle line:84% you have to check whether or not you can reconstruct these things 01:08:44.689 --> 01:08:45.890 align:middle line:90% yourself. 01:08:45.890 --> 01:08:47.649 align:middle line:84% These types of things often happen 01:08:47.649 --> 01:08:50.830 align:middle line:84% on tests, where you think that you understood something, 01:08:50.830 --> 01:08:53.410 align:middle line:84% but when you're forced to come up with it yourself, 01:08:53.410 --> 01:08:54.335 align:middle line:90% it's much harder. 01:08:54.335 --> 01:08:55.710 align:middle line:84% So that's just a piece of advice. 01:08:55.710 --> 01:08:56.090 align:middle line:90% Yeah? 01:08:56.090 --> 01:08:57.515 align:middle line:84% AUDIENCE: Does the solution exist at all? 01:08:57.515 --> 01:08:58.265 align:middle line:90% ANKUR MOITRA: Hmm? 01:08:58.265 --> 01:09:00.350 align:middle line:84% AUDIENCE: The solution exists at all. 01:09:00.350 --> 01:09:03.410 align:middle line:84% ANKUR MOITRA: So the solution exists at all. 01:09:03.410 --> 01:09:07.529 align:middle line:84% So the point is that every pair-- 01:09:07.529 --> 01:09:09.308 align:middle line:90% that's a good question. 01:09:09.308 --> 01:09:14.010 align:middle line:84% So we know that there are ab choices for n, 01:09:14.010 --> 01:09:17.450 align:middle line:84% and there are ab choices for s, t. 01:09:17.450 --> 01:09:22.620 align:middle line:84% Now, if every choice of n gets mapped to some choice of s, 01:09:22.620 --> 01:09:28.490 align:middle line:84% t, and what we just proved is that they don't collide ever. 01:09:28.490 --> 01:09:30.250 align:middle line:84% So what this really means is that we 01:09:30.250 --> 01:09:33.529 align:middle line:84% can draw this bipartite graph right here where these 01:09:33.529 --> 01:09:35.569 align:middle line:90% are all of the values of n. 01:09:35.569 --> 01:09:39.370 align:middle line:84% These are all the different possible pairs s, t. 01:09:39.370 --> 01:09:42.050 align:middle line:84% And every n gets mapped to some value s, 01:09:42.050 --> 01:09:46.689 align:middle line:84% t just by taking the remainder modulo a and modulo b. 01:09:46.689 --> 01:09:48.850 align:middle line:84% And so what this proof just showed 01:09:48.850 --> 01:09:53.810 align:middle line:84% is that there are no x and y that map to the same thing. 01:09:53.810 --> 01:09:56.450 align:middle line:84% If there are no x and y that map to the same thing 01:09:56.450 --> 01:09:58.530 align:middle line:84% and they're the same size, there's 01:09:58.530 --> 01:10:02.210 align:middle line:84% no choice but everything maps to exactly one thing. 01:10:02.210 --> 01:10:04.400 align:middle line:84% And that means everything has a solution. 01:10:04.400 --> 01:10:06.580 align:middle line:90% And we can go back and forth. 01:10:06.580 --> 01:10:07.420 align:middle line:90% Good? 01:10:07.420 --> 01:10:08.688 align:middle line:90% Very good question. 01:10:08.688 --> 01:10:10.980 align:middle line:84% There's also another way to answer your question, which 01:10:10.980 --> 01:10:14.500 align:middle line:84% is the way that I will do next, so thanks for the segue. 01:10:14.500 --> 01:10:17.460 align:middle line:84% That'll be our last math topic for today 01:10:17.460 --> 01:10:20.860 align:middle line:84% before I tell you an application. 01:10:20.860 --> 01:10:23.970 align:middle line:90% See, the same way-- 01:10:23.970 --> 01:10:28.100 align:middle line:84% it was one thing to ask this question about whether or not 01:10:28.100 --> 01:10:31.380 align:middle line:84% every integer has a multiplicative inverse modulo 01:10:31.380 --> 01:10:32.460 align:middle line:90% prime. 01:10:32.460 --> 01:10:35.940 align:middle line:84% And then we asked for more because we not only wanted 01:10:35.940 --> 01:10:37.980 align:middle line:84% that the answer was yes, we wanted 01:10:37.980 --> 01:10:41.752 align:middle line:84% to actually find what that multiplicative inverse is. 01:10:41.752 --> 01:10:45.740 align:middle line:84% And the even stronger thing we could ask for 01:10:45.740 --> 01:10:48.640 align:middle line:84% is, OK, the Chinese remainder theorem is true. 01:10:48.640 --> 01:10:49.780 align:middle line:90% Hooray. 01:10:49.780 --> 01:10:51.940 align:middle line:84% But maybe we can also ask whether we 01:10:51.940 --> 01:10:55.500 align:middle line:90% can find the solution. 01:10:55.500 --> 01:10:58.620 align:middle line:90% So how can we actually find n? 01:10:58.620 --> 01:11:01.360 align:middle line:90% In our case, n was 29. 01:11:01.360 --> 01:11:08.380 align:middle line:90% So how can we find n? 01:11:08.380 --> 01:11:11.420 align:middle line:84% And so here is the step-by-step procedure 01:11:11.420 --> 01:11:13.100 align:middle line:90% for how we would do it. 01:11:13.100 --> 01:11:25.340 align:middle line:84% So first thing is that we write n is equal to kb plus t. 01:11:25.340 --> 01:11:29.820 align:middle line:84% So this is just the statement that if I take n and divide it 01:11:29.820 --> 01:11:33.740 align:middle line:90% by b, the leftover will be t. 01:11:33.740 --> 01:11:35.980 align:middle line:90% And I don't know what k is. 01:11:35.980 --> 01:11:39.320 align:middle line:84% So this just captures one of my modular equations, 01:11:39.320 --> 01:11:41.660 align:middle line:90% the second one. 01:11:41.660 --> 01:11:50.500 align:middle line:84% And we know that k is going to be between 0 and a, just 01:11:50.500 --> 01:11:55.330 align:middle line:84% because we know that our answer is supposed to be, at most, ab. 01:11:55.330 --> 01:11:58.925 align:middle line:90% 01:11:58.925 --> 01:12:04.750 align:middle line:84% And so what we can do is we can take this expression, which 01:12:04.750 --> 01:12:06.210 align:middle line:90% is just an integer expression. 01:12:06.210 --> 01:12:08.230 align:middle line:90% There's no modulus here. 01:12:08.230 --> 01:12:12.310 align:middle line:84% And we can take mods on both sides. 01:12:12.310 --> 01:12:21.950 align:middle line:84% We know that this implies that kb plus t is 01:12:21.950 --> 01:12:26.110 align:middle line:90% congruent to s mod a. 01:12:26.110 --> 01:12:28.250 align:middle line:90% This was our first equation. 01:12:28.250 --> 01:12:30.910 align:middle line:84% And now this was our second equation 01:12:30.910 --> 01:12:34.990 align:middle line:84% in these modular constraints because this unknown integer n, 01:12:34.990 --> 01:12:37.510 align:middle line:84% we know it should be equal to t mod b. 01:12:37.510 --> 01:12:41.980 align:middle line:84% And same thing, it should be equal to s mod a. 01:12:41.980 --> 01:12:46.150 align:middle line:84% And so what this implies now, if we just rearrange things, 01:12:46.150 --> 01:12:53.430 align:middle line:84% is that kb is equal to s minus t mod a. 01:12:53.430 --> 01:12:56.390 align:middle line:84% So just to emphasize, we know s, and we know t 01:12:56.390 --> 01:12:58.720 align:middle line:84% because those are the constraints in our system 01:12:58.720 --> 01:13:00.440 align:middle line:90% of modular equations. 01:13:00.440 --> 01:13:05.000 align:middle line:84% And what we're looking for is what k is. 01:13:05.000 --> 01:13:07.120 align:middle line:84% So now, does anyone have any ideas how 01:13:07.120 --> 01:13:12.080 align:middle line:84% we might solve this equation to figure out what k is? 01:13:12.080 --> 01:13:13.720 align:middle line:90% So what's the key idea? 01:13:13.720 --> 01:13:15.050 align:middle line:90% How can we solve this equation? 01:13:15.050 --> 01:13:18.312 align:middle line:90% 01:13:18.312 --> 01:13:19.603 align:middle line:90% AUDIENCE: [INAUDIBLE] 01:13:19.603 --> 01:13:20.520 align:middle line:90% ANKUR MOITRA: Perfect. 01:13:20.520 --> 01:13:21.480 align:middle line:90% That's right. 01:13:21.480 --> 01:13:24.760 align:middle line:84% We can just multiply by the multiplicative inverse 01:13:24.760 --> 01:13:27.600 align:middle line:90% of b, which, why does it exist? 01:13:27.600 --> 01:13:32.400 align:middle line:84% Because the GCD of b and a is 1 by assumption. 01:13:32.400 --> 01:13:35.800 align:middle line:84% So we know from the extended Euclidean algorithm 01:13:35.800 --> 01:13:39.080 align:middle line:84% that the multiplicative inverse exists, and we can find it. 01:13:39.080 --> 01:13:42.240 align:middle line:84% So, in particular, we can solve this equation. 01:13:42.240 --> 01:13:48.720 align:middle line:84% And we get that k is congruent to b inverse s minus t. 01:13:48.720 --> 01:13:51.120 align:middle line:90% And this all happens mod a. 01:13:51.120 --> 01:13:54.360 align:middle line:90% 01:13:54.360 --> 01:13:56.180 align:middle line:90% We know b inverse exists. 01:13:56.180 --> 01:13:59.840 align:middle line:84% And because k is between 0 and a, well, 01:13:59.840 --> 01:14:02.140 align:middle line:84% k is actually equal to its remainder. 01:14:02.140 --> 01:14:05.060 align:middle line:84% So this just is the answer right here. 01:14:05.060 --> 01:14:08.400 align:middle line:84% So we can actually compute k using this assumption 01:14:08.400 --> 01:14:14.920 align:middle line:90% that k is between 0 and a. 01:14:14.920 --> 01:14:19.040 align:middle line:84% So in the last 4 minutes, I'm going to tell you 01:14:19.040 --> 01:14:22.560 align:middle line:90% a really cool application. 01:14:22.560 --> 01:14:24.600 align:middle line:84% This is somehow like a baby version 01:14:24.600 --> 01:14:27.180 align:middle line:84% I made up of a more real application. 01:14:27.180 --> 01:14:31.280 align:middle line:90% 01:14:31.280 --> 01:14:32.660 align:middle line:90% But let me tell you about it. 01:14:32.660 --> 01:14:47.080 align:middle line:90% 01:14:47.080 --> 01:14:49.240 align:middle line:84% So last time for my demo, I asked you 01:14:49.240 --> 01:14:51.340 align:middle line:84% guys, what are embarrassing movies you like. 01:14:51.340 --> 01:14:56.150 align:middle line:84% And I got much less exciting answers than I usually get, 01:14:56.150 --> 01:14:57.930 align:middle line:90% so you guys gotta work on that. 01:14:57.930 --> 01:15:01.400 align:middle line:84% But how many people here stream stuff online? 01:15:01.400 --> 01:15:04.352 align:middle line:90% 01:15:04.352 --> 01:15:06.310 align:middle line:84% There are people who didn't put their hands up? 01:15:06.310 --> 01:15:11.050 align:middle line:84% [CHUCKLES] How many people stream stuff online? 01:15:11.050 --> 01:15:15.050 align:middle line:84% How many people stream stuff illegally online? 01:15:15.050 --> 01:15:16.470 align:middle line:90% Oh, I saw you. 01:15:16.470 --> 01:15:18.610 align:middle line:90% OK. 01:15:18.610 --> 01:15:21.250 align:middle line:84% So let me tell you about a cool application, which 01:15:21.250 --> 01:15:25.050 align:middle line:84% has to do with streaming, which is something related to fountain 01:15:25.050 --> 01:15:25.550 align:middle line:90% codes. 01:15:25.550 --> 01:15:28.050 align:middle line:84% Really, fountain codes are a whole topic in their own right, 01:15:28.050 --> 01:15:30.770 align:middle line:84% and this is a hugely simplified version, 01:15:30.770 --> 01:15:35.730 align:middle line:84% but imagine I've got some giant file n. 01:15:35.730 --> 01:15:37.770 align:middle line:90% And I have not just-- 01:15:37.770 --> 01:15:40.690 align:middle line:84% I'm representing the contents of the file 01:15:40.690 --> 01:15:42.590 align:middle line:90% as some gigantic integer. 01:15:42.590 --> 01:15:45.650 align:middle line:84% So this is a truly huge integer, not 01:15:45.650 --> 01:15:48.570 align:middle line:84% one I'd want to compute its factorization for by hand 01:15:48.570 --> 01:15:49.850 align:middle line:90% or anything. 01:15:49.850 --> 01:15:52.190 align:middle line:84% But now, I have not just one person 01:15:52.190 --> 01:15:54.730 align:middle line:90% but many people streaming. 01:15:54.730 --> 01:15:57.770 align:middle line:84% Maybe it just came out, like a new season of Stranger Things 01:15:57.770 --> 01:16:02.130 align:middle line:84% or something, and everyone's trying to stream the same thing. 01:16:02.130 --> 01:16:06.490 align:middle line:84% And one of the ways that you can reconstruct the file 01:16:06.490 --> 01:16:08.410 align:middle line:84% is, imagine I'm just going to sit 01:16:08.410 --> 01:16:12.410 align:middle line:84% out there broadcasting a bunch of snippets of the message. 01:16:12.410 --> 01:16:15.090 align:middle line:84% So what my snippets are going to look like is it's 01:16:15.090 --> 01:16:20.490 align:middle line:84% going to look like some modulus a1. 01:16:20.490 --> 01:16:27.290 align:middle line:84% And then I'll take the remainder of n divided by a1. 01:16:27.290 --> 01:16:30.470 align:middle line:84% And I'll do this for a whole different choice of these ai's. 01:16:30.470 --> 01:16:33.230 align:middle line:84% So I'll choose a whole bunch of primes ai. 01:16:33.230 --> 01:16:35.450 align:middle line:90% I'll tell you what the prime is. 01:16:35.450 --> 01:16:37.690 align:middle line:84% And then I'll tell you the modulus, 01:16:37.690 --> 01:16:45.630 align:middle line:84% what the file contents look like as a huge integer modulo a1. 01:16:45.630 --> 01:16:48.580 align:middle line:84% So how can you reconstruct the file? 01:16:48.580 --> 01:16:57.580 align:middle line:90% 01:16:57.580 --> 01:16:59.460 align:middle line:90% So once you have-- 01:16:59.460 --> 01:17:04.228 align:middle line:84% you've received some set of the messages. 01:17:04.228 --> 01:17:05.520 align:middle line:90% These are what you've received. 01:17:05.520 --> 01:17:08.220 align:middle line:90% 01:17:08.220 --> 01:17:12.740 align:middle line:84% As long as the product of the ai's is larger than n-- 01:17:12.740 --> 01:17:15.420 align:middle line:84% that's really the generalization of the Chinese remainder 01:17:15.420 --> 01:17:18.340 align:middle line:84% theorem, where I just had two factors, a and b-- 01:17:18.340 --> 01:17:20.580 align:middle line:84% but as soon as I have the product of these ai's 01:17:20.580 --> 01:17:25.060 align:middle line:84% as larger than n, then the same type of thing works. 01:17:25.060 --> 01:17:27.020 align:middle line:84% And I can use the Chinese remainder theorem 01:17:27.020 --> 01:17:29.740 align:middle line:90% to reconstruct what n is. 01:17:29.740 --> 01:17:31.400 align:middle line:84% But now the really cool thing about it, 01:17:31.400 --> 01:17:34.140 align:middle line:84% which explains fountain codes, is you have all these people 01:17:34.140 --> 01:17:35.460 align:middle line:90% streaming. 01:17:35.460 --> 01:17:39.260 align:middle line:84% And maybe it's a 1-gig file, but they're all not streaming 01:17:39.260 --> 01:17:40.900 align:middle line:90% at the same time. 01:17:40.900 --> 01:17:43.940 align:middle line:84% So what you can do is you can just broadcast these messages 01:17:43.940 --> 01:17:44.680 align:middle line:90% perpetually. 01:17:44.680 --> 01:17:49.340 align:middle line:84% It's like a water fountain that's always spraying water. 01:17:49.340 --> 01:17:50.600 align:middle line:90% And everyone comes there. 01:17:50.600 --> 01:17:53.560 align:middle line:84% And as soon as they fill up their 1 gig of data, 01:17:53.560 --> 01:17:55.380 align:middle line:90% they can reconstruct the file. 01:17:55.380 --> 01:17:59.020 align:middle line:84% It doesn't actually matter which 1 gig of data they get. 01:17:59.020 --> 01:18:01.180 align:middle line:84% So these kinds of things are very effective ways 01:18:01.180 --> 01:18:04.180 align:middle line:84% of sending one thing to many parties. 01:18:04.180 --> 01:18:07.140 align:middle line:84% When those same parties are listening in and getting 01:18:07.140 --> 01:18:10.140 align:middle line:84% different snippets of the code, they'll 01:18:10.140 --> 01:18:12.140 align:middle line:84% still be able to recover it because they've all 01:18:12.140 --> 01:18:15.660 align:middle line:84% filled up their Nalgene bottle with the 1 gig. 01:18:15.660 --> 01:18:17.422 align:middle line:84% So this is a very simplified version 01:18:17.422 --> 01:18:19.380 align:middle line:84% of what fountain codes are because, really, you 01:18:19.380 --> 01:18:22.900 align:middle line:84% care about things like errors in the messages. 01:18:22.900 --> 01:18:24.540 align:middle line:84% But you can already see why things 01:18:24.540 --> 01:18:26.940 align:middle line:84% like the Chinese remainder theorem and modular arithmetic 01:18:26.940 --> 01:18:29.460 align:middle line:90% are extremely powerful. 01:18:29.460 --> 01:18:31.220 align:middle line:84% So next time, on Thursday, we're going 01:18:31.220 --> 01:18:33.780 align:middle line:90% to be starting group theory. 01:18:33.780 --> 01:18:37.320 align:middle line:84% And we'll talk a little bit more about modular arithmetic, 01:18:37.320 --> 01:18:39.340 align:middle line:84% especially the parts we need for crypto. 01:18:39.340 --> 01:18:41.660 align:middle line:90% But see you all then. 01:18:41.660 --> 01:18:43.370 align:middle line:90% All right. 01:18:43.370 --> 01:18:50.000 align:middle line:90%