Chinese remainder theorem

The Chinese remainder theorem is a result about congruences in number theory and its generalizations in abstract algebra.

Theorem statement

The original form of the theorem, contained in a third-century AD book Sun Zi suanjing (孙子算经 The Mathematical Classic by Sun Zi) by Chinese mathematician Sun Tzu and later republished in a 1247 book by Qin Jiushao, the Shushu Jiuzhang (數書九章 Mathematical Treatise in Nine Sections) is a statement about simultaneous congruences (see modular arithmetic).

Suppose n₁, n₂, …, n_k are positive integers which are pairwise coprime. Then, for any given integers a₁,a₂, …, a_k, there exists an integer x solving the system of simultaneous congruences

${\begin{aligned}x&\equiv a_{1}{\pmod {n_{1}}}\\x&\equiv a_{2}{\pmod {n_{2}}}\\&\vdots \\x&\equiv a_{k}{\pmod {n_{k}}}\end{aligned}}$

Furthermore, all solutions x to this system are congruent modulo the product N = n₁n₂…n_k.

Hence $x\equiv y{\pmod {n_{i}}}$ for all $1\leq i\leq k$, if and only if $x\equiv y{\pmod {N}}$.

Sometimes, the simultaneous congruences can be solved even if the n_i's are not pairwise coprime. A solution x exists if and only if:

$a_{i}\equiv a_{j}{\pmod {\gcd(n_{i},n_{j})}}\qquad {\mbox{for all }}i{\mbox{ and }}j.\,\!$

All solutions x are then congruent modulo the least common multiple of the n_i.

Versions of the Chinese remainder theorem were also known to Brahmagupta (7th century), and appear in Fibonacci's Liber Abaci (1202).

A constructive algorithm to find the solution

This algorithm only treats the situations where the $n_{i}$'s are coprime. The method of successive substitution can often yield solutions to simultaneous congruences, even when the moduli are not pairwise coprime.

Suppose, as above, that a solution is needed to the system of congruences:

$x\equiv a_{i}{\pmod {n_{i}}}\quad \mathrm {for} \;i=1,\ldots ,k.$

Again, to begin, the product $N=n_{1}n_{2}\ldots n_{k}$ is defined. Then a solution x can be found as follows.

For each i the integers $n_{i}$ and $N/n_{i}$ are coprime. Using the extended Euclidean algorithm we can find integers $r_{i}$ and $s_{i}$ such that $r_{i}n_{i}+s_{i}N/n_{i}=1$. Then, choosing the label $e_{i}=s_{i}N/n_{i}$, the above expression becomes:

$r_{i}n_{i}+e_{i}=1\,\!$

Consider $e_{i}$. The above equation guarantees that its remainder, when divided by $n_{i}$, must be 1. On the other hand, since it is formed as $s_{i}N/n_{i}$, the presence of $N$ guarantees that it's evenly divisible by any $n_{j}$ so long as $j\neq i$.

$e_{i}\equiv 1{\pmod {n_{i}}}\quad \mathrm {and} \quad e_{i}\equiv 0{\pmod {n_{j}}}\quad \mathrm {for} ~i\neq j$

Because of this, combined with the multiplication rules allowed in congruences, one solution to the system of simultaneous congruences is:

$x=\sum _{i=1}^{k}a_{i}e_{i}.\!$

For example, consider the problem of finding an integer x such that

$x\equiv 2{\pmod {3}},\,\!$

$x\equiv 3{\pmod {4}},\,\!$

$x\equiv 1{\pmod {5}}.\,\!$

Using the extended Euclidean algorithm for 3 and 4×5 = 20, we find (−13) × 3 + 2 × 20 = 1, i.e. e₁ = 40. Using the Euclidean algorithm for 4 and 3×5 = 15, we get (−11) × 4 + 3 × 15 = 1. Hence, e₂ = 45. Finally, using the Euclidean algorithm for 5 and 3×4 = 12, we get 5 × 5 + (−2) × 12 = 1, meaning e₃ = −24. A solution x is therefore 2 × 40 + 3 × 45 + 1 × (−24) = 191. All other solutions are congruent to 191 modulo 60, (3 × 4 × 5 = 60) which means that they are all congruent to 11 modulo 60.

NOTE: There are multiple implementations of the extended Euclidean algorithm which will yield different sets of $e_{1}$, $e_{2}$, and $e_{3}$. These sets however will produce the same solution i.e. 11 modulo 60.

Statement for principal ideal domains

For a principal ideal domain R the Chinese remainder theorem takes the following form: If u₁, ..., u_k are elements of R which are pairwise coprime, and u denotes the product u₁...u_k, then the quotient ring R/uR and the product ring R/u₁R× ... × R/u_kR are isomorphic via the isomorphism

$f:R/uR\rightarrow R/u_{1}R\times \cdots \times R/u_{k}R$

such that

$f(x+uR)=(x+u_{1}R,\ldots ,x+u_{k}R)\quad {\mbox{ for every }}x\in R.$

This isomorphism is unique; the inverse isomorphism can be constructed as follows. For each i, the elements u_i and u/u_i are coprime, and therefore there exist elements r and s in R with

$ru_{i}+su/u_{i}=1.\,\!$

Set e_i = s u/u_i. Then the inverse of f is the map

$g:R/u_{1}R\times \cdots \times R/u_{k}R\rightarrow R/uR$

such that

$g(a_{1}+u_{1}R,\ldots ,a_{k}+u_{k}R)=\left(\sum _{i=1}^{k}a_{i}e_{i}\right)+uR\quad {\mbox{ for all }}a_{1},\ldots ,a_{k}\in R.$

Note that this statement is a straightforward generalization of the above theorem about integer congruences: the ring Z of integers is a principal ideal domain, the surjectivity of the map f shows that every system of congruences of the form

$x\equiv a_{i}{\pmod {u_{i}}}\quad \mathrm {for} \;i=1,\ldots ,k$

can be solved for x, and the injectivity of the map f shows that all the solutions x are congruent modulo u.

Statement for general rings

The general form of the Chinese remainder theorem, which implies all the statements given above, can be formulated for commutative rings and ideals. If R is a commutative ring and I₁, ..., I_k are ideals of R which are pairwise coprime (meaning that I_i + I_j = R whenever i ≠ j), then the product I of these ideals is equal to their intersection, and the quotient ring R/I is isomorphic to the product ring R/I₁ x R/I₂ x ... x R/I_k via the isomorphism

$f:R/I\rightarrow R/I_{1}\times \cdots \times R/I_{k}$

such that

$f(x+I)=(x+I_{1},\ldots ,x+I_{k})\quad {\mbox{ for all }}x\in R.$

Applications

In the RSA algorithm calculations are made modulo $n$, where $n$ is a product of two large prime numbers $p$ and $q$. 1024-, 2048- or 4096-bit integers $n$ are commonly used, making calculations in ${\mathbb {Z} }/n{\mathbb {Z} }$ very time-consuming. By the Chinese Remainder Theorem, however, these calculations can be done in the isomorphic ring ${\mathbb {Z} }/p{\mathbb {Z} }\oplus {\mathbb {Z} }/q{\mathbb {Z} }$ instead. Since $p$ and $q$ are normally of about the same size, that is about ${\sqrt {n}}$, calculations in the latter representation are much faster. Note that RSA algorithm implementations using this isomorphism are more susceptible to fault injection attacks.

The Chinese Remainder Theorem may also be used to construct an elegant Gödel numbering for sequences, which is needed to prove Gödel's incompleteness theorems.

The following example shows a connection with the classic polynomial interpolation theory. Let r complex points ("interpolation nodes") $\textstyle \lambda _{1},\cdots ,\lambda _{r}$ be given, together with the complex data $a_{j,k}\$, for all $\textstyle 1\leq j\leq r$ and $\textstyle 0\leq k<\nu _{j}$. The general Hermite interpolation problem asks for a polynomial $\textstyle P(x)\in \mathbb {C} [x]$ taking the prescribed derivatives in each node $\lambda _{j}\$:

$P^{(k)}(\lambda _{j})=a_{j,k}\quad \forall 1\leq j\leq r\ ,0\leq k<\nu _{j}$.

Introducing the polynomials $\textstyle A_{j}(x):=\sum _{k=0}^{\nu _{j}}{\frac {a_{j,k}}{k!}}(x-\lambda _{j})^{k}$, the problem may be equivalently reformulated as a system of $r\$ simultaneous congruences:

$P(x)\equiv A_{j}(x){\pmod {(x-\lambda _{j})^{\nu _{j}}}},\quad \forall 1\leq j\leq r\$.

By the Chinese remainder theorem in the principal ideal domain $\textstyle \mathbb {C} [x]$, there is a unique such polynomial $\textstyle P(x)$ with degree $\textstyle \deg(P)<n:=\sum _{j}\nu _{j}$. A direct construction, in analogy with the above proof for the integer number case, can be performed as follows. Define the polynomials $\textstyle Q:=\prod _{i=1}^{r}(x-\lambda _{i})^{\nu _{i}}$ and $\textstyle Q_{j}:={\frac {Q}{(x-\lambda _{j})^{\nu _{j}}}}$. The partial fraction decomposition of $\textstyle {\frac {1}{Q}}$ gives r polynomials $\textstyle S_{j}$ with degrees $\textstyle \deg(S_{j})<\nu _{j}$ such that

${\frac {1}{Q}}=\sum _{i=1}^{r}{\frac {S_{i}}{(x-\lambda _{i})^{\nu _{i}}}}$,

so that $\textstyle 1=\sum _{i=1}^{r}S_{i}Q_{i}$. Then a solution of the simultaneous congruence system is given by the polynomial

$\sum _{i=1}^{r}A_{i}S_{i}Q_{i}=A_{j}+\sum _{i=1}^{r}(A_{i}-A_{j})S_{i}Q_{i}\equiv A_{j}{\pmod {(x-\lambda _{j})^{\nu _{j}}}}\quad \forall 1\leq j\leq r\$;

and the minimal degree solution is this one reduced modulo $\textstyle Q$, that is the unique with degree less than n.

The Chinese Remainder Theorem can also be used in Secret sharing, which consists of distributing a set of shares among a group of people who, all together (but noone alone), can recover a certain secret from the given set of shares. Each of the shares is represented in a congruence, and the solution of the system of congruences using the Chinese remainder theorem is the secret to be recovered. Secret Sharing using the Chinese Remainder Theorem uses, along with the Chinese remainder theorem, special sequences of integers that guarantee the impossibility of recovering the secret from a set of shares with less than a certain cardinality.

Non-commutative case

The Chinese remainder theorem does not hold in the non-commutative case. Consider the ring $R$ of non-commutative real polynomials in $x$ and $y$. Let $I$ be the principal two-sided ideal generated by $x$ and $J$ the principal two-sided ideal generated by $xy+1.$ Then $I+J=R$ but $I\cap J\neq IJ.$

Proof:

Observe that $I$ is formed by all polynomials with an $x$ in every term and that every polynomial in $J$ vanishes under the substitution $y=-1/x$. Consider the polynomial $p=(xy+1)x$. Clearly $p\in I\cap J$. Define a term in $R$ as an element of the multiplicative monoid of $R$ generated by $x$ and $y$. Define the degree of a term as the usual degree of the term after the substitution $y=x$. On the other hand, suppose $q\in J$. Observe that a term in $q$ of maximum degree depends on $y$ otherwise $q$ under the substitution $y=-1/x$ can not vanish. The same happens then for an element $q\in IJ$. Observe that the last $y$, from left to right, in a term of maximum degree in an element of $IJ$ is preceded by more than one $x$. (We are counting here all the preceding $x$s. e.g. in $x^{2}yxyx^{5}$ the last $y$ is preceded by $3$ $x$s.) This proves that $(xy+1)x\notin IJ$ since that last $y$ in a term of maximum degree ($xyx$) is preceded by only one $x$. Hence $I\cap J\neq IJ$.

On the other hand, it is true in general that $I+J=R$ implies $I\cap J=IJ+JI$. To see this, note that $I\cap J=(I\cap J)(I+J)\subset IJ+JI$, while the opposite inclusion is obvious. Also, we have in general that, provided $I_{1},\ldots ,I_{m}$ are pairwise coprime two-sided ideals in $R$, the natural map

$R/(I_{1}\cap I_{2}\cap \ldots \cap I_{m})\rightarrow R/I_{1}\oplus R/I_{2}\oplus \cdots \oplus R/I_{m}$

is an isomorphism. Note that $I_{1}\cap I_{2}\cap \ldots \cap I_{m}$ can be replaced by a sum over all orderings of $I_{1},\ldots ,I_{m}$ of their product (or just a sum over enough orderings, using inductively that $I\cap J=IJ+JI$ for coprime ideals $I,J$).

See also

• Covering system
• Residue number system
• Hasse principle
• Secret Sharing using the Chinese Remainder Theorem

References

• Donald Knuth. The Art of Computer Programming, Volume 2: Seminumerical Algorithms, Third Edition. Addison-Wesley, 1997. ISBN 0-201-89684-2. Section 4.3.2 (pp.286–291), exercise 4.6.2–3 (page 456).
• Thomas H. Cormen, Charles E. Leiserson, Ronald L. Rivest, and Clifford Stein. Introduction to Algorithms, Second Edition. MIT Press and McGraw-Hill, 2001. ISBN 0-262-03293-7. Section 31.5: The Chinese remainder theorem, pp.873–876.
• Sigler, Laurence E. (trans.) (2002). Fibonacci's Liber Abaci. Springer-Verlag. pp. 402–403. ISBN 0-387-95419-8.

External links

• Chinese remainder theorem at cut-the-knot
• "Chinese Remainder Theorem" by Ed Pegg, Jr., Wolfram Demonstrations Project, 2007.
• Weisstein, Eric W. "Chinese Remainder Theorem". MathWorld.
• C# program and discussion at codeproject