Fermat's little theorem
For a prime p and a number a that p does not divide, the powers of a modulo p always come back to 1. Can we say in advance which power does it, and does the same thing tell a prime from a composite number?
Where you are 7 in Modular arithmetic
Why this exists
In Powers modulo n the powers of a number modulo n were found to repeat in a cycle, and when a power reached 1 the exponent could be cut down to its remainder. But finding where the cycle closes meant listing powers until 1 appeared, and that lesson only stated, without proof, that 1 does appear when a and n have no common factor. For a prime modulus Fermat’s little theorem settles it in advance: the power a^{p-1} is always 1 modulo p. That turns exponents in the billions into small ones, gives a formula for inverses, and gives a way to prove a number composite without finding a single factor of it.
Definition
Day 1: the theorem and two proofs
Let p be a prime and a an integer. Fermat’s little theorem says two equivalent things.
- If p \nmid a, then a^{p-1} \equiv 1 \pmod{p}.
- For every integer a, a^p \equiv a \pmod{p}.
The first form is the useful one for computing; the second needs no condition on a. They say the same thing: when p \mid a the second form reads 0 \equiv 0, and when p \nmid a the two differ by a factor of a, which may be multiplied in (Theorem 3 of Congruence modulo n and its arithmetic) or cancelled (Lemma 2 below).
Day 2: what the theorem is used for
Day 2 keeps the theorem and changes the question. Read forward, it computes inverses modulo p. Read backward, it is a test: a number n with a^{n-1} \not\equiv 1 \pmod{n} for some a that n does not divide cannot be prime. For a modulus that is not prime, Euler’s phi function \varphi(n) counts the integers from 1 to n that share no factor greater than 1 with n (Inclusion-exclusion for three or more sets, and derangements computed it), and \varphi(n) takes the place of p - 1.
Intuition
Take p = 7 and a = 3, and multiply each of 1, 2, \dots, 6 by 3:
The remainders are 1 to 6 again, in a new order. So the products of the two lists agree modulo 7. The first product is 3^6 \cdot 6! and the second is 6!, so
Since 7 \nmid 6!, the 6! may be cancelled, leaving 3^6 \equiv 1 \pmod{7}. Indeed 3^6 = 729 = 104 \cdot 7 + 1. Nothing here used 3 or 7 beyond two facts: no multiple k \cdot 3 with 1 \le k \le 6 is 0 modulo 7, and no two of them agree. A prime modulus gives both facts for every a it does not divide.
Results
Throughout, p is a prime.
Theorem 1 (Fermat’s little theorem). If p \nmid a, then a^{p-1} \equiv 1 \pmod{p}. For every integer a, a^p \equiv a \pmod{p}.
Lemma 2 (cancellation). If \gcd(c, n) = 1 and cx \equiv cy \pmod{n}, then x \equiv y \pmod{n}. This is Theorem 3 of Modular inverses and linear congruences, proved there.
Lemma 3. For 0 < k < p, p \mid \binom{p}{k}.
Corollary 4 (reducing the exponent). If p \nmid a and e, f are whole numbers with e \equiv f \pmod{p - 1}, then a^e \equiv a^f \pmod{p}. The order of a modulo p (the least t \ge 1 with a^t \equiv 1) divides p - 1.
Corollary 5 (inverse as a power). If p \nmid a, then a \cdot a^{p-2} \equiv 1 \pmod{p}, so a^{p-2} is an inverse of a modulo p.
Corollary 6 (Fermat test). Let n \ge 2. If some integer a with n \nmid a has a^{n-1} \not\equiv 1 \pmod{n}, then n is composite.
Theorem 7 (Euler’s theorem). If n \ge 1 and \gcd(a, n) = 1, then a^{\varphi(n)} \equiv 1 \pmod{n}.
Why it is true
Euclid’s lemma and the coprime factor lemma used below are proved in Bezout's identity and the extended Euclidean algorithm.
First proof of Theorem 1 (rearrangement). Suppose p \nmid a, and look at a, 2a, \dots, (p-1)a. None is 0 modulo p: if p \mid ka then by Euclid’s lemma p \mid k or p \mid a, and p \nmid k because 1 \le k \le p - 1. No two agree: \gcd(a, p) = 1, since the only positive divisors of p are 1 and p, so ia \equiv ja gives i \equiv j by Lemma 2, and two numbers from 1 to p - 1 that are congruent modulo p are equal. So the remainders of the p - 1 multiples are p - 1 different numbers from \{1, \dots, p - 1\}, which is all of them. Multiplying the two lists and using the multiplication rule,
Each factor of (p-1)! is below p, so by Euclid’s lemma (extended to many factors) p \nmid (p-1)!, and \gcd((p-1)!, p) = 1. Lemma 2 cancels it: a^{p-1} \equiv 1. Multiplying by a gives a^p \equiv a, which also holds when p \mid a because both sides are 0. \square
Proof of Lemma 3. \binom{p}{k} counts the k-element subsets of a p-element set, so it is an integer, and \binom{p}{k} \cdot k! \, (p-k)! = p! (Combinations). The prime p divides p!. Every factor of k! and of (p-k)! lies between 1 and p - 1, so by Euclid’s lemma p divides neither. Euclid’s lemma applied to the left side then gives p \mid \binom{p}{k}. \square
Second proof of Theorem 1 (induction). First let a \ge 0 and induct on a (Proof by induction). For a = 0, 0^p = 0. Suppose a^p \equiv a. By the binomial theorem (The binomial theorem),
Each middle term is a multiple of p by Lemma 3, so (a+1)^p \equiv a^p + 1 \equiv a + 1. That proves a^p \equiv a for all a \ge 0. A negative a is congruent to r = a \bmod p \ge 0, so a^p \equiv r^p \equiv r \equiv a by Corollary 4 of Congruence modulo n and its arithmetic. If p \nmid a, then a \cdot a^{p-1} \equiv a \cdot 1 and Lemma 2 cancels a. \square
Proof of Corollary 4. Say e \ge f, so e = f + (p-1)m with m \ge 0. Then a^e = a^f (a^{p-1})^m, which is \equiv a^f \cdot 1^m = a^f. The exponents e with a^e \equiv 1 are exactly the multiples of the order (Powers modulo n), and p - 1 is one. \square
Corollary 5 is Theorem 1 with a^{p-1} written as a \cdot a^{p-2}, and Corollary 6 is the contrapositive of Theorem 1 (A conditional and its contrapositive), since a number n \ge 2 that is not prime is composite.
Proof of Theorem 7. For n = 1 every congruence holds. Let n \ge 2 and let r_1, \dots, r_k be the integers from 1 to n coprime to n, so k = \varphi(n). Let s_i be the remainder of a r_i. If a prime q divided both s_i and n, it would divide a r_i, which is s_i plus a multiple of n, so by Euclid’s lemma q \mid a or q \mid r_i, against \gcd(a, n) = \gcd(r_i, n) = 1. So s_i is coprime to n, and s_i \ne 0 because \gcd(0, n) = n > 1. Each s_i is therefore one of the r_j, and the s_i are different by Lemma 2. They are the r_j rearranged, so with R = r_1 \cdots r_k, a^k R \equiv R \pmod{n}. By the same prime argument \gcd(R, n) = 1, and Lemma 2 cancels R. \square
When n = p is prime, \varphi(p) = p - 1 and the proof is the first proof of Theorem 1.
Worked examples
Day 1, Example 1: an exponent reduced modulo p minus 1
Find 7^{222} \bmod 11.
Solution11 is prime and 11 \nmid 7, so 7^{10} \equiv 1 \pmod{11}. Divide the exponent by 10: 222 = 10 \cdot 22 + 2. Then
So 7^{222} \bmod 11 = 5. Without the theorem this would take repeated squaring through eight binary digits.
Day 1, Example 2: an exponent that is itself a power
Find 5^{10^{10}} \bmod 7.
SolutionBy Corollary 4 the exponent only matters modulo 6. Now 10 \equiv 4 \pmod{6}, and 4 \cdot 4 = 16 \equiv 4 \pmod{6}, so every positive power of 4 is 4 modulo 6. Hence 10^{10} \equiv 4^{10} \equiv 4 \pmod{6}, and
So 5^{10^{10}} \bmod 7 = 2. The exponent has eleven digits and was never handled whole.
Day 1, Example 3: a divisibility claim for every integer
Prove that 42 \mid n^7 - n for every integer n.
SolutionSince 42 = 2 \cdot 3 \cdot 7, show each of these primes divides n^7 - n.
Proof. For 7: Theorem 1 with p = 7 gives n^7 \equiv n \pmod{7}. For 3: Theorem 1 gives n^3 \equiv n \pmod{3}, so n^7 = (n^3)^2 \cdot n \equiv n^2 \cdot n = n^3 \equiv n. For 2: n^2 \equiv n \pmod{2}, so n^7 = (n^2)^3 \cdot n \equiv n^3 \cdot n = (n^2)^2 \equiv n^2 \equiv n. Now let m = n^7 - n. From 2 \mid m, m = 2k. Then 3 \mid 2k with \gcd(3, 2) = 1, so 3 \mid k by the coprime factor lemma, k = 3j and m = 6j. Then 7 \mid 6j with \gcd(7, 6) = 1, so 7 \mid j, and 42 \mid m. \square
Day 2, Example 4: an inverse as a power
Find an inverse of 5 modulo 23 as a power of 5, and use it to solve 5x \equiv 7 \pmod{23}.
SolutionAn inverse of 5 is a number b with 5b \equiv 1 (Modular inverses and linear congruences). By Corollary 5, b = 5^{21} works. Square and reduce: 5^2 = 25 \equiv 2, 5^4 \equiv 4, 5^8 \equiv 16, 5^{16} \equiv 256 = 11 \cdot 23 + 3 \equiv 3. Since 21 = 16 + 4 + 1,
Check: 5 \cdot 14 = 70 = 3 \cdot 23 + 1. Multiplying 5x \equiv 7 by 14 gives x \equiv 98 = 4 \cdot 23 + 6, so x \equiv 6 \pmod{23}; indeed 5 \cdot 6 = 30 \equiv 7.
Day 2, Example 5: a composite number caught without a factor
Ejiro computes 2^{340} \bmod 341 and gets 1, the answer a prime would give. Confirm this, then use the base 3 to prove that 341 is composite.
Solution2^{10} = 1{,}024 = 3 \cdot 341 + 1, so 2^{10} \equiv 1 and 2^{340} = (2^{10})^{34} \equiv 1 \pmod{341}. Ejiro is right, and base 2 proves nothing.
For base 3, 340 = 256 + 64 + 16 + 4. The squares modulo 341: 3^2 = 9, 3^4 = 81, 3^8 \equiv 6{,}561 - 19 \cdot 341 = 82, 3^{16} \equiv 82^2 = 6{,}724 \equiv 245, and 3^{32} \equiv 245^2 = 60{,}025, and 60{,}025 = 176 \cdot 341 + 9. That is 3^2 again, so the squares repeat from there: 3^{64} \equiv 81, 3^{128} \equiv 82, 3^{256} \equiv 245. Then
So 3^{340} \equiv 56 \pmod{341}, which is not 1, and 341 \nmid 3. By Corollary 6, 341 is composite. The test did not say how it factors; trial division finds 341 = 11 \cdot 31.
Day 2, Example 6: a composite that every coprime base passes
Show that 561 is composite, yet a^{560} \equiv 1 \pmod{561} for every a with \gcd(a, 561) = 1.
Solution561 = 3 \cdot 11 \cdot 17. Let \gcd(a, 561) = 1; then none of 3, 11, 17 divides a. Theorem 1 gives a^2 \equiv 1 \pmod{3}, a^{10} \equiv 1 \pmod{11} and a^{16} \equiv 1 \pmod{17}. Since 560 = 2 \cdot 280 = 10 \cdot 56 = 16 \cdot 35, raising each to the matching power gives a^{560} \equiv 1 modulo 3, 11 and 17. So the three distinct primes all divide m = a^{560} - 1, and the coprime factor argument of Example 3 gives 561 \mid m.
So no base coprime to 561 exposes it; only a base sharing a factor does, such as a = 3, where 3 \mid 3^{560} forces 3^{560} \not\equiv 1. A composite n with a^{n-1} \equiv 1 \pmod{n} for every a coprime to n is a Carmichael number. Testing every composite below 561 by machine shows that 561 is the smallest one. That there are infinitely many was proved in 1994; we state it without proof.
Day 2, Example 7: Euler’s theorem for the last two digits
Find the last two digits of 3^{1003}.
SolutionThe last two digits are the remainder modulo 100, which is not prime, so use Theorem 7. Since 100 = 2^2 \cdot 5^2, the integers coprime to 100 are those divisible by neither 2 nor 5, and \displaystyle \varphi(100) = 100 \cdot \frac{1}{2} \cdot \frac{4}{5} = 40. As \gcd(3, 100) = 1, 3^{40} \equiv 1, and 1003 = 40 \cdot 25 + 3 gives
The last two digits are 27. Here 3^{10} = 59{,}049 \equiv 49 and 49^2 = 2{,}401 \equiv 1, so the order of 3 divides 20 but not 10, leaving 4 or 20; as 3^4 = 81, it is 20: Euler’s exponent is a multiple of the order, not always the order.
Boundaries
- The modulus must be prime. Modulo 4, 3^3 = 27 \equiv 3, not 1. Lemma 3 fails too: \binom{4}{2} = 6 and 4 \nmid 6.
- The first form needs p \nmid a. 7^6 \equiv 0 \pmod{7}. The second form a^p \equiv a has no such condition.
- The converse is false. a^{n-1} \equiv 1 \pmod{n} does not make n prime: 2^{340} \equiv 1 \pmod{341} with 341 composite, and a Carmichael number passes for every coprime base. Only a failure proves something.
- p - 1 is a multiple of the order, not the order. 3^3 = 27 \equiv 1 \pmod{13}, well before 3^{12}. Reducing exponents modulo p - 1 is always allowed when p \nmid a, but a smaller period may exist.
- Euler’s theorem needs \gcd(a, n) = 1. 2^{\varphi(10)} = 2^4 = 16 \equiv 6 \pmod{10}.
Where this goes next
Euler’s theorem with n a product of two large primes is the reason RSA public-key encryption unlocks what it locks. The order of a dividing p - 1 is the first step toward the structure of the powers modulo a prime, and the Fermat test, strengthened so that Carmichael numbers cannot fool it, is how large primes are found in practice.
Exercises
Day 1: computing with the theorem
- Find 2^{100} \bmod 13.
- Find 6^{1000} \bmod 19.
- Find 12^{12345} \bmod 7.
- Find 9^{3^{50}} \bmod 13.
- Find the remainder of 1^{10} + 2^{10} + \dots + 10^{10} on division by 11.
- Check Lemma 3 for p = 11 by listing \binom{11}{k} for 0 < k < 11, and show that it fails for \binom{9}{3}.
Day 1: proofs
- Prove that 2730 \mid n^{13} - n for every integer n. (2730 = 2 \cdot 3 \cdot 5 \cdot 7 \cdot 13.)
- Prove that (a + b)^p \equiv a^p + b^p \pmod{p} for every prime p and all integers a, b.
- Let p be an odd prime with p \nmid a. Prove that a^{(p-1)/2} \equiv 1 or a^{(p-1)/2} \equiv -1 \pmod{p}.
- Modulo 8, list the remainders of a, 2a, \dots, 7a for a = 3 and for a = 2. Say which step of the rearrangement proof breaks in each case, and find 3^7 \bmod 8.
- Prove 2^p \equiv 2 \pmod{p} for a prime p directly from Lemma 3, using 2 = 1 + 1.
Day 2: inverses and compositeness
- Find an inverse of 3 modulo 17 by computing 3^{15} \bmod 17.
- Solve 4x \equiv 9 \pmod{19} using Corollary 5.
- Compute 2^{90} \bmod 91 and say what it proves about 91.
- Show that 1105 = 5 \cdot 13 \cdot 17 is a Carmichael number.
- Use the base 2 to prove that 15 is composite.
Day 2: Euler’s theorem
- Find 3^{2023} \bmod 20 using \varphi(20).
- Find 5^{1001} \bmod 36 using \varphi(36).
- List the integers from 1 to 12 coprime to 12, multiply each by 5 modulo 12, and check Euler’s theorem for a = 5. What smaller exponent already gives 1 for all four?
Reasoning
- Prove that if n \ge 2 is composite and q is a prime factor of n, then q^{n-1} \not\equiv 1 \pmod{n}.
- Prove that the order of 2 modulo 13 is 12, testing only the divisors of 12.
- Let p \ne q be primes and \gcd(a, pq) = 1. Prove from Theorem 1 alone that a^{(p-1)(q-1)} \equiv 1 \pmod{pq}.
Answers
- 3. 2^{12} \equiv 1 and 100 = 12 \cdot 8 + 4, so 2^{100} \equiv 2^4 = 16 \equiv 3.
- 6. 1000 = 18 \cdot 55 + 10, so 6^{1000} \equiv 6^{10}. 6^2 = 36 \equiv -2, 6^8 \equiv (-2)^4 = 16 \equiv -3, so 6^{10} \equiv (-3)(-2) = 6.
- 6. 12 \equiv 5 and 12345 = 6 \cdot 2057 + 3, so the power is \equiv 5^3 = 125 = 17 \cdot 7 + 6.
- 1. 3^{50} = 9^{25} and 9^2 = 81 \equiv 9 \pmod{12}, so 3^{50} \equiv 9 \pmod{12}. By Corollary 4 the power is \equiv 9^9, and 9^3 = 729 = 56 \cdot 13 + 1 gives 9^9 \equiv 1.
- 10. Each k from 1 to 10 has 11 \nmid k, so k^{10} \equiv 1, and the sum is \equiv 10.
- The values are 11, 55, 165, 330, 462 and then the same five in reverse, all multiples of 11. But \binom{9}{3} = 84 = 9 \cdot 9 + 3: with 9 composite, the factor 3 of 9 sits in 3! and 6!, and Euclid’s lemma does not apply.
- Proof. Let p be one of 2, 3, 5, 7, 13; then p - 1 is 1, 2, 4, 6 or 12, a divisor of 12. If p \mid n, both n^{13} and n are 0 modulo p. Otherwise n^{p-1} \equiv 1, so n^{12} = (n^{p-1})^{12/(p-1)} \equiv 1 and n^{13} \equiv n. The five distinct primes all divide n^{13} - n, and applying the coprime factor lemma one prime at a time, as in Example 3, gives 2730 \mid n^{13} - n. \square
- Proof. By Theorem 1, (a + b)^p \equiv a + b, a^p \equiv a and b^p \equiv b, so (a+b)^p \equiv a + b \equiv a^p + b^p. \square
- Proof. Let x = a^{(p-1)/2}, an integer power since p is odd. Then x^2 = a^{p-1} \equiv 1, so p \mid (x - 1)(x + 1), and by Euclid’s lemma p \mid x - 1 or p \mid x + 1. \square
- a = 3: 3, 6, 1, 4, 7, 2, 5, a rearrangement of 1 to 7 (as \gcd(3, 8) = 1), so 3^7 \cdot 7! \equiv 7!. But 7! = 5{,}040 = 630 \cdot 8 \equiv 0, so it cannot be cancelled; indeed 3^2 = 9 \equiv 1 gives 3^7 \equiv 3. a = 2: 2, 4, 6, 0, 2, 4, 6, which hits 0 and repeats, because \gcd(2, 8) \ne 1.
- Proof. 2^p = (1 + 1)^p = \sum_{k=0}^{p} \binom{p}{k} by the binomial theorem. The terms k = 0 and k = p are 1 each, and every other term is a multiple of p by Lemma 3, so 2^p \equiv 2. \square
- 6. 3^4 = 81 \equiv -4, 3^8 \equiv 16 \equiv -1, so 3^{15} = 3^8 \cdot 3^4 \cdot 3^2 \cdot 3 is \equiv (-1)(-4)(9)(3) = 108 \equiv 6. Check: 3 \cdot 6 = 18 \equiv 1.
- x \equiv 7 \pmod{19}. The inverse of 4 is 4^{17}: 4^2 \equiv -3, 4^4 \equiv 9, 4^8 \equiv 81 \equiv 5, 4^{16} \equiv 25 \equiv 6, 4^{17} \equiv 24 \equiv 5. Then x \equiv 5 \cdot 9 = 45 \equiv 7; check 4 \cdot 7 = 28 \equiv 9.
- 64. 90 = 64 + 16 + 8 + 2; squares of 2 modulo 91: 2, 4, 16, 256 \equiv 74, 74^2 \equiv 16, 74, 16 for 2^1 to 2^{64}. Then 2^{90} \equiv 16 \cdot 16 \cdot 74 \cdot 4; 16 \cdot 16 \equiv 74, 74 \cdot 74 \equiv 16, 16 \cdot 4 = 64. Since 64 \ne 1 and 91 \nmid 2, Corollary 6 proves 91 composite.
- 1105 is composite. If \gcd(a, 1105) = 1, Theorem 1 gives a^4 \equiv 1 \pmod{5}, a^{12} \equiv 1 \pmod{13}, a^{16} \equiv 1 \pmod{17}. As 1104 = 4 \cdot 276 = 12 \cdot 92 = 16 \cdot 69, a^{1104} \equiv 1 modulo each prime, and as in Example 6, 1105 \mid a^{1104} - 1.
- 2^4 = 16 \equiv 1 \pmod{15}, so 2^{14} = (2^4)^3 \cdot 2^2 \equiv 4, not 1, and 15 \nmid 2. By Corollary 6, 15 is composite.
- 7. \displaystyle \varphi(20) = 20 \cdot \frac{1}{2} \cdot \frac{4}{5} = 8, 2023 = 8 \cdot 252 + 7, and 3^7 = 2{,}187 \equiv 7.
- 29. 36 = 2^2 \cdot 3^2, so \displaystyle \varphi(36) = 36 \cdot \frac{1}{2} \cdot \frac{2}{3} = 12, and \gcd(5, 36) = 1. As 1001 = 12 \cdot 83 + 5, 5^{1001} \equiv 5^5 = 3{,}125 = 86 \cdot 36 + 29.
- The integers are 1, 5, 7, 11, so \varphi(12) = 4. Times 5: 5, 25 \equiv 1, 35 \equiv 11, 55 \equiv 7, the same four rearranged, and 5^4 = 625 = 52 \cdot 12 + 1. Exponent 2 already works: 1, 25, 49, 121 are all \equiv 1.
- Proof. Suppose q^{n-1} \equiv 1 \pmod{n}. Then n \mid q^{n-1} - 1, and q \mid n, so q \mid q^{n-1} - 1. Since n - 1 \ge 1, q \mid q^{n-1}, so q divides the difference 1, which is impossible. \square
- Proof. By Corollary 4 the order divides 12, so it is 1, 2, 3, 4, 6 or 12. Now 2^1 = 2, 2^2 = 4, 2^3 = 8, 2^4 = 16 \equiv 3, 2^6 = 64 \equiv 12, none 1, so the order is 12. \square
- Proof. p \nmid a, so a^{p-1} \equiv 1 \pmod{p}, so (a^{p-1})^{q-1} \equiv 1 \pmod{p}. Likewise modulo q. So p \mid m and q \mid m for m = a^{(p-1)(q-1)} - 1: m = pk, q \mid pk with \gcd(q, p) = 1, so q \mid k and pq \mid m. \square