WEBVTT 00:00:00.000 --> 00:00:11.460 align:middle line:84% [SQUEAKING] [RUSTLING] [CLICKING] 00:00:11.460 --> 00:00:13.480 align:middle line:84% ANKUR MOITRA: All right, let's get started. 00:00:13.480 --> 00:00:15.640 align:middle line:84% So today, we're going to continue 00:00:15.640 --> 00:00:18.400 align:middle line:90% our discussion of algebra. 00:00:18.400 --> 00:00:21.000 align:middle line:84% So last time, we talked about modular arithmetic. 00:00:21.000 --> 00:00:23.380 align:middle line:84% And I introduced you to the basic notions. 00:00:23.380 --> 00:00:26.060 align:middle line:84% We talked about the Euclidean algorithm, 00:00:26.060 --> 00:00:28.380 align:middle line:84% the extended Euclidean algorithm, 00:00:28.380 --> 00:00:31.040 align:middle line:90% and multiplicative inverses. 00:00:31.040 --> 00:00:34.040 align:middle line:84% And it turns out that there are some really powerful 00:00:34.040 --> 00:00:36.400 align:middle line:84% abstractions that can give us a useful way 00:00:36.400 --> 00:00:38.840 align:middle line:84% to think about modular arithmetic. 00:00:38.840 --> 00:00:42.360 align:middle line:84% And these come from really the starting point of group theory. 00:00:42.360 --> 00:00:45.680 align:middle line:84% So group theory is something that you can take a whole class 00:00:45.680 --> 00:00:47.680 align:middle line:90% in, multiple classes in. 00:00:47.680 --> 00:00:48.980 align:middle line:90% And it goes quite deep. 00:00:48.980 --> 00:00:52.080 align:middle line:84% But we're going to introduce you to the basics of group theory 00:00:52.080 --> 00:00:54.920 align:middle line:84% and why this abstraction is powerful. 00:00:54.920 --> 00:00:58.720 align:middle line:84% So let me start off from where we left off last time. 00:00:58.720 --> 00:01:02.120 align:middle line:84% So we had this notion of multiplication 00:01:02.120 --> 00:01:03.760 align:middle line:90% in modular arithmetic. 00:01:03.760 --> 00:01:05.800 align:middle line:84% And one of the questions which was on our mind 00:01:05.800 --> 00:01:10.360 align:middle line:84% was whether an element has a multiplicative inverse. 00:01:10.360 --> 00:01:14.160 align:middle line:84% So given an element a, is there some other number element 00:01:14.160 --> 00:01:19.360 align:middle line:84% we can multiply it by so that mod n we get back 1? 00:01:19.360 --> 00:01:22.600 align:middle line:84% And we showed that this was always true whenever n is prime 00:01:22.600 --> 00:01:24.520 align:middle line:90% and a is nonzero. 00:01:24.520 --> 00:01:27.680 align:middle line:84% And in fact, what we really showed 00:01:27.680 --> 00:01:31.360 align:middle line:84% was that even if n is not prime, the critical thing 00:01:31.360 --> 00:01:34.800 align:middle line:84% is whether or not the GCD, the greatest common divisor, 00:01:34.800 --> 00:01:37.520 align:middle line:90% between a and n is 1. 00:01:37.520 --> 00:01:40.480 align:middle line:84% So we showed in particular that there was this equivalent way 00:01:40.480 --> 00:01:44.840 align:middle line:84% to think about the GCD as the smallest integer you can get, 00:01:44.840 --> 00:01:50.480 align:middle line:84% non-zero integer, where you take s times a plus t times n. 00:01:50.480 --> 00:01:53.440 align:middle line:84% And you want to get that to be equal to 1. 00:01:53.440 --> 00:01:56.000 align:middle line:84% So if the GCD is 1, then that gives you 00:01:56.000 --> 00:01:57.800 align:middle line:90% the multiplicative inverse. 00:01:57.800 --> 00:02:00.400 align:middle line:84% And if you can't get 1, you can show directly 00:02:00.400 --> 00:02:03.560 align:middle line:84% that it has no multiplicative inverse. 00:02:03.560 --> 00:02:06.280 align:middle line:84% So this is where we left off last time. 00:02:06.280 --> 00:02:09.460 align:middle line:84% But now, I'm going to tell you one very powerful definition. 00:02:09.460 --> 00:02:13.800 align:middle line:84% And it'll take us all of today's lecture to really understand 00:02:13.800 --> 00:02:17.600 align:middle line:84% why this is such a powerful notion, which takes us 00:02:17.600 --> 00:02:20.560 align:middle line:90% to what's called a group. 00:02:20.560 --> 00:02:23.740 align:middle line:90% So a group is just a pair, g. 00:02:23.740 --> 00:02:27.520 align:middle line:84% It's a set of elements, potentially infinite, 00:02:27.520 --> 00:02:31.720 align:middle line:84% along with a binary operation star. 00:02:31.720 --> 00:02:34.840 align:middle line:84% So this is some set, potentially infinite. 00:02:34.840 --> 00:02:38.960 align:middle line:84% And this is just the binary operation. 00:02:38.960 --> 00:02:40.920 align:middle line:84% And the critical thing about a group 00:02:40.920 --> 00:02:44.840 align:middle line:84% is that it has to satisfy a whole bunch of properties. 00:02:44.840 --> 00:02:47.840 align:middle line:84% So the first thing we need is closure, 00:02:47.840 --> 00:02:52.040 align:middle line:84% that we can apply this binary operation to pairs of elements 00:02:52.040 --> 00:02:55.080 align:middle line:84% and get back another element in the group. 00:02:55.080 --> 00:02:56.640 align:middle line:84% So this is really just the statement 00:02:56.640 --> 00:03:00.830 align:middle line:84% that, for any pair of elements a, b that belong to the group, 00:03:00.830 --> 00:03:05.950 align:middle line:84% the operation of a star b is well-defined because it sends us 00:03:05.950 --> 00:03:09.630 align:middle line:90% back to some group element. 00:03:09.630 --> 00:03:12.170 align:middle line:84% So last time when I wrote down, for example, 00:03:12.170 --> 00:03:15.470 align:middle line:84% this table we got with modular addition, 00:03:15.470 --> 00:03:17.977 align:middle line:84% I was really just showing you, for every row that's 00:03:17.977 --> 00:03:20.310 align:middle line:84% a choice of a different element, for every column that's 00:03:20.310 --> 00:03:22.190 align:middle line:90% a choice of a different element. 00:03:22.190 --> 00:03:25.510 align:middle line:84% And I told you in the table what particular group 00:03:25.510 --> 00:03:29.250 align:middle line:84% element that pair adds to or multiplies to. 00:03:29.250 --> 00:03:31.750 align:middle line:84% That was just the closure property. 00:03:31.750 --> 00:03:37.550 align:middle line:84% We also need associativity, which 00:03:37.550 --> 00:03:39.830 align:middle line:90% is also familiar from before. 00:03:39.830 --> 00:03:44.630 align:middle line:84% So for all triples a, b, c that belong to your group, 00:03:44.630 --> 00:03:49.630 align:middle line:84% doing the operation of a star b, and then taking the result 00:03:49.630 --> 00:03:52.790 align:middle line:84% and doing that with star c is the same thing 00:03:52.790 --> 00:03:56.610 align:middle line:84% as parenthesizing the expression a different way. 00:03:56.610 --> 00:03:59.410 align:middle line:90% 00:03:59.410 --> 00:04:07.070 align:middle line:84% We also need the existence of an identity element, which 00:04:07.070 --> 00:04:10.630 align:middle line:84% means that there is some element, which we'll call e, 00:04:10.630 --> 00:04:13.750 align:middle line:84% that belongs to the group with the property 00:04:13.750 --> 00:04:19.910 align:middle line:84% that, for all elements of the group, doing a star e 00:04:19.910 --> 00:04:23.030 align:middle line:84% gets back the same element I started from. 00:04:23.030 --> 00:04:25.910 align:middle line:84% And that doesn't matter whether you apply e on the right 00:04:25.910 --> 00:04:27.190 align:middle line:90% or on the left. 00:04:27.190 --> 00:04:30.010 align:middle line:84% Either way, you get back your original element. 00:04:30.010 --> 00:04:31.870 align:middle line:90% And you do nothing to it. 00:04:31.870 --> 00:04:34.870 align:middle line:84% So for example, in the case of the group being-- 00:04:34.870 --> 00:04:39.510 align:middle line:84% when we were working with this set of moduli, 00:04:39.510 --> 00:04:43.030 align:middle line:84% when we had addition, the identity element is 0. 00:04:43.030 --> 00:04:46.790 align:middle line:84% And when we had multiplication, the identity element was 1. 00:04:46.790 --> 00:04:51.670 align:middle line:84% And finally, the last property we need from our group 00:04:51.670 --> 00:04:55.510 align:middle line:90% is the existence of an inverse. 00:04:55.510 --> 00:04:58.210 align:middle line:90% So what this means is natural. 00:04:58.210 --> 00:05:01.790 align:middle line:84% We want that, for all a belonging to our group, 00:05:01.790 --> 00:05:05.150 align:middle line:84% there is some element, which we'll call a inverse, 00:05:05.150 --> 00:05:09.790 align:middle line:84% with the property that a inverse applied 00:05:09.790 --> 00:05:14.510 align:middle line:84% on the left versus a inverse applied on the right, 00:05:14.510 --> 00:05:18.390 align:middle line:84% both of them send you back to the identity element. 00:05:18.390 --> 00:05:20.050 align:middle line:84% So this is the notion of a group. 00:05:20.050 --> 00:05:23.590 align:middle line:84% This is just formalizing algebraic structures 00:05:23.590 --> 00:05:25.250 align:middle line:84% that we've already seen in action. 00:05:25.250 --> 00:05:26.870 align:middle line:90% We've already seen groups. 00:05:26.870 --> 00:05:30.590 align:middle line:84% But we didn't think about them as abstract sets, 00:05:30.590 --> 00:05:33.630 align:middle line:90% abstract properties. 00:05:33.630 --> 00:05:40.910 align:middle line:84% And I'll also mention that, additionally, 00:05:40.910 --> 00:05:42.890 align:middle line:90% if we have commutativity-- 00:05:42.890 --> 00:05:46.470 align:middle line:90% 00:05:46.470 --> 00:05:53.710 align:middle line:84% so if commutativity holds that a star b is equal to b star a, 00:05:53.710 --> 00:06:00.510 align:middle line:84% then what we say is that we call g abelian. 00:06:00.510 --> 00:06:02.750 align:middle line:90% So it's an abelian group. 00:06:02.750 --> 00:06:04.850 align:middle line:84% So these are the key definitions for today. 00:06:04.850 --> 00:06:06.308 align:middle line:84% And what we're going to do is we're 00:06:06.308 --> 00:06:08.590 align:middle line:84% going to understand why this is powerful. 00:06:08.590 --> 00:06:13.350 align:middle line:84% So are there any questions about the definition of a group? 00:06:13.350 --> 00:06:16.390 align:middle line:90% This makes sense, hopefully. 00:06:16.390 --> 00:06:19.050 align:middle line:84% So next, let's go through some examples. 00:06:19.050 --> 00:06:22.390 align:middle line:84% We've already seen groups in action. 00:06:22.390 --> 00:06:26.230 align:middle line:84% And let's see some examples just to get a feel 00:06:26.230 --> 00:06:28.950 align:middle line:90% for what these definitions are. 00:06:28.950 --> 00:06:32.230 align:middle line:84% So one simple example is an infinite group 00:06:32.230 --> 00:06:34.950 align:middle line:84% you've been working with all the time. 00:06:34.950 --> 00:06:41.440 align:middle line:84% You can look at the set of integers under addition. 00:06:41.440 --> 00:06:47.830 align:middle line:90% 00:06:47.830 --> 00:06:52.340 align:middle line:84% So we can check, in that case, our set g is just 00:06:52.340 --> 00:06:53.200 align:middle line:90% an infinite set. 00:06:53.200 --> 00:06:56.180 align:middle line:84% It's the set of all integers, positive and negative. 00:06:56.180 --> 00:06:58.820 align:middle line:84% Our binary operation is addition. 00:06:58.820 --> 00:07:01.200 align:middle line:84% And you can check that all of these properties hold. 00:07:01.200 --> 00:07:03.080 align:middle line:84% I take two integers, I add them up, 00:07:03.080 --> 00:07:06.180 align:middle line:84% I definitely get back an integer. 00:07:06.180 --> 00:07:09.220 align:middle line:84% When I add up three integers, it doesn't matter the order 00:07:09.220 --> 00:07:10.780 align:middle line:90% that I add them up. 00:07:10.780 --> 00:07:13.660 align:middle line:84% I have an identity element that's 0. 00:07:13.660 --> 00:07:15.280 align:middle line:90% I have an inverse. 00:07:15.280 --> 00:07:18.700 align:middle line:84% That's just the negative of the number I started off with. 00:07:18.700 --> 00:07:20.880 align:middle line:84% And in fact, it's also commutative. 00:07:20.880 --> 00:07:23.100 align:middle line:90% So it's an abelian group. 00:07:23.100 --> 00:07:25.900 align:middle line:84% So this is a very simple example of a group 00:07:25.900 --> 00:07:29.380 align:middle line:84% is just the set of integers under addition. 00:07:29.380 --> 00:07:32.500 align:middle line:84% Just as a pop quiz, what about the set of integers 00:07:32.500 --> 00:07:34.460 align:middle line:90% under multiplication? 00:07:34.460 --> 00:07:39.020 align:middle line:84% So what if I take the same set, but my binary operation is now 00:07:39.020 --> 00:07:40.620 align:middle line:90% multiplication? 00:07:40.620 --> 00:07:43.060 align:middle line:90% Is that a group? 00:07:43.060 --> 00:07:45.140 align:middle line:90% Why not? 00:07:45.140 --> 00:07:47.420 align:middle line:84% STUDENT: Because 0 doesn't have an inverse. 00:07:47.420 --> 00:07:49.620 align:middle line:84% ANKUR MOITRA: 0 doesn't have an inverse. 00:07:49.620 --> 00:07:52.440 align:middle line:84% And that's true of all kinds of other elements, too. 00:07:52.440 --> 00:07:55.060 align:middle line:84% When I take the element 2, well, I 00:07:55.060 --> 00:07:57.220 align:middle line:84% can talk about multiplying by that element. 00:07:57.220 --> 00:08:00.820 align:middle line:84% That will still send me back to another integer. 00:08:00.820 --> 00:08:04.740 align:middle line:84% But I don't have the existence of an inverse because that would 00:08:04.740 --> 00:08:05.520 align:middle line:90% be 1/2. 00:08:05.520 --> 00:08:07.500 align:middle line:90% And that's not in my set. 00:08:07.500 --> 00:08:11.980 align:middle line:84% So a non-example of a group is integers under multiplication. 00:08:11.980 --> 00:08:13.900 align:middle line:84% So it's not just about the set, but it's 00:08:13.900 --> 00:08:17.500 align:middle line:84% about how the set behaves under the binary operation I've 00:08:17.500 --> 00:08:19.340 align:middle line:90% chosen. 00:08:19.340 --> 00:08:23.540 align:middle line:84% We can do another example with multiplication. 00:08:23.540 --> 00:08:29.210 align:middle line:84% We can take the set of rationals minus 0. 00:08:29.210 --> 00:08:37.740 align:middle line:90% 00:08:37.740 --> 00:08:42.559 align:middle line:84% And we can take our operation to be multiplication. 00:08:42.559 --> 00:08:47.740 align:middle line:90% 00:08:47.740 --> 00:08:50.220 align:middle line:84% So now, we do have an inverse because we just flip 00:08:50.220 --> 00:08:51.620 align:middle line:90% the numerator and denominator. 00:08:51.620 --> 00:08:53.660 align:middle line:84% And we, once again, have a group. 00:08:53.660 --> 00:08:57.320 align:middle line:84% So these are all examples of infinite groups. 00:08:57.320 --> 00:09:00.180 align:middle line:84% And what we'll be particularly interested in today 00:09:00.180 --> 00:09:01.400 align:middle line:90% are finite groups. 00:09:01.400 --> 00:09:06.020 align:middle line:84% That's the part that's going to connect with modular arithmetic. 00:09:06.020 --> 00:09:10.300 align:middle line:90% So what about finite groups? 00:09:10.300 --> 00:09:13.500 align:middle line:84% In fact, I claim we've already seen some examples 00:09:13.500 --> 00:09:17.140 align:middle line:90% of finite groups in action. 00:09:17.140 --> 00:09:21.260 align:middle line:90% So we can take another example. 00:09:21.260 --> 00:09:24.440 align:middle line:84% This will be a very important example for us, 00:09:24.440 --> 00:09:28.856 align:middle line:84% which is we can take zn, which is just addition. 00:09:28.856 --> 00:09:32.100 align:middle line:90% 00:09:32.100 --> 00:09:33.780 align:middle line:84% We can take it with the binary operation 00:09:33.780 --> 00:09:36.850 align:middle line:90% of addition, modular addition. 00:09:36.850 --> 00:09:40.140 align:middle line:90% 00:09:40.140 --> 00:09:44.720 align:middle line:84% So for example, when n equals 2, this is just two elements. 00:09:44.720 --> 00:09:47.300 align:middle line:90% We're looking at evens and odds. 00:09:47.300 --> 00:09:52.020 align:middle line:84% And for that finite group, just the set of evens and odds, 00:09:52.020 --> 00:09:56.860 align:middle line:84% you can check that when you add up two elements it makes sense. 00:09:56.860 --> 00:09:59.380 align:middle line:84% An even plus and even takes you back to even. 00:09:59.380 --> 00:10:01.660 align:middle line:84% And odd plus an odd takes you to even. 00:10:01.660 --> 00:10:04.740 align:middle line:84% And an even plus an odd takes you to odd. 00:10:04.740 --> 00:10:08.900 align:middle line:84% So in fact, we've already seen examples of finite groups 00:10:08.900 --> 00:10:09.520 align:middle line:90% in action. 00:10:09.520 --> 00:10:12.580 align:middle line:90% That's what we did last time. 00:10:12.580 --> 00:10:15.620 align:middle line:84% But let me give you a more interesting example, which 00:10:15.620 --> 00:10:16.840 align:middle line:90% is going to show up. 00:10:16.840 --> 00:10:22.580 align:middle line:90% 00:10:22.580 --> 00:10:25.720 align:middle line:84% So actually, let's do a simple corollary first. 00:10:25.720 --> 00:10:28.500 align:middle line:84% And then we'll get to that example. 00:10:28.500 --> 00:10:32.460 align:middle line:84% This will be a corollary of that key lemma I wrote up there. 00:10:32.460 --> 00:10:37.140 align:middle line:84% So let's look at the set zn minus 0. 00:10:37.140 --> 00:10:41.180 align:middle line:84% So I'm just looking at the remainders when I take mod n. 00:10:41.180 --> 00:10:44.820 align:middle line:90% But I'm removing the 0 element. 00:10:44.820 --> 00:10:54.690 align:middle line:84% And if I look at this finite set with multiplication, 00:10:54.690 --> 00:11:05.170 align:middle line:84% I claim that this is a group if and only if n is prime. 00:11:05.170 --> 00:11:07.070 align:middle line:84% And I'm writing this as a corollary 00:11:07.070 --> 00:11:10.290 align:middle line:84% because, really, it's a corollary of this key lemma 00:11:10.290 --> 00:11:12.890 align:middle line:90% that we showed last time. 00:11:12.890 --> 00:11:16.370 align:middle line:84% So let's prove this lemma just to get some familiarity 00:11:16.370 --> 00:11:19.050 align:middle line:90% with groups. 00:11:19.050 --> 00:11:21.930 align:middle line:84% So this is an if and only if statement. 00:11:21.930 --> 00:11:25.050 align:middle line:84% Let's prove the reverse direction first. 00:11:25.050 --> 00:11:28.290 align:middle line:84% So let's suppose that n is prime. 00:11:28.290 --> 00:11:33.010 align:middle line:84% Then why exactly is this a group? 00:11:33.010 --> 00:11:35.490 align:middle line:84% Now, some properties, a bunch of properties of the group 00:11:35.490 --> 00:11:37.150 align:middle line:90% are tedious to check. 00:11:37.150 --> 00:11:39.010 align:middle line:90% And they're very natural. 00:11:39.010 --> 00:11:43.890 align:middle line:84% So if I take multiplication mod n, it's definitely closed. 00:11:43.890 --> 00:11:47.150 align:middle line:84% That's what it means to do modular multiplication. 00:11:47.150 --> 00:11:48.890 align:middle line:90% We talked about that last time. 00:11:48.890 --> 00:11:50.490 align:middle line:84% You just multiply the two numbers 00:11:50.490 --> 00:11:54.250 align:middle line:84% and subtract off as many multiples of n as you can. 00:11:54.250 --> 00:11:56.530 align:middle line:84% And you'll get back to some remainder. 00:11:56.530 --> 00:11:57.930 align:middle line:90% No big deal. 00:11:57.930 --> 00:12:01.170 align:middle line:84% It's associative because, really, multiplication 00:12:01.170 --> 00:12:01.930 align:middle line:90% is associative. 00:12:01.930 --> 00:12:06.170 align:middle line:84% And we're just subtracting off multiples of n. 00:12:06.170 --> 00:12:08.910 align:middle line:84% The main question and the identity element is easy. 00:12:08.910 --> 00:12:10.410 align:middle line:90% That's also one. 00:12:10.410 --> 00:12:12.870 align:middle line:84% I take any remainder, multiply it by 1, 00:12:12.870 --> 00:12:15.330 align:middle line:90% I still get the same remainder. 00:12:15.330 --> 00:12:18.250 align:middle line:84% The tricky thing is really the inverse. 00:12:18.250 --> 00:12:21.850 align:middle line:84% That's where this corollary becomes interesting. 00:12:21.850 --> 00:12:25.850 align:middle line:84% So the key thing to check is that there is an inverse. 00:12:25.850 --> 00:12:30.930 align:middle line:84% And really, from our lemma, so if n is prime, 00:12:30.930 --> 00:12:35.610 align:middle line:84% we know, by the key lemma from last time, 00:12:35.610 --> 00:12:44.400 align:middle line:84% that every element has a multiplicative inverse. 00:12:44.400 --> 00:12:47.490 align:middle line:90% 00:12:47.490 --> 00:12:52.570 align:middle line:84% So that proves one direction of our corollary. 00:12:52.570 --> 00:12:55.110 align:middle line:90% The converse is equally simple. 00:12:55.110 --> 00:12:59.930 align:middle line:90% So let's prove that if n is-- 00:12:59.930 --> 00:13:02.290 align:middle line:84% we'll actually prove it in the contrapositive. 00:13:02.290 --> 00:13:08.510 align:middle line:84% So let's suppose that n is composite. 00:13:08.510 --> 00:13:11.130 align:middle line:90% 00:13:11.130 --> 00:13:13.490 align:middle line:84% So what I just proved was that if n is prime, 00:13:13.490 --> 00:13:15.130 align:middle line:90% then it's a group. 00:13:15.130 --> 00:13:17.790 align:middle line:84% But let's prove that if n is not prime, 00:13:17.790 --> 00:13:20.610 align:middle line:84% if it's a composite, that we don't have a group. 00:13:20.610 --> 00:13:25.755 align:middle line:84% And how am I going to prove that this is not a group? 00:13:25.755 --> 00:13:27.130 align:middle line:84% What I'm going to do is I'm going 00:13:27.130 --> 00:13:30.010 align:middle line:84% to construct an element that doesn't have 00:13:30.010 --> 00:13:32.330 align:middle line:84% a multiplicative inverse because that's 00:13:32.330 --> 00:13:34.010 align:middle line:84% where all this action is happening 00:13:34.010 --> 00:13:36.290 align:middle line:90% in the proof of this corollary. 00:13:36.290 --> 00:13:39.210 align:middle line:84% So any guesses for what kind of element 00:13:39.210 --> 00:13:41.140 align:middle line:84% might not have a multiplicative inverse? 00:13:41.140 --> 00:13:47.290 align:middle line:90% 00:13:47.290 --> 00:13:48.810 align:middle line:90% Any good ideas? 00:13:48.810 --> 00:13:50.450 align:middle line:84% We already know this lemma tells us 00:13:50.450 --> 00:13:53.890 align:middle line:84% a bunch of things do have multiplicative inverses. 00:13:53.890 --> 00:13:56.050 align:middle line:84% So where should I look for something that doesn't 00:13:56.050 --> 00:13:58.530 align:middle line:90% have a multiplicative inverse? 00:13:58.530 --> 00:14:02.890 align:middle line:84% I should look for an element a where the GCD between a and n 00:14:02.890 --> 00:14:05.760 align:middle line:90% is not 1. 00:14:05.760 --> 00:14:14.530 align:middle line:84% So let's just take any old element a with the property 00:14:14.530 --> 00:14:19.890 align:middle line:84% that the GCD between a and n is not equal to 1. 00:14:19.890 --> 00:14:24.170 align:middle line:84% And so the Lemma tells us already-- 00:14:24.170 --> 00:14:27.490 align:middle line:84% the work is already done for us-- that that element does not 00:14:27.490 --> 00:14:29.330 align:middle line:90% have a multiplicative inverse. 00:14:29.330 --> 00:14:32.260 align:middle line:84% So it fails our property for being a group. 00:14:32.260 --> 00:14:35.530 align:middle line:90% 00:14:35.530 --> 00:14:37.290 align:middle line:84% So when we were doing modular arithmetic 00:14:37.290 --> 00:14:40.170 align:middle line:84% and we were worrying about multiplicative inverses, 00:14:40.170 --> 00:14:41.680 align:middle line:84% really, what we were doing was we 00:14:41.680 --> 00:14:46.358 align:middle line:84% were characterizing when exactly we had this group structure. 00:14:46.358 --> 00:14:48.400 align:middle line:84% So that's the first point, is that we were really 00:14:48.400 --> 00:14:51.200 align:middle line:90% doing group theory last time. 00:14:51.200 --> 00:14:53.560 align:middle line:84% And what we're going to do now is 00:14:53.560 --> 00:14:56.720 align:middle line:84% we're going to understand some of the implications of having 00:14:56.720 --> 00:14:57.900 align:middle line:90% this abstraction. 00:14:57.900 --> 00:15:03.280 align:middle line:90% 00:15:03.280 --> 00:15:05.600 align:middle line:90% All right. 00:15:05.600 --> 00:15:08.760 align:middle line:84% Actually, let me make one comment first. 00:15:08.760 --> 00:15:13.560 align:middle line:84% So just as a quick comment, this will be very useful for later. 00:15:13.560 --> 00:15:18.040 align:middle line:84% So imagine that we take n, which is composite. 00:15:18.040 --> 00:15:21.360 align:middle line:84% We now know that the non-zero elements of zn 00:15:21.360 --> 00:15:23.520 align:middle line:90% do not form a group. 00:15:23.520 --> 00:15:26.420 align:middle line:84% But it turns out that even though it's not a group, 00:15:26.420 --> 00:15:29.000 align:middle line:90% there is a group hiding inside. 00:15:29.000 --> 00:15:30.940 align:middle line:84% So this will be very useful for us. 00:15:30.940 --> 00:15:35.160 align:middle line:84% So there is a way to fix the failure of this group property. 00:15:35.160 --> 00:15:43.400 align:middle line:84% What we can do is we can let zn star just be the set of elements 00:15:43.400 --> 00:15:50.880 align:middle line:84% a belonging to zn with the property that the GCD of a and n 00:15:50.880 --> 00:15:53.520 align:middle line:90% is equal to 1. 00:15:53.520 --> 00:15:55.980 align:middle line:84% So what I claim-- and I'll just assert this. 00:15:55.980 --> 00:15:58.640 align:middle line:90% But the proof is very simple. 00:15:58.640 --> 00:16:02.080 align:middle line:84% It just, again, follows from this key lemma last time. 00:16:02.080 --> 00:16:07.560 align:middle line:84% What I claim is that zn star, equipped with the multiplication 00:16:07.560 --> 00:16:11.960 align:middle line:90% operation, is a group. 00:16:11.960 --> 00:16:14.840 align:middle line:84% So that's our key fact that we're going to be using. 00:16:14.840 --> 00:16:18.880 align:middle line:84% So even though there are elements belonging to zn that 00:16:18.880 --> 00:16:22.380 align:middle line:84% are not zero that do not have a multiplicative inverse-- 00:16:22.380 --> 00:16:24.200 align:middle line:90% so we failed to be a group-- 00:16:24.200 --> 00:16:25.960 align:middle line:84% we can just take the set of elements 00:16:25.960 --> 00:16:29.560 align:middle line:84% that do have an inverse, the set of all elements a 00:16:29.560 --> 00:16:32.280 align:middle line:90% where the GCD is 1. 00:16:32.280 --> 00:16:35.080 align:middle line:84% And what I claim is that that's a group sitting 00:16:35.080 --> 00:16:40.840 align:middle line:84% inside this other thing that failed to be a group. 00:16:40.840 --> 00:16:43.080 align:middle line:84% So the main point for today's lecture 00:16:43.080 --> 00:16:47.080 align:middle line:84% is we're going to develop some understanding of properties 00:16:47.080 --> 00:16:48.055 align:middle line:90% of groups. 00:16:48.055 --> 00:16:50.680 align:middle line:84% We're going to prove something called Lagrange's theorem, which 00:16:50.680 --> 00:16:55.000 align:middle line:84% is going to have a ton of cool, simple to understand 00:16:55.000 --> 00:16:57.800 align:middle line:90% applications. 00:16:57.800 --> 00:17:00.730 align:middle line:84% So let's go a little further with group theory. 00:17:00.730 --> 00:17:05.319 align:middle line:90% 00:17:05.319 --> 00:17:09.160 align:middle line:84% Let me give you a key definition. 00:17:09.160 --> 00:17:20.480 align:middle line:84% The order of a group of a finite group G 00:17:20.480 --> 00:17:23.210 align:middle line:90% is just the number of elements. 00:17:23.210 --> 00:17:26.119 align:middle line:90% 00:17:26.119 --> 00:17:30.040 align:middle line:84% And we denote it by size of G, this way. 00:17:30.040 --> 00:17:34.530 align:middle line:84% So we're just measuring the number of elements in G. 00:17:34.530 --> 00:17:39.120 align:middle line:84% And you shouldn't yet see why this is are a useful notion. 00:17:39.120 --> 00:17:42.240 align:middle line:84% But that's where Lagrange's theorem is going to kick in. 00:17:42.240 --> 00:17:44.840 align:middle line:84% But let's do some examples just to make sure 00:17:44.840 --> 00:17:47.280 align:middle line:90% that we're on the same page. 00:17:47.280 --> 00:17:56.520 align:middle line:84% So we can look at, zn with multiplication for prime n. 00:17:56.520 --> 00:17:59.720 align:middle line:84% So we already proved in our corollary that when n is prime, 00:17:59.720 --> 00:18:01.600 align:middle line:90% this is a group. 00:18:01.600 --> 00:18:04.040 align:middle line:84% So what's the order of this group? 00:18:04.040 --> 00:18:08.440 align:middle line:84% Well, the order of this group zn-- 00:18:08.440 --> 00:18:15.600 align:middle line:84% sorry, zn minus 0, because the element 0 doesn't work, 00:18:15.600 --> 00:18:19.280 align:middle line:84% well, this is just n minus 1 for this group, 00:18:19.280 --> 00:18:23.110 align:middle line:84% just because I've removed that element. 00:18:23.110 --> 00:18:28.520 align:middle line:90% 00:18:28.520 --> 00:18:31.700 align:middle line:84% So now, the key property we're going to-- 00:18:31.700 --> 00:18:35.280 align:middle line:84% so then let's do one more example. 00:18:35.280 --> 00:18:39.190 align:middle line:84% And this will be a crucial example that we use for later. 00:18:39.190 --> 00:18:42.350 align:middle line:84% So let's imagine that m is composite. 00:18:42.350 --> 00:18:46.910 align:middle line:84% We can look at zm star again with multiplication. 00:18:46.910 --> 00:18:52.870 align:middle line:84% And let's assume that m is equal to p times q, where 00:18:52.870 --> 00:18:58.950 align:middle line:84% both p and q are primes and they're distinct primes. 00:18:58.950 --> 00:19:01.070 align:middle line:90% So this is one simple example. 00:19:01.070 --> 00:19:02.710 align:middle line:90% m is composite. 00:19:02.710 --> 00:19:06.790 align:middle line:90% So zm minus 0 is not a group. 00:19:06.790 --> 00:19:09.590 align:middle line:84% But if we only look at the set of elements 00:19:09.590 --> 00:19:11.790 align:middle line:84% that have a multiplicative inverse, 00:19:11.790 --> 00:19:13.510 align:middle line:90% we know that it's a group. 00:19:13.510 --> 00:19:15.970 align:middle line:84% The question is, what's the order of this group? 00:19:15.970 --> 00:19:20.630 align:middle line:84% So how many elements are actually in this set zm star? 00:19:20.630 --> 00:19:23.870 align:middle line:84% So this is really just a counting argument 00:19:23.870 --> 00:19:25.830 align:middle line:84% because what we want to do is we want 00:19:25.830 --> 00:19:32.390 align:middle line:84% to count the number of a's such that the GCD between a and m is 00:19:32.390 --> 00:19:34.990 align:middle line:90% equal to 1. 00:19:34.990 --> 00:19:38.950 align:middle line:84% So now, what I can do is I can use my old friend, inclusion 00:19:38.950 --> 00:19:41.002 align:middle line:90% exclusion. 00:19:41.002 --> 00:19:43.870 align:middle line:84% So what I can do is I can overcount. 00:19:43.870 --> 00:19:48.910 align:middle line:84% So I can start off with pq minus 1 00:19:48.910 --> 00:19:51.070 align:middle line:84% because those are all of the elements that are 00:19:51.070 --> 00:19:54.470 align:middle line:90% in consideration in this set. 00:19:54.470 --> 00:19:58.470 align:middle line:84% And then what I can do is I can subtract off the things which 00:19:58.470 --> 00:20:01.070 align:middle line:90% fail to have GCD 1. 00:20:01.070 --> 00:20:07.550 align:middle line:84% So what are the ways that a could fail to have GCD with m 1? 00:20:07.550 --> 00:20:09.830 align:middle line:84% Well, it could have GCD equal to p 00:20:09.830 --> 00:20:12.750 align:middle line:90% or it could have GCD equal to q. 00:20:12.750 --> 00:20:14.710 align:middle line:84% So the question is just, how many 00:20:14.710 --> 00:20:18.350 align:middle line:84% elements, how many choices of are there 00:20:18.350 --> 00:20:21.790 align:middle line:84% where the GCD between a and m would be p? 00:20:21.790 --> 00:20:25.390 align:middle line:84% How many are there where the GCD would be q? 00:20:25.390 --> 00:20:28.470 align:middle line:84% Because that's the amount by which I've overcounted. 00:20:28.470 --> 00:20:31.510 align:middle line:84% So I should subtract off those things. 00:20:31.510 --> 00:20:34.430 align:middle line:84% And you can subtract off p minus 1. 00:20:34.430 --> 00:20:43.590 align:middle line:84% This is just the number of a's where the GCD of a and m 00:20:43.590 --> 00:20:45.270 align:middle line:90% is equal to q. 00:20:45.270 --> 00:20:49.470 align:middle line:84% In particular, a should be a multiple of q in order for this 00:20:49.470 --> 00:20:50.750 align:middle line:90% to be true. 00:20:50.750 --> 00:20:55.390 align:middle line:84% And then there are p minus 1 possibilities for what that is. 00:20:55.390 --> 00:20:58.670 align:middle line:84% And I can do the same thing the other direction. 00:20:58.670 --> 00:21:02.670 align:middle line:84% I can subtract off the things which are multiples of p. 00:21:02.670 --> 00:21:06.350 align:middle line:84% And I'm going to get q minus 1 of these elements. 00:21:06.350 --> 00:21:10.150 align:middle line:84% And there's nothing that's a multiple of both p and q 00:21:10.150 --> 00:21:15.110 align:middle line:84% because the largest my remainder gets to is pq minus 1. 00:21:15.110 --> 00:21:18.570 align:middle line:84% So this, even though it sounds like a pretty tedious example, 00:21:18.570 --> 00:21:22.230 align:middle line:84% this turns out to be an extremely important example. 00:21:22.230 --> 00:21:24.650 align:middle line:84% So just to write down what the expression is, 00:21:24.650 --> 00:21:28.110 align:middle line:90% it's p minus 1 times q minus 1. 00:21:28.110 --> 00:21:32.550 align:middle line:84% And what I promise you is that this expression is going to come 00:21:32.550 --> 00:21:35.150 align:middle line:90% up in a very magical way later. 00:21:35.150 --> 00:21:41.030 align:middle line:84% In fact, I claim that this expression is the key to RSA 00:21:41.030 --> 00:21:42.430 align:middle line:90% encryption. 00:21:42.430 --> 00:21:44.130 align:middle line:84% So we'll see a bit of a hint of that. 00:21:44.130 --> 00:21:46.590 align:middle line:84% But this expression is very important. 00:21:46.590 --> 00:21:49.350 align:middle line:84% It's just the order of this group 00:21:49.350 --> 00:21:52.590 align:middle line:84% that has fixed the fact that our original attempt was not 00:21:52.590 --> 00:21:53.910 align:middle line:90% a group. 00:21:53.910 --> 00:21:57.310 align:middle line:84% So are there any questions about where we are right now? 00:21:57.310 --> 00:21:59.630 align:middle line:84% The notion of groups makes sense and the order 00:21:59.630 --> 00:22:01.870 align:middle line:90% makes sense hopefully? 00:22:01.870 --> 00:22:04.230 align:middle line:90% Any questions? 00:22:04.230 --> 00:22:05.510 align:middle line:90% Good? 00:22:05.510 --> 00:22:06.130 align:middle line:90% All right. 00:22:06.130 --> 00:22:10.270 align:middle line:90% 00:22:10.270 --> 00:22:15.350 align:middle line:84% So I want to get up to Lagrange's theorem. 00:22:15.350 --> 00:22:18.030 align:middle line:84% But next, we have one more abstraction 00:22:18.030 --> 00:22:19.940 align:middle line:84% before I can tell you Lagrange's theorem. 00:22:19.940 --> 00:22:22.910 align:middle line:90% 00:22:22.910 --> 00:22:25.790 align:middle line:84% This is our last abstraction for today. 00:22:25.790 --> 00:22:29.590 align:middle line:84% We can also talk about the notion of a subgroup. 00:22:29.590 --> 00:22:32.760 align:middle line:84% So imagine I gave you a pair, G and star. 00:22:32.760 --> 00:22:34.340 align:middle line:90% So G is the set. 00:22:34.340 --> 00:22:36.680 align:middle line:84% And we'll be interested in finite sets for today. 00:22:36.680 --> 00:22:39.460 align:middle line:84% And then we have this binary operation, star. 00:22:39.460 --> 00:22:42.180 align:middle line:84% And let's assume that it's a group. 00:22:42.180 --> 00:22:47.140 align:middle line:84% So it satisfies all the axioms 1 through 4 of being a group. 00:22:47.140 --> 00:22:52.220 align:middle line:84% And let's imagine that you give me some subset of the group. 00:22:52.220 --> 00:22:53.820 align:middle line:84% You just keep some of the elements. 00:22:53.820 --> 00:23:03.060 align:middle line:84% And let's call that H. Well, if this pair H and star is also 00:23:03.060 --> 00:23:14.010 align:middle line:84% a group, then what we do is we say that H is a subgroup. 00:23:14.010 --> 00:23:19.380 align:middle line:90% 00:23:19.380 --> 00:23:21.780 align:middle line:90% So this is our key definition. 00:23:21.780 --> 00:23:25.740 align:middle line:84% So not only do we have a group, but sometimes inside a group 00:23:25.740 --> 00:23:29.882 align:middle line:84% we have other smaller groups sitting inside them. 00:23:29.882 --> 00:23:31.340 align:middle line:84% And what we're going to do is we're 00:23:31.340 --> 00:23:34.660 align:middle line:84% going to show that whenever we have a subgroup, 00:23:34.660 --> 00:23:36.500 align:middle line:84% we can say something very interesting 00:23:36.500 --> 00:23:40.300 align:middle line:84% about the relationship between H and G. 00:23:40.300 --> 00:23:41.640 align:middle line:90% So that's where we're headed. 00:23:41.640 --> 00:23:45.860 align:middle line:84% But let's just be explicit about this. 00:23:45.860 --> 00:23:49.180 align:middle line:84% So what does it mean for H star to be a group? 00:23:49.180 --> 00:23:54.020 align:middle line:84% So in particular, what this definition is really telling 00:23:54.020 --> 00:23:59.980 align:middle line:84% us is that we better satisfy a stronger closure property. 00:23:59.980 --> 00:24:06.860 align:middle line:84% So when we have any pair of elements a, b that belong to H, 00:24:06.860 --> 00:24:11.250 align:middle line:84% we need that a star b belongs to h as well. 00:24:11.250 --> 00:24:14.900 align:middle line:84% See, a and b are both elements of G. 00:24:14.900 --> 00:24:18.180 align:middle line:84% So we're automatically guaranteed that a star b belongs 00:24:18.180 --> 00:24:21.060 align:middle line:84% to G. But this is the stronger statement 00:24:21.060 --> 00:24:23.800 align:middle line:84% that when a and b are actually not just in G, 00:24:23.800 --> 00:24:27.380 align:middle line:84% but they're sitting inside H, then the result 00:24:27.380 --> 00:24:32.140 align:middle line:84% of multiplying them should be something that's in H, too. 00:24:32.140 --> 00:24:35.660 align:middle line:84% So the critical thing here is that this should not just 00:24:35.660 --> 00:24:40.540 align:middle line:90% be in G, but in H itself. 00:24:40.540 --> 00:24:44.260 align:middle line:84% And the same thing is true for the inverse, too. 00:24:44.260 --> 00:24:48.260 align:middle line:84% We need that, for all elements a belong to H-- 00:24:48.260 --> 00:24:51.220 align:middle line:84% well, a is in G. So there is an inverse. 00:24:51.220 --> 00:24:53.900 align:middle line:84% But the key thing is that this inverse actually 00:24:53.900 --> 00:24:58.420 align:middle line:84% belongs to H and, again, not G. So somehow, 00:24:58.420 --> 00:25:00.620 align:middle line:84% when you're doing the binary operations 00:25:00.620 --> 00:25:02.980 align:middle line:84% or when you're looking for the inverse, 00:25:02.980 --> 00:25:07.020 align:middle line:84% you never have to go outside of the set you started from, 00:25:07.020 --> 00:25:10.300 align:middle line:84% even though it lives inside a much bigger group. 00:25:10.300 --> 00:25:11.700 align:middle line:90% So that's the idea. 00:25:11.700 --> 00:25:13.680 align:middle line:90% So this is a key definition. 00:25:13.680 --> 00:25:15.380 align:middle line:90% This is very subtle. 00:25:15.380 --> 00:25:18.010 align:middle line:84% Are there any questions about the definition for a subgroup? 00:25:18.010 --> 00:25:25.740 align:middle line:90% 00:25:25.740 --> 00:25:26.520 align:middle line:90% All right. 00:25:26.520 --> 00:25:30.340 align:middle line:84% So I'm going to state Lagrange's theorem. 00:25:30.340 --> 00:25:34.340 align:middle line:84% And then we're going to go through some examples. 00:25:34.340 --> 00:25:36.240 align:middle line:84% And we'll prove Lagrange's theorem. 00:25:36.240 --> 00:25:39.000 align:middle line:84% And then I'll tell you some awesome applications of it. 00:25:39.000 --> 00:25:42.980 align:middle line:90% 00:25:42.980 --> 00:25:44.900 align:middle line:84% So what I claim relating all these 00:25:44.900 --> 00:25:47.020 align:middle line:90% concepts we've done so far-- 00:25:47.020 --> 00:26:00.860 align:middle line:84% so if G is finite, it's a finite group, and H is a subgroup, 00:26:00.860 --> 00:26:04.780 align:middle line:84% then what I claim is that the order of H 00:26:04.780 --> 00:26:09.140 align:middle line:84% divides the order of G. This is why 00:26:09.140 --> 00:26:11.780 align:middle line:90% we care about orders already. 00:26:11.780 --> 00:26:16.060 align:middle line:84% See, when you tell me the group and you tell me the order, 00:26:16.060 --> 00:26:20.220 align:middle line:84% how many elements belong to this group, 00:26:20.220 --> 00:26:24.540 align:middle line:84% well, that imposes some restrictions 00:26:24.540 --> 00:26:29.150 align:middle line:84% on what kinds of subgroups you can find. 00:26:29.150 --> 00:26:34.530 align:middle line:84% If I have my original group as order 6, this tells me, 00:26:34.530 --> 00:26:41.010 align:middle line:84% no matter where I look, I cannot find a subgroup of order 4 00:26:41.010 --> 00:26:43.730 align:middle line:90% because it wouldn't divide it. 00:26:43.730 --> 00:26:45.790 align:middle line:84% So this is a really beautiful fact. 00:26:45.790 --> 00:26:48.430 align:middle line:84% Even though it sounds like we haven't assumed very much, 00:26:48.430 --> 00:26:53.690 align:middle line:84% just G satisfies these simple axioms and H is a subgroup, 00:26:53.690 --> 00:26:55.250 align:middle line:84% automatically we can say something 00:26:55.250 --> 00:26:59.650 align:middle line:84% very striking and powerful about the relationship between H 00:26:59.650 --> 00:27:02.450 align:middle line:84% and G that tells us something very important 00:27:02.450 --> 00:27:05.330 align:middle line:90% structure on what H could be. 00:27:05.330 --> 00:27:07.070 align:middle line:90% So we're going to prove this. 00:27:07.070 --> 00:27:15.930 align:middle line:84% But first, let's give some examples 00:27:15.930 --> 00:27:18.970 align:middle line:90% just to make this explicit. 00:27:18.970 --> 00:27:19.970 align:middle line:90% All right. 00:27:19.970 --> 00:27:26.770 align:middle line:84% So let's let G denote z7 negative 0. 00:27:26.770 --> 00:27:27.950 align:middle line:90% 7 is prime. 00:27:27.950 --> 00:27:29.450 align:middle line:90% So this is a group. 00:27:29.450 --> 00:27:33.050 align:middle line:90% It has six elements. 00:27:33.050 --> 00:27:38.470 align:middle line:84% And now, what's going on is that the subgroup 00:27:38.470 --> 00:27:44.690 align:middle line:84% H we can take to be the elements 1, 2, 4. 00:27:44.690 --> 00:27:46.410 align:middle line:84% And what you can do is you can just 00:27:46.410 --> 00:27:49.530 align:middle line:84% check that when I take any of these two elements-- 00:27:49.530 --> 00:27:52.110 align:middle line:90% 1 times 2, 1 times 4-- 00:27:52.110 --> 00:27:53.790 align:middle line:90% I go back within the subgroup. 00:27:53.790 --> 00:28:01.330 align:middle line:84% And 2 times 4, I go back to the subgroup because it gives me 1. 00:28:01.330 --> 00:28:04.410 align:middle line:84% And you can check that every element 00:28:04.410 --> 00:28:07.470 align:middle line:84% has a multiplicative inverse because, in fact, 00:28:07.470 --> 00:28:09.970 align:middle line:84% the multiplicative inverse of 4 is 2. 00:28:09.970 --> 00:28:12.530 align:middle line:84% And similarly, the multiplicative inverse of 2 00:28:12.530 --> 00:28:13.930 align:middle line:90% is 4. 00:28:13.930 --> 00:28:19.410 align:middle line:84% In fact, one of the elegant ways to see that this is a subgroup 00:28:19.410 --> 00:28:21.850 align:middle line:84% is actually by realizing that there's 00:28:21.850 --> 00:28:26.530 align:middle line:84% a way to express this subgroup in a different way. 00:28:26.530 --> 00:28:29.090 align:middle line:84% So an easy and powerful way to see 00:28:29.090 --> 00:28:32.050 align:middle line:84% this that will be very useful for what we do later, 00:28:32.050 --> 00:28:34.810 align:middle line:84% in terms of applications of Lagrange, 00:28:34.810 --> 00:28:38.610 align:middle line:84% is that all of these elements of the subgroup 00:28:38.610 --> 00:28:40.870 align:middle line:90% are all powers of 2. 00:28:40.870 --> 00:28:44.530 align:middle line:90% 00:28:44.530 --> 00:28:48.430 align:middle line:90% So 2 to the 1 is 2 mod 7. 00:28:48.430 --> 00:28:51.650 align:middle line:90% 00:28:51.650 --> 00:28:56.770 align:middle line:90% 2 to the 3 is 1 mod 7. 00:28:56.770 --> 00:28:59.810 align:middle line:90% 00:28:59.810 --> 00:29:04.970 align:middle line:90% Sorry 2 to the 2 is 4 mod 7. 00:29:04.970 --> 00:29:06.810 align:middle line:90% So all of the elements we got-- 00:29:06.810 --> 00:29:08.050 align:middle line:90% 1, 2, and 4-- 00:29:08.050 --> 00:29:10.090 align:middle line:90% they were powers of 2. 00:29:10.090 --> 00:29:13.130 align:middle line:84% So why do we have the closure properties? 00:29:13.130 --> 00:29:15.570 align:middle line:84% It's just because when I take different powers of 2 00:29:15.570 --> 00:29:19.810 align:middle line:84% and multiply them, I'm just adding their exponents. 00:29:19.810 --> 00:29:21.810 align:middle line:84% So really, this is the set of remainders 00:29:21.810 --> 00:29:25.770 align:middle line:84% you get from taking powers of 2 and looking at the remainder 00:29:25.770 --> 00:29:27.810 align:middle line:90% mod 7. 00:29:27.810 --> 00:29:30.650 align:middle line:84% So this is one example of how to build a subgroup, 00:29:30.650 --> 00:29:33.250 align:middle line:84% is really with powers of some element. 00:29:33.250 --> 00:29:37.100 align:middle line:84% And this will be a crucial way that we use Lagrange's theorem. 00:29:37.100 --> 00:29:38.600 align:middle line:84% But I'll have to explain that later. 00:29:38.600 --> 00:29:41.250 align:middle line:90% 00:29:41.250 --> 00:29:43.370 align:middle line:84% And of course, you can check the obvious thing, 00:29:43.370 --> 00:29:47.570 align:middle line:84% that Lagrange's theorem checks out in this case 00:29:47.570 --> 00:29:51.910 align:middle line:84% because the size of G is 6, the size of H is 3. 00:29:51.910 --> 00:29:54.640 align:middle line:90% So 3 really does divide 6. 00:29:54.640 --> 00:29:58.010 align:middle line:90% 00:29:58.010 --> 00:29:58.890 align:middle line:90% All right. 00:29:58.890 --> 00:30:01.410 align:middle line:84% So let me pause here and ask you guys 00:30:01.410 --> 00:30:04.650 align:middle line:84% if you have any questions again because, if not, we're 00:30:04.650 --> 00:30:07.263 align:middle line:84% going to do the proof of Lagrange's theorem. 00:30:07.263 --> 00:30:08.930 align:middle line:84% And that's where we're going to assemble 00:30:08.930 --> 00:30:12.010 align:middle line:84% all of these definitions from groups and subgroups 00:30:12.010 --> 00:30:14.130 align:middle line:84% that we've been talking about so far. 00:30:14.130 --> 00:30:17.930 align:middle line:84% So ask me questions to slow me down. 00:30:17.930 --> 00:30:20.150 align:middle line:84% They should hopefully be about the course material. 00:30:20.150 --> 00:30:21.470 align:middle line:90% But if not, that's fine. 00:30:21.470 --> 00:30:29.680 align:middle line:90% 00:30:29.680 --> 00:30:31.720 align:middle line:84% I'm just going to stare awkwardly until someone 00:30:31.720 --> 00:30:32.540 align:middle line:90% asks me a question. 00:30:32.540 --> 00:30:34.800 align:middle line:90% Everyone understands everything. 00:30:34.800 --> 00:30:36.960 align:middle line:90% You promise? 00:30:36.960 --> 00:30:38.160 align:middle line:90% Yes, OK. 00:30:38.160 --> 00:30:39.560 align:middle line:90% All right. 00:30:39.560 --> 00:30:41.080 align:middle line:90% I'll take it. 00:30:41.080 --> 00:30:43.480 align:middle line:84% So let's prove Lagrange's theorem. 00:30:43.480 --> 00:30:46.320 align:middle line:84% This will be the main proof we do today. 00:30:46.320 --> 00:30:49.720 align:middle line:84% But then we'll get a whole bunch of amazing applications out 00:30:49.720 --> 00:30:52.000 align:middle line:84% of it and this fact that I promised you 00:30:52.000 --> 00:30:54.320 align:middle line:90% is going to come back later on. 00:30:54.320 --> 00:30:58.960 align:middle line:84% But we can already see some hint about why this fact is powerful. 00:30:58.960 --> 00:31:01.400 align:middle line:84% Counting the number of group elements 00:31:01.400 --> 00:31:03.840 align:middle line:84% tells us something very powerful about the types 00:31:03.840 --> 00:31:06.690 align:middle line:84% of subgroups we can expect to see inside. 00:31:06.690 --> 00:31:12.040 align:middle line:90% 00:31:12.040 --> 00:31:12.570 align:middle line:90% All right. 00:31:12.570 --> 00:31:19.640 align:middle line:90% 00:31:19.640 --> 00:31:21.212 align:middle line:90% So let's prove it here. 00:31:21.212 --> 00:31:22.670 align:middle line:84% I think I should have enough space. 00:31:22.670 --> 00:31:27.160 align:middle line:90% 00:31:27.160 --> 00:31:29.640 align:middle line:84% Now, this is really just a counting argument 00:31:29.640 --> 00:31:31.682 align:middle line:90% using the group structure. 00:31:31.682 --> 00:31:33.640 align:middle line:84% After all, we just want to prove some statement 00:31:33.640 --> 00:31:35.880 align:middle line:90% about divisibility. 00:31:35.880 --> 00:31:38.200 align:middle line:84% So really, what's going on here, the way 00:31:38.200 --> 00:31:40.960 align:middle line:84% to prove Lagrange's theorem at a high level 00:31:40.960 --> 00:31:44.720 align:middle line:84% is to break G up into different pieces. 00:31:44.720 --> 00:31:47.960 align:middle line:84% We already have a subgroup, which is one piece of G. 00:31:47.960 --> 00:31:51.680 align:middle line:84% But the question is, how can I translate that subgroup around 00:31:51.680 --> 00:31:54.960 align:middle line:84% to cover all of G in a nice, even way. 00:31:54.960 --> 00:31:58.480 align:middle line:84% So that's the intuition behind Lagrange's proof. 00:31:58.480 --> 00:32:02.800 align:middle line:84% And making this precise, we have to talk about what 00:32:02.800 --> 00:32:04.100 align:middle line:90% are these translates. 00:32:04.100 --> 00:32:06.840 align:middle line:84% And this takes us to the notion of a coset. 00:32:06.840 --> 00:32:14.840 align:middle line:84% So as I promised you, the main idea is to partition G. 00:32:14.840 --> 00:32:18.160 align:middle line:84% And we're going to build up this partition one by one. 00:32:18.160 --> 00:32:23.000 align:middle line:84% And we're going to partition it into something called cosets. 00:32:23.000 --> 00:32:28.200 align:middle line:84% These are really just translates of my original subgroup. 00:32:28.200 --> 00:32:32.160 align:middle line:84% So if you take any element belonging to the group, what 00:32:32.160 --> 00:32:36.000 align:middle line:84% we're going to do is we're going to consider the following set. 00:32:36.000 --> 00:32:38.480 align:middle line:90% It's called xH. 00:32:38.480 --> 00:32:45.870 align:middle line:84% And it's really the set of all x, y's where y belongs to H. 00:32:45.870 --> 00:32:48.700 align:middle line:84% So what's going on is, for the definition of the subgroup, 00:32:48.700 --> 00:32:52.000 align:middle line:84% we needed the property that when I take a pair of elements 00:32:52.000 --> 00:32:55.640 align:middle line:84% belonging to H. We go back within H. Here, 00:32:55.640 --> 00:32:59.800 align:middle line:84% I'm taking a pair of elements, one of which belongs to H 00:32:59.800 --> 00:33:02.200 align:middle line:90% and one of which is general. 00:33:02.200 --> 00:33:04.800 align:middle line:84% And these are my different translates. 00:33:04.800 --> 00:33:07.740 align:middle line:84% So I'm not just considering an x which belongs to H. 00:33:07.740 --> 00:33:10.680 align:middle line:84% But as I range x over the group, I'm 00:33:10.680 --> 00:33:13.960 align:middle line:84% going to get different pieces of the group. 00:33:13.960 --> 00:33:17.000 align:middle line:84% When x belongs to H, I'm just getting back H. 00:33:17.000 --> 00:33:20.140 align:middle line:84% And when x is something else that does not belong to H, 00:33:20.140 --> 00:33:23.520 align:middle line:84% it's a translate of the thing I started from. 00:33:23.520 --> 00:33:25.100 align:middle line:90% So these are called cosets. 00:33:25.100 --> 00:33:28.120 align:middle line:84% In fact, this is called a left coset 00:33:28.120 --> 00:33:32.160 align:middle line:84% because the element that I'm taking from G 00:33:32.160 --> 00:33:33.800 align:middle line:90% is multiplied on the left. 00:33:33.800 --> 00:33:35.820 align:middle line:84% And right cosets would be the same thing, 00:33:35.820 --> 00:33:38.240 align:middle line:90% but on the other side. 00:33:38.240 --> 00:33:41.480 align:middle line:90% So now, here's our plan. 00:33:41.480 --> 00:33:46.120 align:middle line:84% This is our plan of action, is what we want to do 00:33:46.120 --> 00:33:53.760 align:middle line:84% is we want to show that G can be written as x1 H union disjoint 00:33:53.760 --> 00:34:02.000 align:middle line:84% union x2 H all the way up to disjoint union xk H. 00:34:02.000 --> 00:34:05.200 align:middle line:84% So what's going on is I have k different cosets, 00:34:05.200 --> 00:34:06.860 align:middle line:90% one for each of these xi's. 00:34:06.860 --> 00:34:08.639 align:middle line:84% I haven't told you how to find them. 00:34:08.639 --> 00:34:10.600 align:middle line:84% We'll talk about that in a minute. 00:34:10.600 --> 00:34:14.679 align:middle line:84% But I want the property that I can choose x1 through xk 00:34:14.679 --> 00:34:19.949 align:middle line:84% so that their resulting cosets together make up G 00:34:19.949 --> 00:34:22.550 align:middle line:84% and there is no overlap between them. 00:34:22.550 --> 00:34:25.429 align:middle line:84% So what the symbol means is it's not the union, 00:34:25.429 --> 00:34:29.190 align:middle line:90% it's the disjoint union. 00:34:29.190 --> 00:34:34.190 align:middle line:84% So I want all of these things to have empty intersection. 00:34:34.190 --> 00:34:36.989 align:middle line:90% So that's my plan. 00:34:36.989 --> 00:34:39.350 align:middle line:84% And if this were true, Lagrange's theorem 00:34:39.350 --> 00:34:42.569 align:middle line:90% would be done because what is-- 00:34:42.569 --> 00:34:44.110 align:middle line:84% each of these elements right here, 00:34:44.110 --> 00:34:47.070 align:middle line:84% we're going to prove that each of these cosets 00:34:47.070 --> 00:34:50.030 align:middle line:84% has size order of H. And then we've 00:34:50.030 --> 00:34:55.389 align:middle line:84% written G as k copies of H. So that'll be our plan. 00:34:55.389 --> 00:34:59.870 align:middle line:84% So here are the things we need to show. 00:34:59.870 --> 00:35:04.830 align:middle line:84% And I haven't even told you how to build up this set. 00:35:04.830 --> 00:35:11.790 align:middle line:84% What I want to show is that the size of each of these cosets xH 00:35:11.790 --> 00:35:15.470 align:middle line:84% is equal to the size of H. And I want 00:35:15.470 --> 00:35:18.230 align:middle line:84% to show that the way that I've built it up, 00:35:18.230 --> 00:35:24.430 align:middle line:84% the intersection between any pair of elements 00:35:24.430 --> 00:35:27.990 align:middle line:90% of any pair of cosets is 0. 00:35:27.990 --> 00:35:32.270 align:middle line:84% And this should be true for all i not equal to j. 00:35:32.270 --> 00:35:34.990 align:middle line:84% So in fact, we're going to have a very simple plan for how 00:35:34.990 --> 00:35:37.390 align:middle line:90% to generate these xi's. 00:35:37.390 --> 00:35:41.110 align:middle line:84% All we're going to do is we're just 00:35:41.110 --> 00:35:45.980 align:middle line:90% greedily picking uncovered xi. 00:35:45.980 --> 00:35:50.990 align:middle line:90% 00:35:50.990 --> 00:35:54.670 align:middle line:84% So I start off before I've built up a single coset. 00:35:54.670 --> 00:35:55.570 align:middle line:90% I have nothing. 00:35:55.570 --> 00:35:56.990 align:middle line:84% I've covered none of the elements 00:35:56.990 --> 00:36:01.030 align:middle line:84% of G. I take any arbitrary element x 00:36:01.030 --> 00:36:04.270 align:middle line:84% belonging to G that's not covered, which is all of them. 00:36:04.270 --> 00:36:06.830 align:middle line:90% That will be my x1. 00:36:06.830 --> 00:36:08.950 align:middle line:90% That defines a coset. 00:36:08.950 --> 00:36:11.950 align:middle line:84% I pull that coset out of G. All of those elements 00:36:11.950 --> 00:36:13.270 align:middle line:90% are now covered. 00:36:13.270 --> 00:36:16.730 align:middle line:84% And then I take any other element that's not yet covered. 00:36:16.730 --> 00:36:18.190 align:middle line:90% That's my x2. 00:36:18.190 --> 00:36:19.690 align:middle line:90% It defines a coset. 00:36:19.690 --> 00:36:21.150 align:middle line:90% I pull it out. 00:36:21.150 --> 00:36:25.070 align:middle line:84% And I keep recursing in this way. 00:36:25.070 --> 00:36:26.990 align:middle line:84% But I have to prove that this really 00:36:26.990 --> 00:36:30.750 align:middle line:84% does create a disjoint union of G. Everything 00:36:30.750 --> 00:36:31.770 align:middle line:90% is covered at the end. 00:36:31.770 --> 00:36:34.190 align:middle line:84% And it's covered once and only once. 00:36:34.190 --> 00:36:36.350 align:middle line:84% And I have to prove that each time I 00:36:36.350 --> 00:36:41.430 align:middle line:84% pull out a piece, a coset, it has exactly the same size. 00:36:41.430 --> 00:36:44.010 align:middle line:84% So if we can prove these two properties, we're done. 00:36:44.010 --> 00:36:46.230 align:middle line:84% And we've proved Lagrange's theorem. 00:36:46.230 --> 00:36:47.950 align:middle line:84% But now, proving these two properties 00:36:47.950 --> 00:36:52.790 align:middle line:84% will just be about using the axioms of group theory. 00:36:52.790 --> 00:36:56.670 align:middle line:84% So this is where group theory is a powerful definition. 00:36:56.670 --> 00:36:59.710 align:middle line:84% We haven't seen it yet, but we will in a minute, is to prove 00:36:59.710 --> 00:37:02.590 align:middle line:90% these two properties. 00:37:02.590 --> 00:37:05.230 align:middle line:84% So let's show these two properties. 00:37:05.230 --> 00:37:08.520 align:middle line:90% So first, let's show 1. 00:37:08.520 --> 00:37:13.416 align:middle line:90% 00:37:13.416 --> 00:37:29.030 align:middle line:84% And let's suppose that xh1 equals xh2 for some h1 and h2 00:37:29.030 --> 00:37:32.350 align:middle line:84% belonging to my subgroup, capital H. 00:37:32.350 --> 00:37:35.470 align:middle line:84% So what is the way that I wouldn't 00:37:35.470 --> 00:37:39.030 align:middle line:90% get the coset has size order H? 00:37:39.030 --> 00:37:41.550 align:middle line:84% Really, the way that the coset is defined 00:37:41.550 --> 00:37:50.310 align:middle line:84% is once I've fixed x, I look at x star y for all y in H. 00:37:50.310 --> 00:37:52.490 align:middle line:84% And if for different choices of y, 00:37:52.490 --> 00:37:55.450 align:middle line:84% I get the same element when I do that multiplication, 00:37:55.450 --> 00:37:56.830 align:middle line:90% I get a collision. 00:37:56.830 --> 00:38:00.750 align:middle line:84% That's the only way that I don't have an equality here. 00:38:00.750 --> 00:38:03.110 align:middle line:84% If that doesn't happen, then I really 00:38:03.110 --> 00:38:06.670 align:middle line:84% do have that my coset equals the order of the subgroup. 00:38:06.670 --> 00:38:09.350 align:middle line:84% Every distinct choice of y is going 00:38:09.350 --> 00:38:13.100 align:middle line:90% to lead to a distinct product. 00:38:13.100 --> 00:38:17.820 align:middle line:84% So let's imagine that we had two elements h1 and h2 00:38:17.820 --> 00:38:24.580 align:middle line:84% that x times h1 and x times h2 were the same thing. 00:38:24.580 --> 00:38:26.680 align:middle line:90% And now, what should I do? 00:38:26.680 --> 00:38:31.780 align:middle line:84% I claim that the way that my proof strategy wants to work-- 00:38:31.780 --> 00:38:36.420 align:middle line:84% this won't be a very complicated proof, but the logic is subtle. 00:38:36.420 --> 00:38:40.100 align:middle line:84% So what I want to do is I want to show that h1 and h2 must 00:38:40.100 --> 00:38:42.300 align:middle line:90% be the same thing. 00:38:42.300 --> 00:38:45.740 align:middle line:84% I want to show that the only way that you get the same element 00:38:45.740 --> 00:38:50.020 align:middle line:84% when you get x times h1 is equal to x times h2 00:38:50.020 --> 00:38:52.860 align:middle line:90% is if h1 equals h2. 00:38:52.860 --> 00:38:56.180 align:middle line:90% So how should I do that? 00:38:56.180 --> 00:39:01.920 align:middle line:84% How should I conclude that h1 and h2 are the same thing? 00:39:01.920 --> 00:39:07.540 align:middle line:84% And you know my hint is that the critical thing in Lagrange's 00:39:07.540 --> 00:39:10.220 align:middle line:90% theorem is if G is a group. 00:39:10.220 --> 00:39:13.220 align:middle line:84% So what should I use about the group axioms 00:39:13.220 --> 00:39:15.900 align:middle line:90% in order to conclude this fact? 00:39:15.900 --> 00:39:17.500 align:middle line:90% That's my key question. 00:39:17.500 --> 00:39:19.820 align:middle line:84% You promised me you guys understood everything up 00:39:19.820 --> 00:39:21.340 align:middle line:90% until that point. 00:39:21.340 --> 00:39:23.420 align:middle line:90% So which axiom should I use? 00:39:23.420 --> 00:39:25.040 align:middle line:84% I've got you guys on the hook now. 00:39:25.040 --> 00:39:28.140 align:middle line:90% 00:39:28.140 --> 00:39:29.110 align:middle line:90% Who can make me happy? 00:39:29.110 --> 00:39:32.860 align:middle line:90% 00:39:32.860 --> 00:39:37.060 align:middle line:84% People are not making eye contact. 00:39:37.060 --> 00:39:37.580 align:middle line:90% Yeah? 00:39:37.580 --> 00:39:39.038 align:middle line:84% STUDENT: Yeah, maybe you could just 00:39:39.038 --> 00:39:40.505 align:middle line:90% use the existence of x inverse. 00:39:40.505 --> 00:39:41.880 align:middle line:84% ANKUR MOITRA: Yeah, that's right. 00:39:41.880 --> 00:39:43.260 align:middle line:90% That's a great idea. 00:39:43.260 --> 00:39:47.220 align:middle line:84% Let's use the existence of x inverse. 00:39:47.220 --> 00:39:48.805 align:middle line:90% And that'll work. 00:39:48.805 --> 00:39:50.180 align:middle line:84% So now, what we're going to do is 00:39:50.180 --> 00:39:58.100 align:middle line:84% we're going to left multiply by x inverse. 00:39:58.100 --> 00:40:00.040 align:middle line:84% See, this is where I need the group structure, 00:40:00.040 --> 00:40:03.660 align:middle line:90% is that x inverse exists. 00:40:03.660 --> 00:40:08.860 align:middle line:84% So once x inverse exists, then what this is going to imply 00:40:08.860 --> 00:40:16.520 align:middle line:90% is that x inverse x h1-- 00:40:16.520 --> 00:40:19.220 align:middle line:84% and now, I can use associativity-- 00:40:19.220 --> 00:40:24.620 align:middle line:90% is equal to x inverse x h2. 00:40:24.620 --> 00:40:28.420 align:middle line:84% And when I use associativity and the property of the inverse, 00:40:28.420 --> 00:40:31.980 align:middle line:84% that it equals the identity, and that identity times an element 00:40:31.980 --> 00:40:36.980 align:middle line:84% is the element, it's going to imply that h1 equals h2. 00:40:36.980 --> 00:40:39.320 align:middle line:84% So in fact, the critical thing was the inverse. 00:40:39.320 --> 00:40:41.300 align:middle line:84% But we really used all of the properties, 00:40:41.300 --> 00:40:44.180 align:middle line:84% like the fact that we have associativity, 00:40:44.180 --> 00:40:47.063 align:middle line:84% the fact that we get back the identity element, 00:40:47.063 --> 00:40:48.980 align:middle line:84% and the fact that the identity element doesn't 00:40:48.980 --> 00:40:51.140 align:middle line:90% change any of those things. 00:40:51.140 --> 00:40:53.780 align:middle line:84% So in this one step, we've used all the properties 00:40:53.780 --> 00:40:55.620 align:middle line:90% of groups, which is great. 00:40:55.620 --> 00:40:57.900 align:middle line:84% And it implies the thing we're after. 00:40:57.900 --> 00:41:01.420 align:middle line:84% But this finishes this first part in the proof. 00:41:01.420 --> 00:41:05.340 align:middle line:84% Every coset has the same size because when I take different 00:41:05.340 --> 00:41:09.140 align:middle line:84% elements of H, I cannot get the same thing 00:41:09.140 --> 00:41:11.420 align:middle line:90% because of the inverse. 00:41:11.420 --> 00:41:12.646 align:middle line:90% So we're halfway home. 00:41:12.646 --> 00:41:16.820 align:middle line:90% 00:41:16.820 --> 00:41:19.100 align:middle line:90% So let's show property 2. 00:41:19.100 --> 00:41:21.600 align:middle line:84% And then we'll be done with Lagrange's theorem. 00:41:21.600 --> 00:41:24.580 align:middle line:90% 00:41:24.580 --> 00:41:26.040 align:middle line:90% So now, let's show 2. 00:41:26.040 --> 00:41:31.840 align:middle line:90% 00:41:31.840 --> 00:41:34.140 align:middle line:84% So what I'm going to do is I'm going 00:41:34.140 --> 00:41:40.860 align:middle line:84% to suppose that they're not disjoint, these cosets we get. 00:41:40.860 --> 00:41:44.580 align:middle line:84% So let's suppose, for i less than j, 00:41:44.580 --> 00:41:53.580 align:middle line:84% we have the property that xi h1 equals xj h2. 00:41:53.580 --> 00:42:02.580 align:middle line:84% And this is true for some h1 and h2 belonging to H. 00:42:02.580 --> 00:42:07.090 align:middle line:84% So we just proved that we don't have any collisions 00:42:07.090 --> 00:42:08.350 align:middle line:90% within the coset. 00:42:08.350 --> 00:42:10.850 align:middle line:84% We don't get back the same element. 00:42:10.850 --> 00:42:13.270 align:middle line:84% Now, what I want to do is I want to suppose, 00:42:13.270 --> 00:42:18.650 align:middle line:84% for the sake of contradiction, that there's some coset i 00:42:18.650 --> 00:42:21.890 align:middle line:84% and there's some coset j that intersect. 00:42:21.890 --> 00:42:24.250 align:middle line:84% And that means that there's some element I got out 00:42:24.250 --> 00:42:27.530 align:middle line:90% of one, which is xi times h1. 00:42:27.530 --> 00:42:29.050 align:middle line:84% And that's the same as the element 00:42:29.050 --> 00:42:33.810 align:middle line:84% I got out of the later coset, which is xj times h2. 00:42:33.810 --> 00:42:36.290 align:middle line:84% So this is what it means for the two cosets 00:42:36.290 --> 00:42:40.650 align:middle line:84% to not be disjoint, is that they have a collision for some h1 00:42:40.650 --> 00:42:42.210 align:middle line:90% and h2. 00:42:42.210 --> 00:42:46.850 align:middle line:84% And now, we're going to try and get a contradiction. 00:42:46.850 --> 00:42:48.730 align:middle line:90% So what I want to do-- 00:42:48.730 --> 00:42:51.090 align:middle line:84% I'm going to ask you guys to help me out-- 00:42:51.090 --> 00:42:56.050 align:middle line:84% is that I want to show that xj actually 00:42:56.050 --> 00:42:59.330 align:middle line:90% belonged to an earlier coset. 00:42:59.330 --> 00:43:07.180 align:middle line:84% So I want to show that xj belongs to an coset. 00:43:07.180 --> 00:43:12.770 align:middle line:90% 00:43:12.770 --> 00:43:16.930 align:middle line:84% This would let me be done because what is the way that I 00:43:16.930 --> 00:43:18.930 align:middle line:90% built up my cosets? 00:43:18.930 --> 00:43:22.310 align:middle line:84% I started off with any x that was uncovered. 00:43:22.310 --> 00:43:24.370 align:middle line:90% And I chose it as my x1. 00:43:24.370 --> 00:43:27.010 align:middle line:84% And I pulled out the entire coset. 00:43:27.010 --> 00:43:30.390 align:middle line:84% And then I took any x2 that was still not covered. 00:43:30.390 --> 00:43:33.530 align:middle line:84% I used it to find a coset and pulled it out. 00:43:33.530 --> 00:43:36.930 align:middle line:84% So if some xj later down the line actually 00:43:36.930 --> 00:43:39.687 align:middle line:84% belongs to an earlier coset, then 00:43:39.687 --> 00:43:41.270 align:middle line:84% that means I shouldn't have done that. 00:43:41.270 --> 00:43:44.250 align:middle line:84% It should have been pulled out before. 00:43:44.250 --> 00:43:46.030 align:middle line:84% So what I'm really saying logically 00:43:46.030 --> 00:43:49.130 align:middle line:84% is that, if this weren't true, if the intersection were 00:43:49.130 --> 00:43:52.330 align:middle line:84% non-zero, then I actually haven't implemented 00:43:52.330 --> 00:43:54.010 align:middle line:84% this procedure I told you correctly 00:43:54.010 --> 00:43:57.330 align:middle line:90% because xj was already covered. 00:43:57.330 --> 00:43:59.730 align:middle line:90% So now, same question-- 00:43:59.730 --> 00:44:01.770 align:middle line:84% I'm telling you what I want to show. 00:44:01.770 --> 00:44:05.170 align:middle line:84% This is what we're assuming for the purpose of contradiction. 00:44:05.170 --> 00:44:10.910 align:middle line:84% How can I show that xj belongs to an earlier coset? 00:44:10.910 --> 00:44:12.170 align:middle line:90% And I'll give you a hint. 00:44:12.170 --> 00:44:15.290 align:middle line:84% It should be the coset defined by xi. 00:44:15.290 --> 00:44:17.610 align:middle line:84% And same thing is going to be true here. 00:44:17.610 --> 00:44:20.210 align:middle line:84% We just need to figure out what property of a group 00:44:20.210 --> 00:44:23.316 align:middle line:90% or subgroup we should apply. 00:44:23.316 --> 00:44:26.330 align:middle line:84% So what should I do to this expression, 00:44:26.330 --> 00:44:33.090 align:middle line:84% xi h1 equals xj h2 to try and derive 00:44:33.090 --> 00:44:39.850 align:middle line:84% an expression where xj belongs to a coset, the coset of Xi? 00:44:39.850 --> 00:44:44.440 align:middle line:84% What about right-multiplying by h2 inverse? 00:44:44.440 --> 00:44:47.250 align:middle line:90% 00:44:47.250 --> 00:44:50.370 align:middle line:90% So let's see what happens. 00:44:50.370 --> 00:44:56.210 align:middle line:84% So let's right-multiply by h2 inverse. 00:44:56.210 --> 00:45:04.170 align:middle line:84% So we get xi h1 h2 inverse as equal to x. 00:45:04.170 --> 00:45:08.450 align:middle line:84% I wanted to show that x belongs to an earlier coset. 00:45:08.450 --> 00:45:12.130 align:middle line:84% Why is this expression showing that xj 00:45:12.130 --> 00:45:14.490 align:middle line:90% belongs to an earlier coset? 00:45:14.490 --> 00:45:16.850 align:middle line:84% So what can I say about this element right 00:45:16.850 --> 00:45:20.570 align:middle line:90% here, h1 h2 inverse? 00:45:20.570 --> 00:45:21.110 align:middle line:90% Yeah? 00:45:21.110 --> 00:45:22.830 align:middle line:84% STUDENT: That it's an element in H. 00:45:22.830 --> 00:45:24.590 align:middle line:84% ANKUR MOITRA: It's an element in H, right? 00:45:24.590 --> 00:45:25.090 align:middle line:90% Why? 00:45:25.090 --> 00:45:29.330 align:middle line:84% Because h2 inverse belongs to H. And then I'm 00:45:29.330 --> 00:45:31.370 align:middle line:84% multiplying two things belonging to H. So 00:45:31.370 --> 00:45:36.530 align:middle line:84% we've used the two key closure properties of the subgroup. 00:45:36.530 --> 00:45:45.050 align:middle line:84% And so what this means is that xj belongs to the set xiH. 00:45:45.050 --> 00:45:48.050 align:middle line:90% 00:45:48.050 --> 00:45:51.090 align:middle line:84% And that means that xj should have been covered. 00:45:51.090 --> 00:45:53.850 align:middle line:84% And we shouldn't have considered it to begin with. 00:45:53.850 --> 00:45:55.410 align:middle line:90% So that's our proof. 00:45:55.410 --> 00:45:57.450 align:middle line:90% This is not a long proof. 00:45:57.450 --> 00:46:00.490 align:middle line:84% But the logic for this is very subtle. 00:46:00.490 --> 00:46:02.440 align:middle line:84% We used everything that we could have 00:46:02.440 --> 00:46:05.240 align:middle line:84% used about groups and subgroups just 00:46:05.240 --> 00:46:08.600 align:middle line:84% to prove these few lines of this logical argument. 00:46:08.600 --> 00:46:12.020 align:middle line:84% Once we had the strategy of how to partition it into cosets 00:46:12.020 --> 00:46:14.400 align:middle line:84% and we had this definition of a coset, 00:46:14.400 --> 00:46:16.680 align:middle line:84% where we needed the group theory and the subgroups 00:46:16.680 --> 00:46:19.520 align:middle line:84% was really the structural properties 00:46:19.520 --> 00:46:23.160 align:middle line:84% that forced these properties 1 and 2 to be true. 00:46:23.160 --> 00:46:25.480 align:middle line:90% So this is a tricky proof. 00:46:25.480 --> 00:46:28.180 align:middle line:90% I will ask again, any questions? 00:46:28.180 --> 00:46:30.840 align:middle line:90% 00:46:30.840 --> 00:46:34.280 align:middle line:84% Is everyone comfortable with this proof, 00:46:34.280 --> 00:46:37.840 align:middle line:84% so I can give you my pop quiz now 00:46:37.840 --> 00:46:40.420 align:middle line:84% that will count towards 50% of your grade? 00:46:40.420 --> 00:46:43.040 align:middle line:90% I'm just kidding. 00:46:43.040 --> 00:46:45.620 align:middle line:84% Boy, would the people who didn't show up today be upset. 00:46:45.620 --> 00:46:48.520 align:middle line:90% We should do that at some point. 00:46:48.520 --> 00:46:52.000 align:middle line:84% All right, so now that we've done 00:46:52.000 --> 00:46:55.040 align:middle line:84% this hard work of proving Lagrange's theorem, 00:46:55.040 --> 00:46:56.050 align:middle line:90% let's see some payoff. 00:46:56.050 --> 00:47:02.320 align:middle line:90% 00:47:02.320 --> 00:47:06.760 align:middle line:84% So let me tell you some awesome statements 00:47:06.760 --> 00:47:11.130 align:middle line:84% that are going to follow as an application of Lagrange's 00:47:11.130 --> 00:47:11.630 align:middle line:90% theorem. 00:47:11.630 --> 00:47:14.440 align:middle line:90% 00:47:14.440 --> 00:47:16.680 align:middle line:84% And it's going to connect all of the tools we talked 00:47:16.680 --> 00:47:21.640 align:middle line:84% about-- subgroups, powers of elements, 00:47:21.640 --> 00:47:24.520 align:middle line:90% the order, and everything. 00:47:24.520 --> 00:47:30.680 align:middle line:84% So this is a theorem called Fermat's little theorem. 00:47:30.680 --> 00:47:34.440 align:middle line:84% We're not going to prove Fermat's last theorem. 00:47:34.440 --> 00:47:41.520 align:middle line:84% So what I claim is that if p is prime 00:47:41.520 --> 00:47:59.200 align:middle line:84% and a is not divisible by p, then a to the p minus 1 00:47:59.200 --> 00:48:03.840 align:middle line:90% is congruent to 1 mod p. 00:48:03.840 --> 00:48:06.680 align:middle line:90% This is a beautiful identity. 00:48:06.680 --> 00:48:10.000 align:middle line:84% In particular, what this means is really 00:48:10.000 --> 00:48:18.000 align:middle line:84% that a to the p minus 2 times a is equal to 1. 00:48:18.000 --> 00:48:22.400 align:middle line:84% So this gives me an explicit algebraic expression for what 00:48:22.400 --> 00:48:24.505 align:middle line:90% the multiplicative inverse is. 00:48:24.505 --> 00:48:25.880 align:middle line:84% Last time, we talked about how we 00:48:25.880 --> 00:48:28.520 align:middle line:84% could compute the multiplicative inverse 00:48:28.520 --> 00:48:31.640 align:middle line:84% by using the extended Euclidean algorithm. 00:48:31.640 --> 00:48:35.000 align:middle line:84% It turns out you can also do it by powering. 00:48:35.000 --> 00:48:38.520 align:middle line:84% If you give me a and I know that p is prime, all I have to do 00:48:38.520 --> 00:48:41.160 align:middle line:84% is raise a to the p minus 2 power. 00:48:41.160 --> 00:48:43.960 align:middle line:84% And that is the multiplicative inverse. 00:48:43.960 --> 00:48:47.720 align:middle line:84% You can check that all of our examples satisfy that property. 00:48:47.720 --> 00:48:50.560 align:middle line:84% That's why 2 and 4 were multiplicative inverses 00:48:50.560 --> 00:48:51.320 align:middle line:90% of each other. 00:48:51.320 --> 00:48:54.040 align:middle line:84% It was just that you take one and you raise it 00:48:54.040 --> 00:48:56.040 align:middle line:90% to the p minus 2 power. 00:48:56.040 --> 00:48:59.440 align:middle line:84% And that will give you the other one. 00:48:59.440 --> 00:49:01.360 align:middle line:84% So this property, it doesn't seem 00:49:01.360 --> 00:49:05.760 align:middle line:84% like it's connected to Lagrange, but it is. 00:49:05.760 --> 00:49:08.280 align:middle line:84% So it turns out that we're going to prove it 00:49:08.280 --> 00:49:09.770 align:middle line:90% through Lagrange's theorem. 00:49:09.770 --> 00:49:12.760 align:middle line:90% 00:49:12.760 --> 00:49:16.220 align:middle line:84% So what I'm going to do is I'm going to have a key definition, 00:49:16.220 --> 00:49:26.160 align:middle line:84% which is I'll let k be the smallest integer such 00:49:26.160 --> 00:49:34.460 align:middle line:84% that a to the k is congruent to 1 mod p. 00:49:34.460 --> 00:49:39.000 align:middle line:90% 00:49:39.000 --> 00:49:41.840 align:middle line:84% So now, the basic idea is that I have 00:49:41.840 --> 00:49:44.920 align:middle line:90% to prove that such a k exists. 00:49:44.920 --> 00:49:48.480 align:middle line:84% It's not obvious that there should always be a k. 00:49:48.480 --> 00:49:51.160 align:middle line:84% And once I know that there is a k, 00:49:51.160 --> 00:49:53.440 align:middle line:84% I'll relate it to the order of the group 00:49:53.440 --> 00:49:56.510 align:middle line:84% because this is going to define a subgroup. 00:49:56.510 --> 00:49:59.190 align:middle line:84% And that'll tell me something about when 00:49:59.190 --> 00:50:01.150 align:middle line:84% I use Lagrange's theorem and I relate that 00:50:01.150 --> 00:50:04.350 align:middle line:84% to the order of the actual group, which is p minus 1. 00:50:04.350 --> 00:50:07.510 align:middle line:84% That'll tell me that the same thing holds with p minus 1 00:50:07.510 --> 00:50:09.190 align:middle line:90% instead. 00:50:09.190 --> 00:50:11.990 align:middle line:90% So really, this is the plan. 00:50:11.990 --> 00:50:15.190 align:middle line:84% First, I have to show that such a k exists. 00:50:15.190 --> 00:50:18.170 align:middle line:90% So why is there any k? 00:50:18.170 --> 00:50:25.990 align:middle line:90% 00:50:25.990 --> 00:50:29.030 align:middle line:84% And now, we get to use a lot of the tools we've talked about 00:50:29.030 --> 00:50:30.330 align:middle line:90% in the class so far. 00:50:30.330 --> 00:50:33.910 align:middle line:84% So we get to connect it to a lot of earlier tools. 00:50:33.910 --> 00:50:37.910 align:middle line:84% I claim we can prove this by pigeonhole principle. 00:50:37.910 --> 00:50:42.710 align:middle line:84% So let's assume that there is no k. 00:50:42.710 --> 00:50:45.150 align:middle line:90% Suppose there is no such k. 00:50:45.150 --> 00:50:51.510 align:middle line:84% Then what I claim is that, by the pigeonhole principle, 00:50:51.510 --> 00:50:56.790 align:middle line:84% there must exist some i less than j with the property 00:50:56.790 --> 00:51:04.470 align:middle line:84% that a to the i is congruent to a to the j mod p. 00:51:04.470 --> 00:51:06.790 align:middle line:84% So what I'm going to do is I start off with a. 00:51:06.790 --> 00:51:08.910 align:middle line:90% I raise it to different powers. 00:51:08.910 --> 00:51:12.030 align:middle line:84% And I stop at the first power where what I get 00:51:12.030 --> 00:51:15.030 align:middle line:90% is congruent to 1 mod p. 00:51:15.030 --> 00:51:17.230 align:middle line:90% Let's suppose I never stop. 00:51:17.230 --> 00:51:19.430 align:middle line:90% What if I just kept going? 00:51:19.430 --> 00:51:22.610 align:middle line:84% Well, there are only so many other values 00:51:22.610 --> 00:51:25.870 align:middle line:84% for what the remainder when I divide by p can be. 00:51:25.870 --> 00:51:28.570 align:middle line:84% And eventually, when I consider high enough powers, 00:51:28.570 --> 00:51:33.110 align:middle line:84% I must be getting some kind of collision. 00:51:33.110 --> 00:51:35.510 align:middle line:84% So once I get this collision that a 00:51:35.510 --> 00:51:38.790 align:middle line:84% to the i equals a to the j, let's 00:51:38.790 --> 00:51:43.990 align:middle line:84% figure out why there must exist a k such that a to the k 00:51:43.990 --> 00:51:46.190 align:middle line:90% is congruent to 1. 00:51:46.190 --> 00:51:49.590 align:middle line:84% So what we can do is we can just divide through 00:51:49.590 --> 00:51:55.630 align:middle line:84% by a because there is an inverse to a, because p is prime. 00:51:55.630 --> 00:52:00.950 align:middle line:84% And so we can write this as a to the j minus i is congruent to 00:52:00.950 --> 00:52:03.310 align:middle line:90% 1 mod p. 00:52:03.310 --> 00:52:05.990 align:middle line:84% This is just because a inverse exists and we 00:52:05.990 --> 00:52:09.990 align:middle line:90% can get rid of powers of a. 00:52:09.990 --> 00:52:13.290 align:middle line:84% So when we get rid of i powers of from both sides, 00:52:13.290 --> 00:52:19.830 align:middle line:84% we get the identity a to the j minus i is congruent to 1 mod p. 00:52:19.830 --> 00:52:23.150 align:middle line:84% And that shows that there must exist some k just 00:52:23.150 --> 00:52:24.750 align:middle line:90% by pigeonhole principle. 00:52:24.750 --> 00:52:28.390 align:middle line:84% So this is the first thing that I owed you, is that k exists. 00:52:28.390 --> 00:52:32.370 align:middle line:84% And now, we're going to relate k to p minus 1. 00:52:32.370 --> 00:52:35.390 align:middle line:84% And that'll be the proof of Fermat. 00:52:35.390 --> 00:52:37.750 align:middle line:90% So this is the first step. 00:52:37.750 --> 00:52:42.310 align:middle line:90% And now, what I claim-- 00:52:42.310 --> 00:52:47.980 align:middle line:90% the powers of a form a subgroup. 00:52:47.980 --> 00:52:54.230 align:middle line:90% 00:52:54.230 --> 00:52:56.120 align:middle line:84% And what is the order of this subgroup? 00:52:56.120 --> 00:52:59.894 align:middle line:90% 00:52:59.894 --> 00:53:03.470 align:middle line:84% It's k because that's the first time when I got back 00:53:03.470 --> 00:53:05.590 align:middle line:90% the identity element. 00:53:05.590 --> 00:53:08.750 align:middle line:84% So it was the same way when I did that numerical example up 00:53:08.750 --> 00:53:09.790 align:middle line:90% here. 00:53:09.790 --> 00:53:14.390 align:middle line:84% I had a subgroup that was really generated by powers of 2. 00:53:14.390 --> 00:53:17.990 align:middle line:84% Now, I have a subgroup that's generated by powers of a. 00:53:17.990 --> 00:53:20.030 align:middle line:84% And my order is just the first time 00:53:20.030 --> 00:53:22.990 align:middle line:84% that I return back to the identity element. 00:53:22.990 --> 00:53:24.750 align:middle line:90% That's what k is. 00:53:24.750 --> 00:53:27.990 align:middle line:84% So I have a subgroup, which is the powers of a. 00:53:27.990 --> 00:53:29.990 align:middle line:90% And it has order k. 00:53:29.990 --> 00:53:34.950 align:middle line:84% So what I can do is now I can appeal to Lagrange's theorem. 00:53:34.950 --> 00:53:41.830 align:middle line:84% So by Lagrange's theorem, we know 00:53:41.830 --> 00:53:47.830 align:middle line:84% that k, the order of my subgroup, must divide p minus 1. 00:53:47.830 --> 00:53:50.740 align:middle line:84% You remember when we did all those computations of what 00:53:50.740 --> 00:53:54.220 align:middle line:84% the order of a subgroup is when n is prime, when 00:53:54.220 --> 00:53:56.260 align:middle line:90% n is the product of two primes? 00:53:56.260 --> 00:53:58.320 align:middle line:90% We know the order is p minus 1. 00:53:58.320 --> 00:54:00.820 align:middle line:84% Because of that first example we did. 00:54:00.820 --> 00:54:02.960 align:middle line:84% And now, we can appeal to Lagrange's theorem. 00:54:02.960 --> 00:54:06.180 align:middle line:84% And we know that k divides p minus 1. 00:54:06.180 --> 00:54:12.300 align:middle line:84% So now, we're golden because a to the p minus 1, that's 00:54:12.300 --> 00:54:17.460 align:middle line:84% the thing we want to show is congruent to 1 mod p. 00:54:17.460 --> 00:54:19.220 align:middle line:90% And what are we going to do? 00:54:19.220 --> 00:54:22.420 align:middle line:84% We're just going to write this as a 00:54:22.420 --> 00:54:29.060 align:middle line:84% to the k raised to the c-th power if, for example, p minus 1 00:54:29.060 --> 00:54:33.620 align:middle line:84% equals c times k because k divides p minus 1. 00:54:33.620 --> 00:54:36.300 align:middle line:84% So I'm just rewriting it in a different way. 00:54:36.300 --> 00:54:38.980 align:middle line:84% And now, what do I know about a to the k? 00:54:38.980 --> 00:54:42.140 align:middle line:90% What is it congruent to, mod p? 00:54:42.140 --> 00:54:44.100 align:middle line:90% It's congruent to 1. 00:54:44.100 --> 00:54:49.460 align:middle line:84% So this is the same thing as raising 1 to the power c, which 00:54:49.460 --> 00:54:51.110 align:middle line:90% is the same thing as 1. 00:54:51.110 --> 00:54:53.740 align:middle line:90% 00:54:53.740 --> 00:54:54.610 align:middle line:90% So that's the proof. 00:54:54.610 --> 00:54:58.900 align:middle line:90% 00:54:58.900 --> 00:55:01.460 align:middle line:84% So this is Fermat's little theorem. 00:55:01.460 --> 00:55:03.500 align:middle line:84% And even though the statement of it 00:55:03.500 --> 00:55:05.520 align:middle line:90% had nothing to do with groups-- 00:55:05.520 --> 00:55:07.780 align:middle line:84% I could have stated this for you at the beginning 00:55:07.780 --> 00:55:12.140 align:middle line:84% of lecture today because we knew what modular arithmetic was. 00:55:12.140 --> 00:55:15.140 align:middle line:84% We know what it means to take powers of a. 00:55:15.140 --> 00:55:18.110 align:middle line:84% But somehow, the cleanest proof of Fermat's theorem-- 00:55:18.110 --> 00:55:20.820 align:middle line:84% or at least, one of the cleanest proofs-- 00:55:20.820 --> 00:55:23.140 align:middle line:84% really goes through the fact that, 00:55:23.140 --> 00:55:27.220 align:middle line:84% sitting inside the powers of a, is some understanding of a group 00:55:27.220 --> 00:55:30.860 align:middle line:84% structure and how that relates to the larger group 00:55:30.860 --> 00:55:33.700 align:middle line:90% that it contains. 00:55:33.700 --> 00:55:36.740 align:middle line:84% So are there any questions about Lagrange's theorem? 00:55:36.740 --> 00:55:38.580 align:middle line:84% Sorry, the application of Lagrange's theorem 00:55:38.580 --> 00:55:39.990 align:middle line:90% to Fermat's little theorem? 00:55:39.990 --> 00:55:46.340 align:middle line:90% 00:55:46.340 --> 00:55:48.160 align:middle line:84% Who's comfortable with the proof? 00:55:48.160 --> 00:55:49.940 align:middle line:90% Give me a thumbs up. 00:55:49.940 --> 00:55:51.740 align:middle line:90% OK. 00:55:51.740 --> 00:55:54.740 align:middle line:90% All right. 00:55:54.740 --> 00:55:58.440 align:middle line:84% So one of the really cool things you can do-- 00:55:58.440 --> 00:56:04.500 align:middle line:84% let me just take a brief digression for a minute, which 00:56:04.500 --> 00:56:08.420 align:middle line:84% is that something like Fermat's little theorem, 00:56:08.420 --> 00:56:10.580 align:middle line:84% there are actually tons of proofs. 00:56:10.580 --> 00:56:14.940 align:middle line:84% So we gave a group theoretic proof right now. 00:56:14.940 --> 00:56:20.020 align:middle line:84% Let me give you a totally different proof just because. 00:56:20.020 --> 00:56:22.300 align:middle line:84% And this will connect back to some of the earlier 00:56:22.300 --> 00:56:23.980 align:middle line:90% topics we've seen. 00:56:23.980 --> 00:56:29.100 align:middle line:84% I claim there's a purely combinatorial way 00:56:29.100 --> 00:56:32.580 align:middle line:84% to prove Fermat's little theorem. 00:56:32.580 --> 00:56:34.780 align:middle line:84% And we'll prove it in a particular case 00:56:34.780 --> 00:56:38.460 align:middle line:84% for a particular setting of a and p. 00:56:38.460 --> 00:56:40.410 align:middle line:84% So let me give you a combinatorial proof. 00:56:40.410 --> 00:56:47.060 align:middle line:90% 00:56:47.060 --> 00:56:49.080 align:middle line:84% And let's do the proof specifically 00:56:49.080 --> 00:56:57.300 align:middle line:84% in the case where a equals 2 and p equals 5, just to be concrete. 00:56:57.300 --> 00:56:59.500 align:middle line:84% So the way that I'm going to do this is I'm 00:56:59.500 --> 00:57:04.140 align:middle line:84% actually going to think about a counting problem under the hood. 00:57:04.140 --> 00:57:07.980 align:middle line:84% And it'll involve something called necklaces. 00:57:07.980 --> 00:57:14.780 align:middle line:84% So the idea is that, when I take the statement of Fermat, 00:57:14.780 --> 00:57:22.860 align:middle line:84% it's the statement that a to the p minus 1 is congruent to 1. 00:57:22.860 --> 00:57:27.580 align:middle line:84% But another way to think about this statement is really 00:57:27.580 --> 00:57:39.540 align:middle line:84% the statement that a to the p minus a is divisible by p. 00:57:39.540 --> 00:57:41.700 align:middle line:84% That's really what the statement means 00:57:41.700 --> 00:57:45.370 align:middle line:84% because I can take this identity and I can multiply it 00:57:45.370 --> 00:57:46.770 align:middle line:90% through by a. 00:57:46.770 --> 00:57:51.010 align:middle line:84% So I get a to the p minus 1 is congruent to a mod p. 00:57:51.010 --> 00:57:52.670 align:middle line:84% When I move the a on the other side, 00:57:52.670 --> 00:57:55.970 align:middle line:84% I get this quantity a to the p minus a. 00:57:55.970 --> 00:57:58.330 align:middle line:84% And the statement that that's congruent to 0 00:57:58.330 --> 00:58:02.690 align:middle line:84% mod p is really the statement that that is a multiple of p. 00:58:02.690 --> 00:58:05.370 align:middle line:90% 00:58:05.370 --> 00:58:07.850 align:middle line:84% And I claim that there's a combinatorial proof 00:58:07.850 --> 00:58:11.050 align:middle line:84% of this fact, which will give us another way 00:58:11.050 --> 00:58:16.290 align:middle line:84% to think about what's happening in Fermat's little theorem. 00:58:16.290 --> 00:58:18.690 align:middle line:84% So what I'm going to do is I'm going to count 00:58:18.690 --> 00:58:21.130 align:middle line:90% certain combinatorial objects. 00:58:21.130 --> 00:58:26.210 align:middle line:84% And I'm going to prove as a corollary that statement. 00:58:26.210 --> 00:58:29.050 align:middle line:84% So what I can do is I can think about strings 00:58:29.050 --> 00:58:30.750 align:middle line:90% with different types of beads. 00:58:30.750 --> 00:58:31.470 align:middle line:90% a is 2. 00:58:31.470 --> 00:58:35.210 align:middle line:84% So they'll have two kinds of beads, red or blue beads. 00:58:35.210 --> 00:58:38.730 align:middle line:84% And their length will be p, which is 5. 00:58:38.730 --> 00:58:47.130 align:middle line:84% So I can look at the number of strings of length 5 00:58:47.130 --> 00:58:51.130 align:middle line:90% over an alphabet-- 00:58:51.130 --> 00:58:53.490 align:middle line:90% those are just the bead types-- 00:58:53.490 --> 00:58:57.290 align:middle line:90% of size 2. 00:58:57.290 --> 00:58:59.770 align:middle line:84% So how many strings are there of length 5 00:58:59.770 --> 00:59:03.410 align:middle line:84% that are composed of red and blue beads? 00:59:03.410 --> 00:59:04.970 align:middle line:90% That's very simple. 00:59:04.970 --> 00:59:08.970 align:middle line:90% It's 2 to the 5. 00:59:08.970 --> 00:59:12.770 align:middle line:84% That's my a to the p, right here, is 2 to the 5, 00:59:12.770 --> 00:59:16.650 align:middle line:84% is just counting the number of these strings. 00:59:16.650 --> 00:59:20.170 align:middle line:84% But what I'm going to do instead of counting these strings 00:59:20.170 --> 00:59:23.170 align:middle line:84% is I'll be interested in the number of necklaces. 00:59:23.170 --> 00:59:25.770 align:middle line:90% 00:59:25.770 --> 00:59:28.310 align:middle line:84% So I'll take those strings, which are length 5, 00:59:28.310 --> 00:59:31.050 align:middle line:84% and I'm going to tie their ends together. 00:59:31.050 --> 00:59:35.110 align:middle line:84% But now, the point is that it doesn't matter for the necklace 00:59:35.110 --> 00:59:36.310 align:middle line:90% whether it's-- 00:59:36.310 --> 00:59:38.870 align:middle line:84% when you take that necklace and rotate it, 00:59:38.870 --> 00:59:41.410 align:middle line:90% it's still the same necklace. 00:59:41.410 --> 00:59:43.710 align:middle line:84% So now, I'm losing some information. 00:59:43.710 --> 00:59:46.610 align:middle line:84% There are fewer necklaces because some of them 00:59:46.610 --> 00:59:49.010 align:middle line:90% are the same thing. 00:59:49.010 --> 00:59:53.050 align:middle line:84% So the question is, how many necklaces are there? 00:59:53.050 --> 00:59:54.090 align:middle line:90% I don't know. 00:59:54.090 --> 00:59:56.710 align:middle line:84% It was very easy to count the number of strings 00:59:56.710 --> 01:00:00.370 align:middle line:84% I can get out of two beads of length 5. 01:00:00.370 --> 01:00:06.750 align:middle line:84% And the way to think about it is that, when you take an example, 01:00:06.750 --> 01:00:12.010 align:middle line:84% let's say, which is a necklace that looks like red, 01:00:12.010 --> 01:00:18.810 align:middle line:84% blue, red, red, red, well, there are actually many strings that 01:00:18.810 --> 01:00:21.262 align:middle line:90% could have come from. 01:00:21.262 --> 01:00:24.730 align:middle line:84% In fact, there are five strings it could have come from, which 01:00:24.730 --> 01:00:27.570 align:middle line:90% all depend on where the B is. 01:00:27.570 --> 01:00:31.530 align:middle line:84% Maybe the B was the starting point of the necklace. 01:00:31.530 --> 01:00:35.930 align:middle line:84% Maybe it was the second, and so on. 01:00:35.930 --> 01:00:38.130 align:middle line:84% And there are five possibilities. 01:00:38.130 --> 01:00:40.730 align:middle line:90% And 5 is my p. 01:00:40.730 --> 01:00:44.010 align:middle line:84% So in fact, some of these necklaces 01:00:44.010 --> 01:00:47.770 align:middle line:84% really come from equivalence classes of strings 01:00:47.770 --> 01:00:50.610 align:middle line:90% that could have generated. 01:00:50.610 --> 01:00:52.850 align:middle line:84% Now, there are some necklaces which 01:00:52.850 --> 01:00:56.490 align:middle line:84% don't come from five different strings. 01:00:56.490 --> 01:00:58.610 align:middle line:84% Can anyone give me an example of a necklace 01:00:58.610 --> 01:01:05.470 align:middle line:84% that can only come from one of the 32 possibilities? 01:01:05.470 --> 01:01:06.340 align:middle line:90% STUDENT: All reds. 01:01:06.340 --> 01:01:07.673 align:middle line:90% ANKUR MOITRA: All reds, perfect. 01:01:07.673 --> 01:01:10.090 align:middle line:90% 01:01:10.090 --> 01:01:12.310 align:middle line:84% There are all of these other examples. 01:01:12.310 --> 01:01:13.810 align:middle line:90% Well, there's two of them. 01:01:13.810 --> 01:01:16.570 align:middle line:90% We could take all red. 01:01:16.570 --> 01:01:18.810 align:middle line:90% And we could take all blue. 01:01:18.810 --> 01:01:23.450 align:middle line:84% This, any way you rotate it, you get back the same thing. 01:01:23.450 --> 01:01:25.770 align:middle line:84% So what you can show is that these are the only two 01:01:25.770 --> 01:01:29.610 align:middle line:84% possibilities that the proof is using the Euclidean 01:01:29.610 --> 01:01:32.090 align:middle line:90% algorithm again, amazingly. 01:01:32.090 --> 01:01:35.930 align:middle line:84% But here, the number of necklaces, 01:01:35.930 --> 01:01:39.010 align:middle line:84% really, the way to think about them is in different groups. 01:01:39.010 --> 01:01:42.200 align:middle line:84% Either it's a necklace which comes from five strings 01:01:42.200 --> 01:01:46.360 align:middle line:84% or it's a necklace that comes from one. 01:01:46.360 --> 01:01:51.920 align:middle line:84% So this gives us our proof, is because the statement is 01:01:51.920 --> 01:01:56.640 align:middle line:84% that if we look at 5, this should divide 2 01:01:56.640 --> 01:01:58.800 align:middle line:90% to the fifth minus 2. 01:01:58.800 --> 01:02:06.960 align:middle line:84% So these are the number of non-monochromatic strings. 01:02:06.960 --> 01:02:10.200 align:middle line:84% And if we just remove all of the monochromatic strings-- 01:02:10.200 --> 01:02:12.600 align:middle line:90% the all red and all blue-- 01:02:12.600 --> 01:02:15.440 align:middle line:84% the rest of the strings have this property 01:02:15.440 --> 01:02:20.240 align:middle line:84% that they come in a 5 to 1 relationship with the necklaces. 01:02:20.240 --> 01:02:23.360 align:middle line:84% So in fact, the necklaces gives us a way to group the set 01:02:23.360 --> 01:02:25.920 align:middle line:90% of strings into groups of 5. 01:02:25.920 --> 01:02:28.960 align:middle line:84% So what does this statement look like more generally? 01:02:28.960 --> 01:02:35.480 align:middle line:84% This is just the statement that p divides a to the p minus a 01:02:35.480 --> 01:02:38.640 align:middle line:84% because you'll have a monochromatic necklaces. 01:02:38.640 --> 01:02:42.080 align:middle line:84% And that is exactly what Fermat's little theorem 01:02:42.080 --> 01:02:44.120 align:middle line:90% is telling you. 01:02:44.120 --> 01:02:48.460 align:middle line:84% So once we have enough tools in discrete applied math, 01:02:48.460 --> 01:02:51.440 align:middle line:84% there's this amazing nexus between these things. 01:02:51.440 --> 01:02:54.720 align:middle line:84% This was a simple statement related to modular arithmetic. 01:02:54.720 --> 01:02:56.640 align:middle line:84% I can prove it using group theory. 01:02:56.640 --> 01:02:59.120 align:middle line:84% I can prove it using combinatorics. 01:02:59.120 --> 01:03:02.520 align:middle line:84% And there are maybe half a dozen different proofs 01:03:02.520 --> 01:03:04.160 align:middle line:90% of Fermat's little theorem. 01:03:04.160 --> 01:03:06.220 align:middle line:84% There are many routes to this theorem. 01:03:06.220 --> 01:03:08.520 align:middle line:84% And they all lead to different kinds of abstractions 01:03:08.520 --> 01:03:11.480 align:middle line:90% and different mathematics. 01:03:11.480 --> 01:03:13.650 align:middle line:84% All right, any questions about this? 01:03:13.650 --> 01:03:20.080 align:middle line:90% 01:03:20.080 --> 01:03:21.320 align:middle line:90% All right. 01:03:21.320 --> 01:03:31.580 align:middle line:84% So I will tell you one other statement, which I promised you. 01:03:31.580 --> 01:03:34.840 align:middle line:90% 01:03:34.840 --> 01:03:35.970 align:middle line:90% This is due to Euler. 01:03:35.970 --> 01:03:48.340 align:middle line:90% 01:03:48.340 --> 01:03:49.840 align:middle line:84% And this is the thing which is going 01:03:49.840 --> 01:03:53.140 align:middle line:84% to have amazing applications in cryptography 01:03:53.140 --> 01:03:56.000 align:middle line:84% when we get to it in a bunch of lectures time. 01:03:56.000 --> 01:03:56.593 align:middle line:90% We'll do that. 01:03:56.593 --> 01:03:58.010 align:middle line:84% We'll do a whole unit on it later. 01:03:58.010 --> 01:04:01.080 align:middle line:90% 01:04:01.080 --> 01:04:02.130 align:middle line:90% This is due to Euler. 01:04:02.130 --> 01:04:08.060 align:middle line:90% 01:04:08.060 --> 01:04:11.380 align:middle line:84% So we're in the same setting of Fermat's little theorem, 01:04:11.380 --> 01:04:13.640 align:middle line:84% except for the fact that we have a composite. 01:04:13.640 --> 01:04:22.080 align:middle line:84% So if m is equal to p times q where p and q are 01:04:22.080 --> 01:04:40.040 align:middle line:84% distinct primes and a has GCD between a and m equal to 1, 01:04:40.040 --> 01:04:50.520 align:middle line:84% then what I claim is that a to the p minus 1 times q minus 1 01:04:50.520 --> 01:04:54.740 align:middle line:90% is congruent to 1 mod m. 01:04:54.740 --> 01:04:58.760 align:middle line:90% 01:04:58.760 --> 01:05:02.280 align:middle line:84% So this takes a minute to digest. 01:05:02.280 --> 01:05:07.000 align:middle line:84% So now, I'm working modulo m that is not prime. 01:05:07.000 --> 01:05:09.440 align:middle line:84% So we already know that it's not a group. 01:05:09.440 --> 01:05:14.040 align:middle line:84% And not every element has a multiplicative inverse. 01:05:14.040 --> 01:05:15.685 align:middle line:90% But some elements do. 01:05:15.685 --> 01:05:17.560 align:middle line:84% And in particular, what are the elements that 01:05:17.560 --> 01:05:18.900 align:middle line:90% have a multiplicative inverse? 01:05:18.900 --> 01:05:23.600 align:middle line:84% Those are the a's where the GCD between a and m is 1. 01:05:23.600 --> 01:05:26.160 align:middle line:84% So what I'm saying is that all of these elements that 01:05:26.160 --> 01:05:30.120 align:middle line:84% have a multiplicative inverse, a version of Fermat's 01:05:30.120 --> 01:05:32.200 align:middle line:84% little theorem holds, even though we're not 01:05:32.200 --> 01:05:34.080 align:middle line:90% working over a prime. 01:05:34.080 --> 01:05:37.590 align:middle line:84% The difference is that I'm raising it to a different power. 01:05:37.590 --> 01:05:44.790 align:middle line:84% It's not p minus 1 anymore, where p is the modulus. 01:05:44.790 --> 01:05:48.790 align:middle line:84% It's now p minus 1 times q minus 1. 01:05:48.790 --> 01:05:51.510 align:middle line:84% So we've changed the power we have to raise it 01:05:51.510 --> 01:05:53.670 align:middle line:90% to in Euler's theorem. 01:05:53.670 --> 01:05:58.030 align:middle line:84% It turns out that this is really a corollary of the proof I 01:05:58.030 --> 01:06:00.270 align:middle line:90% already gave you. 01:06:00.270 --> 01:06:04.430 align:middle line:84% There's actually nothing that's really specific about the fact 01:06:04.430 --> 01:06:06.270 align:middle line:90% that p is prime. 01:06:06.270 --> 01:06:09.910 align:middle line:90% We're just using groups. 01:06:09.910 --> 01:06:11.030 align:middle line:90% So what can I do? 01:06:11.030 --> 01:06:13.670 align:middle line:90% How does this proof change? 01:06:13.670 --> 01:06:16.590 align:middle line:84% Where did I use the fact that it was prime? 01:06:16.590 --> 01:06:20.390 align:middle line:84% Well, let k be the smallest integer so that a to the k 01:06:20.390 --> 01:06:24.470 align:middle line:90% is congruent to 1 mod m. 01:06:24.470 --> 01:06:28.990 align:middle line:84% I have to prove that such an integer exists. 01:06:28.990 --> 01:06:34.430 align:middle line:84% And if not, then there'll be some collision where a to the i 01:06:34.430 --> 01:06:36.550 align:middle line:90% is congruent to a to the j. 01:06:36.550 --> 01:06:38.990 align:middle line:84% And then I can still rearrange things 01:06:38.990 --> 01:06:43.630 align:middle line:84% because I'm working with an a whose GCD between a and m is 1. 01:06:43.630 --> 01:06:45.710 align:middle line:90% So it has an inverse. 01:06:45.710 --> 01:06:48.510 align:middle line:90% So I can pull out i powers of a. 01:06:48.510 --> 01:06:52.870 align:middle line:84% And I'll get a to the j minus i is congruent to 1 mod m. 01:06:52.870 --> 01:06:54.370 align:middle line:90% That part still worked. 01:06:54.370 --> 01:06:56.550 align:middle line:90% It was literally the same proof. 01:06:56.550 --> 01:06:58.990 align:middle line:90% So such a k exists. 01:06:58.990 --> 01:07:03.070 align:middle line:84% And now, that's still a subgroup. 01:07:03.070 --> 01:07:06.350 align:middle line:84% When I look at the powers of 2, look at the powers 01:07:06.350 --> 01:07:08.350 align:middle line:90% of a, that's still a subgroup. 01:07:08.350 --> 01:07:11.110 align:middle line:84% I still know its order because that's the first time 01:07:11.110 --> 01:07:14.310 align:middle line:90% I have a collision, is that k. 01:07:14.310 --> 01:07:16.830 align:middle line:84% And then by Lagrange's theorem, I 01:07:16.830 --> 01:07:21.750 align:middle line:84% know that k divides not p minus 1, but the order of the group. 01:07:21.750 --> 01:07:24.190 align:middle line:84% So what did I promise you we were going to use 01:07:24.190 --> 01:07:27.710 align:middle line:84% was this simple example, this computation right here. 01:07:27.710 --> 01:07:30.830 align:middle line:84% What is the order of the multiplicative subgroup 01:07:30.830 --> 01:07:34.550 align:middle line:84% sitting inside zm, which is where the structure is really 01:07:34.550 --> 01:07:35.350 align:middle line:90% happening? 01:07:35.350 --> 01:07:36.930 align:middle line:90% It's not m minus 1. 01:07:36.930 --> 01:07:39.670 align:middle line:90% It's p minus 1 q minus 1. 01:07:39.670 --> 01:07:42.950 align:middle line:84% So what do we know is that k divides 01:07:42.950 --> 01:07:45.710 align:middle line:90% p minus 1 times q minus 1. 01:07:45.710 --> 01:07:55.030 align:middle line:84% So then p minus 1 times q minus 1 is equal to c times k. 01:07:55.030 --> 01:07:56.990 align:middle line:90% Same thing happens here. 01:07:56.990 --> 01:07:59.790 align:middle line:84% This is p minus 1 times q minus 1, 01:07:59.790 --> 01:08:03.630 align:middle line:84% which in writing as a to the k raised to the c-th power. 01:08:03.630 --> 01:08:06.150 align:middle line:90% And that's still 1. 01:08:06.150 --> 01:08:08.615 align:middle line:84% So in fact, what's really cool about this-- 01:08:08.615 --> 01:08:09.990 align:middle line:84% I could have told you all of this 01:08:09.990 --> 01:08:11.430 align:middle line:90% at the beginning of lecture. 01:08:11.430 --> 01:08:13.210 align:middle line:84% We knew what modular arithmetic was. 01:08:13.210 --> 01:08:16.069 align:middle line:84% I could have stated Fermat's little theorem. 01:08:16.069 --> 01:08:19.109 align:middle line:84% I could have stated Euler's theorem. 01:08:19.109 --> 01:08:21.090 align:middle line:84% And they might have seemed a bit mysterious. 01:08:21.090 --> 01:08:26.189 align:middle line:84% Why is the power I'm raising things to different depending 01:08:26.189 --> 01:08:31.109 align:middle line:84% on whether I have a prime or I have a product of primes/ 01:08:31.109 --> 01:08:34.750 align:middle line:84% And it turns out that once you have this group theoretic proof 01:08:34.750 --> 01:08:37.750 align:middle line:84% of it, we can see that the reason that we 01:08:37.750 --> 01:08:41.850 align:middle line:84% have a different power is because it's no longer a group. 01:08:41.850 --> 01:08:45.390 align:middle line:84% And we have to look at the order of the subgroup that's inside. 01:08:45.390 --> 01:08:47.550 align:middle line:84% So that's really what's going in the exponent, 01:08:47.550 --> 01:08:51.310 align:middle line:84% is just the order of the appropriate subgroup. 01:08:51.310 --> 01:08:55.710 align:middle line:84% So this is one of the amazing things about group theory, 01:08:55.710 --> 01:08:59.189 align:middle line:84% is that it can demystify a lot of these statements that 01:08:59.189 --> 01:09:03.189 align:middle line:84% otherwise look like they're not quite the same thing. 01:09:03.189 --> 01:09:07.350 align:middle line:84% In fact, here, we had literally the same proof. 01:09:07.350 --> 01:09:09.710 align:middle line:90% It was 100% the same proof. 01:09:09.710 --> 01:09:14.430 align:middle line:84% I just had to cross out a bunch of things and replace them. 01:09:14.430 --> 01:09:15.770 align:middle line:90% So are there any questions? 01:09:15.770 --> 01:09:20.750 align:middle line:90% 01:09:20.750 --> 01:09:22.270 align:middle line:90% All right. 01:09:22.270 --> 01:09:26.790 align:middle line:84% So very last thing I'm going to tell you-- 01:09:26.790 --> 01:09:28.470 align:middle line:84% one more abstraction, and then I'm 01:09:28.470 --> 01:09:30.020 align:middle line:84% just going to tell you a theorem because we're 01:09:30.020 --> 01:09:30.960 align:middle line:90% going to use it later. 01:09:30.960 --> 01:09:33.380 align:middle line:84% But we'll just take this for granted. 01:09:33.380 --> 01:09:36.840 align:middle line:84% So it turns out a group has a decent amount of structure, 01:09:36.840 --> 01:09:41.620 align:middle line:90% but not everything. 01:09:41.620 --> 01:09:43.180 align:middle line:84% So there's actually something you 01:09:43.180 --> 01:09:46.779 align:middle line:84% can do which imposes even more structure than a group. 01:09:46.779 --> 01:09:49.340 align:middle line:84% Actually, there are many things you can do. 01:09:49.340 --> 01:09:50.880 align:middle line:90% There are things called rings. 01:09:50.880 --> 01:09:52.920 align:middle line:90% We won't be interested in those. 01:09:52.920 --> 01:09:54.420 align:middle line:84% But we'll be interested in something 01:09:54.420 --> 01:09:59.380 align:middle line:84% called a field, which has a lot more structure than a group. 01:09:59.380 --> 01:10:00.960 align:middle line:84% And when you're dealing with a field, 01:10:00.960 --> 01:10:04.580 align:middle line:84% a lot more nice things can happen. 01:10:04.580 --> 01:10:16.406 align:middle line:84% So last bit of abstract algebra is a field 01:10:16.406 --> 01:10:19.660 align:middle line:84% is a set F, potentially infinite, which 01:10:19.660 --> 01:10:24.140 align:middle line:84% now has two operations, addition and multiplication. 01:10:24.140 --> 01:10:26.520 align:middle line:84% And it satisfies a bunch of properties. 01:10:26.520 --> 01:10:30.500 align:middle line:84% So first of all, we need that F and the operation 01:10:30.500 --> 01:10:34.870 align:middle line:84% plus, the binary operation, is an abelian group. 01:10:34.870 --> 01:10:38.460 align:middle line:90% 01:10:38.460 --> 01:10:47.660 align:middle line:84% And it'll have identity which is some distinguished 0 element. 01:10:47.660 --> 01:10:51.980 align:middle line:84% We're going to need that multiplication is also a group. 01:10:51.980 --> 01:10:55.100 align:middle line:84% We need that F minus 0, when we remove out 01:10:55.100 --> 01:10:59.260 align:middle line:84% the element that's the identity for addition, 01:10:59.260 --> 01:11:03.100 align:middle line:84% we need that the binary operation on whatever remains 01:11:03.100 --> 01:11:05.260 align:middle line:90% is a group. 01:11:05.260 --> 01:11:07.030 align:middle line:84% We need that it's an abelian group. 01:11:07.030 --> 01:11:11.660 align:middle line:90% 01:11:11.660 --> 01:11:19.820 align:middle line:84% And it'll have identity 1, some special element. 01:11:19.820 --> 01:11:23.140 align:middle line:84% And the very last property that we need 01:11:23.140 --> 01:11:27.430 align:middle line:84% is we need that it satisfies the distributive property. 01:11:27.430 --> 01:11:29.940 align:middle line:90% 01:11:29.940 --> 01:11:39.780 align:middle line:84% So we need that, for all a, b, c belonging to my field, a times 01:11:39.780 --> 01:11:46.940 align:middle line:84% b plus c is the same thing as a times b plus a times c. 01:11:46.940 --> 01:11:48.515 align:middle line:90% So this is a field. 01:11:48.515 --> 01:11:50.640 align:middle line:84% A lot of times, we're not just dealing with groups. 01:11:50.640 --> 01:11:55.700 align:middle line:84% We're dealing with fields, like the field of rationals, where 01:11:55.700 --> 01:11:57.460 align:middle line:84% we have addition and multiplication 01:11:57.460 --> 01:11:58.950 align:middle line:90% and everything behaves nicely. 01:11:58.950 --> 01:12:02.060 align:middle line:90% 01:12:02.060 --> 01:12:04.040 align:middle line:84% And now, here is an amazing theorem, 01:12:04.040 --> 01:12:08.050 align:middle line:84% which we're going to use later on when we do more crypto. 01:12:08.050 --> 01:12:10.980 align:middle line:90% 01:12:10.980 --> 01:12:23.820 align:middle line:84% What I claim is that any polynomial of degree d, at least 01:12:23.820 --> 01:12:32.780 align:middle line:84% one, with coefficients in my field 01:12:32.780 --> 01:12:44.220 align:middle line:84% can have at most d roots in F. So what 01:12:44.220 --> 01:12:49.420 align:middle line:84% this means is you can consider some polynomial, p of x, which 01:12:49.420 --> 01:12:57.700 align:middle line:84% is p0 plus p1 x and so on all the way up to pd x to the d. 01:12:57.700 --> 01:13:01.340 align:middle line:84% And the crucial thing is that all of these pi's belong 01:13:01.340 --> 01:13:03.420 align:middle line:90% to my field. 01:13:03.420 --> 01:13:05.620 align:middle line:84% And I'm only going to consider values 01:13:05.620 --> 01:13:08.300 align:middle line:90% of x that belong to my field. 01:13:08.300 --> 01:13:10.740 align:middle line:84% So a notion of a root is can I find 01:13:10.740 --> 01:13:18.620 align:middle line:84% an x that belongs to my field so that P of x evaluates to 0. 01:13:18.620 --> 01:13:23.860 align:middle line:84% And now, it turns out that you can show this basic statement we 01:13:23.860 --> 01:13:27.450 align:middle line:84% know and love about real valued polynomials, 01:13:27.450 --> 01:13:32.110 align:middle line:84% that if they have degree d, they have at most d roots, well, 01:13:32.110 --> 01:13:35.570 align:middle line:84% that's actually a property of a general field. 01:13:35.570 --> 01:13:37.590 align:middle line:84% So it's not just a property of the reals. 01:13:37.590 --> 01:13:39.970 align:middle line:84% It generalizes even in this sense. 01:13:39.970 --> 01:13:43.290 align:middle line:84% So just to give you a hint about what we're going to do later-- 01:13:43.290 --> 01:13:45.810 align:middle line:84% we're going to do an application where we talk about crypto 01:13:45.810 --> 01:13:48.730 align:middle line:84% called secret sharing, where what we want to do is we want 01:13:48.730 --> 01:13:53.290 align:middle line:84% to take a secret and divide it up among a group of n people 01:13:53.290 --> 01:13:57.130 align:middle line:84% so that any k people can recover the secret, 01:13:57.130 --> 01:14:01.370 align:middle line:84% but any fewer than that cannot recover the secret. 01:14:01.370 --> 01:14:04.810 align:middle line:84% So they can together share their piece of the key 01:14:04.810 --> 01:14:06.828 align:middle line:90% and find out the answer. 01:14:06.828 --> 01:14:08.370 align:middle line:84% And what we're going to be interested 01:14:08.370 --> 01:14:10.970 align:middle line:84% in is the way we're going to build up our secret sharing 01:14:10.970 --> 01:14:14.090 align:middle line:84% schemes is we're going to be working with polynomials not 01:14:14.090 --> 01:14:16.993 align:middle line:84% over the reals, but over finite fields. 01:14:16.993 --> 01:14:18.410 align:middle line:84% So roughly, what's going to happen 01:14:18.410 --> 01:14:20.370 align:middle line:84% is that the secret will be something 01:14:20.370 --> 01:14:23.850 align:middle line:84% like the constant coefficient of my polynomial. 01:14:23.850 --> 01:14:27.330 align:middle line:84% So it's some finite value from some finite field. 01:14:27.330 --> 01:14:28.810 align:middle line:84% And then what each of the parties 01:14:28.810 --> 01:14:31.010 align:middle line:84% are going to have is they're going 01:14:31.010 --> 01:14:35.490 align:middle line:84% to have the evaluation of this polynomial at some point. 01:14:35.490 --> 01:14:39.810 align:middle line:84% And together, when they have enough points and evaluations, 01:14:39.810 --> 01:14:43.490 align:middle line:84% they can interpolate the polynomial and find the secret. 01:14:43.490 --> 01:14:45.690 align:middle line:90% And otherwise, they cannot. 01:14:45.690 --> 01:14:47.990 align:middle line:84% So I'll just give you the hint of that for later. 01:14:47.990 --> 01:14:49.350 align:middle line:90% But stay tuned. 01:14:49.350 --> 01:14:52.250 align:middle line:84% When we do cryptography, we're going 01:14:52.250 --> 01:14:55.330 align:middle line:84% to see how this identity, namely Euler's theorem, 01:14:55.330 --> 01:14:58.250 align:middle line:84% is the basis for modern cryptography and the RSA 01:14:58.250 --> 01:14:59.610 align:middle line:90% encryption scheme. 01:14:59.610 --> 01:15:02.970 align:middle line:84% And we're going to see how this statement about polynomials 01:15:02.970 --> 01:15:06.970 align:middle line:84% and the number of roots is the basis for modern secret sharing. 01:15:06.970 --> 01:15:08.850 align:middle line:90% But we'll get there. 01:15:08.850 --> 01:15:10.170 align:middle line:90% So let's stop here. 01:15:10.170 --> 01:15:13.070 align:middle line:84% And I'll take any questions you guys have offline. 01:15:13.070 --> 01:15:15.730 align:middle line:84% Otherwise, have a great spring break. 01:15:15.730 --> 01:15:18.320 align:middle line:90% Hope you guys do something fun. 01:15:18.320 --> 01:15:23.000 align:middle line:90%