Choosing Numbers for the Properties of Their

Squares
Michael de Mare
Computer Science Department
SUNY Institute of Technology
Abstract
This paper investigates the properties of certain numbers modulus
a composite whose quadratic residues can be predicted. A structure
is presented that allows minimums to be taken over the set of these
numbers.
1 Introduction
An interesting question in number theory is whether you can put a bound on
the quadratic residue of a number based on some other property. Our results
indicate that, for

n
2
numbers you can. The numbers we work with are the
ceilings of multiples of the square root of n, ¸k

n|. A simple bound on the
square of this number is 2k

n.
The next question is whether we can compute ¸k

n|
2
without computing
the square, ie, whether there is another formula for computing this value. The
answer is yes, and it is based on a function with predictable properties. We
call this the Delta-function.
2 Notation
Convention 1 Z is the set of integers. Z
k
is the set of integers formed by
modulus k. Z

k
is the group formed using modulus k, ie. Z
k
with all numbers
(C) Copyright 2004 SUNY Institute of Technology
This technical report was written in the course of research for a thesis.
1
divisible by factors of k removed. A discussion of group theory is beyond the
scope of this paper.[1][2]
Convention 2 i, j, k ∈ Z We use these variables when we wish to denote
integers in this paper. These values are generally understood to either hold
any integer, or to be counters through a range of integers.
Convention 3 We use x, y ∈ 1 together to define Cartesian coordinates or
seperately as real numbers. In this paper, when Cartesian coordinates are
used x ∈ Z, y ∈ 1. x and y are used as variables in this paper. x by itself
is used as an unknown or a function input, while when used together, they
represent Cartesian coordinates for a point on a plane.
Convention 4 n ∈ Z
+
is the positive integer we want to factor.
Convention 5 ¸x| ∈ Z, x ∈ 1 is the ceiling function. ¸x| is the floor
function. These are used to find the minimum integer i such that x ≤ i and
the maximum integer j such that x ≥ j respectively.
Convention 6 f(x) = O(g(x)) if there exists constants c > 0 and X such
that f(x) ≤ cg(x) for all x ≥ X.[1] [2]
Convention 7 (a, b) is the set of all numbers a < x < b. [a, b] is the set of
all numbers a ≤ x ≤ b. [3]
Convention 8 A point is defined as a pair of numbers x, y written (x, y).
Convention 9 In this paper ∆z for some z ∈ 1 means the change in z. We
use the variable δ to signify a difference.
Convention 10 When we indicate (mod n), we are invoking the modulus
function, which means that we use the remainder after division by n.
Convention 11 We define the slope s to be the slope of a line, calculated
from two points as follows. s =
y
2
−y
1
x
2
−x
1
Convention 12 φ(n) is the size of the group formed by n. This is the num-
ber to compute modulus of when dealing with exponents in Z

n
and given φ(n)
it is trivial to factor n. [1][2]
2
Convention 13 D is the vector of lengths along the X axis of lines. It’s
members are denoted d
0
, d
1
. . .
Convention 14 D is the vector of offsets on the X axis of lines. It’s mem-
bers are denoted v
0
, v
1
. . .
Convention 15 Q is an integer vector of divisors for the clipping function.
C is an integer vector of offsets for the clipping function.
3 The Delta-Function
The key insight is that there exists a correlation between the square of the
number immediately following the multiple of the root and the small real
value which is the difference between the multiple of the root and the root
itself. This relationship allows us to select numbers based on what the prop-
erties of their squares without computing the square itself. If there is a
structure in the value of this difference, which we shall show later that there
is, then we have a structure for choosing the squares.
First let us define this difference so that we have something to work with.
Definition 1 δ
n
(i)
We will define a function called the delta function:
δ
n
(i) = (¸i

n| −i

n)
Now we need to show that there is a relationship between δ
n
(i) and
¸i

n|
2
. We will prove this by induction. In the proof we also find a scaling
factor that allows us to efficiently compare the squares against one another
without actually computing them.
Theorem 1 Proportionality of δ
n
(i) to ¸i

n|
2
(mod n)
δ
n
(i) increases as (¸i

n|mod n)
2
increases.
Pf: For our base step we have the case δ
n
(i) = (¸i

n| − i

n) = 0 This
is trivially true if i = 0 or n is a perfect square.
¸i

n|
2
= (i

n)
2
= i
2
n = 0mod n
Inductive step: Keep n constant, let i vary. For δ = ¸i

n|−i

n. We assume
that for each δ

< δ resulting in an increase of one then δ

must equal zero, so
the change in the square is 1. Then consider how δ varies if ¸i

n|
2
mod n is
3
one larger. If this is not a relevant quadratic residue, we can consider the next
relevant quadratic residue and scale appropriately. We then use the binomial
theorem [4] on δ
2
+2i

nδ = 1 to compute ∆δ = −i

n +

(i

n)
2
+ 1 This
is a small positive number, so δ has increased. The alternative root can not
be true, as δ ∈ [0, 1) and the difference would be too large. Since δ is defined
by i, it trivially covers all i <

n ∈ Z.//
The underlying idea of this proof is to carve up the space between zero
and one into tiny pieces and show that if we move to the next piece, the
square increases by one. The proof shows the size of the tiny pieces. This
makes δ
n
i a discrete value and allows us to map it to the square mod n.
The real function we are tring to optimize:
¸i

n|
2
is very regular and periodic, as we can see in a graph of it for RSA576 (below).
This helps us understand why we can minimize the delta function by finding
a set of periods.
0
2e+88
4e+88
6e+88
8e+88
1e+89
1.2e+89
1.4e+89
0 20 40 60 80 100 120 140 160 180 200
(ceil(i*sqrt(n)))^2 mod n for n=RSA576
4
4 First Order Properties
The delta-function expresses a line. Actually, since the line goes to zero
everytime it intercepts a one (or vice-vera), it represents a series of parallel
lines. We demonstrate this by showing that there
Theorem 2 ∀n∃s : ∀δ
n
(i) ∈ Z > 2, δ
n
(i−1), δ
n
(i)−y
n
(i−1) = s∨δ
n
(i)+1−
δ
n
(i−1) = s if s > 0 else δ
n
(i)−1−δ
n
(i−1) = s where δ
n
(j) = ¸j

n|−j

n
and s ∈ [−1, 1].
Pf. Let δ
n
(k) = ¸k

n| −k

n. δ
n
(k) −δ
n
(k −1) = ¸(k)

n| −(k)

n −
¸(k −1)

n| −(k −1)

n. This is ¸(k)

n| −¸(k −1)

n| −

n.
= ¸k

n| −¸k

n −k

n| −(k −1)

n = ¸k

n| −¸(k −1)

n| +¸(k −
1)

n| − (k − 1)

n or ¸k

n| − ¸(k − 1)

n| + ¸k

n| − (k − 1)

n − 1.
This is

n − ¸

n| or

n − ¸

n| + 1 which is a constant function of

n,
which is constant. Therefore δ
n
(k)−δ
n
(k−1) is constant except where zero is
intersected between k−1, k, in these cases one needs to be added or subtracted
depending on the direction of the slope. Furthermore, s ∈ [−1, 1] because the
difference between the ceiling of a number and a number can not exceed one.//
What this proof shows is that there is a constant slope, except at the
discontinous points where δ
n
(i) intercept zero or one. This means that we
are dealing with a sequence of parallel lines. Later, in the algorithm, we will
be interested in the lowest value for these lines for which k is an integer. We
can show that this will make another sequence of parallel lines.
The proof further shows that the slope is in [0, 1]. This is because the
proof finds the slope to be

n − ¸

n| or

n − ¸

n| + 1. We get the +1
because we a adding to numbers in [0,1] and the sum may exceed one but
will never exceed two. Therefore the lines will have more than one point in
them and be usable.
Here is an example of the delta function on the RSA-576 challenge num-
ber.
5
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
0 5 10 15 20 25 30 35 40 45 50
First order delta function for RSA-576
Theorem 3 Derived Lines
The minimum point of each line such that δ
n
(i) is an integer forms an-
other set of parallel lines.
Pf: The horizontal length of the lines remains constant and the slope
remains constant. Therefore the change in δ
n
(i) is a constant. Now we
expand the horizontal length to cover a line segment. The vertical distance
will still be a constant therefore the new slope is a constant. //
These meta parallel lines will wrap around at a value less than one. This
value can be computed by first finding two points on the line, and computing
the slope. Then we find a point on the next line and determine that line
by the point slope method. Finally we compute the line between a point on
each line and compute what x would have to be to make y zero and take the
absolute value as the distance the line travels on x. The maximum y can be
computed from this and the slope.
Now we have a relationship that allows us to predict the value of δ
n
(i).
We will be able to use this relationship to select out a large group of i with
small values of δ
n
(i). This gives us a shot at either finding a perfect square
or a collision. This is because ¸i

n|
2
will be a small number which improves
6
our odds. We will deal with just how much the odds are improved in the
analysis of the algorithm.
There are really two sets of lines, we want to take the lines whose slope
has the lesser absolute value, as you can see in the graph of the derived lines
for RSA-576. This is why you will see algorithms which need to compute the
slope choosing among two of them based on the absolute value.
7
0
0.05
0.1
0.15
0.2
0.25
0.3
0.35
0.4
0 20 40 60 80 100 120 140
Second Order lines function for RSA-576
0
0.02
0.04
0.06
0.08
0.1
0.12
0.14
0.16
0.18
0 50 100 150 200 250 300
Third Order lines function for RSA-576
8
5 nth Order Properties
What is interesting, for the purpose of choosing good candidates to be the
other root of perfect squares, are values of i such that δ
n
(i) are local min-
imums. For any set of values of i, o, such that the function f : o →
[0, 1), f(x) = δ
n
(x) that forms a series of parallel lines that wraps at zero
and a fixed value of δ
n
(x) we can find the set o

, which is the set composed
of the least value in o for each line, in other words, o

is the set of local
minimums in o.
Theorem 4 If o has the property of forming these parallel lines, then so
will o

.
Pf: (o, f(o)) has a constant slope. Since ∆x is constant and δ
n
(x) is a
multiplication of x by a constant, ∆y is constant. Therefore o

has a constant
slope.//
Since it would be prohibitively expensive to store all the values of o or o

,
we compute, given the first point on o

and the length of the x component of
the lines values on o

. If we want to compute the jth value on o

, we simply
multiply j by the length and add the first point T. We can see by Theorem
4 that o

will have the same property as o.
6 Minimums
Now we have a structure for the delta function that allows us to minimize
it. Using this we can find minimum values for ¸k

n|
2
. The next question
is, what is the minimum going to be on average. This is a very important
question, because if the minimum was O(log n) then it would be possible
to factor n by looking for perfect squares, which are common among small
numbers. Unfortunately, the minimum is not small enough to factor.
Consider the single point ¸

n|
2
. The maximum value for this is going to
be 2

n, so the average value for the point is

n. Since this is a single point,
the average value is also the average minimum.
Consider the set of points k ∈ ¦1 . . .
4

n¦. The average minimum is going
to be:

1
2

2

n
4

n
4

n
=

n
9
As k gets larger, so does 2k

n, so we can safely assume that we are not
going to find a smaller average minimum greater than the one for
4

n which
is

n.
7 Conclusions and Open Problems
This shows a structure in Z

n
that may be useful in predicting some properties
but is probably not sufficient for factoring. Open problems include computing
the average minimum from k ∈ ¦1 . . .
sqrtn
2
¦. Study is also required on higher
roots. It would be surprising, but not completely unexpected if a way of
exploiting this other than trying to get a perfect square were found.
You might note that we might find a way of exploiting the structure by
the following line of reasoning, and this is an important open problem.
We write
¸x

n|
2
= (xδ(x))
2
We can compute x
2
thus we can compute δ(x)
2
by dividing out the x
2
component.
(¸x

n| + z)
2
= ¸x

n + z|
2
= (xδ(x) + z)
2
= (xδ(x))
2
+ 2zxδ(x) + z
2
Using this, we can calculate δ(x)(mod n) =
(¸x

n| + z)
2
−(¸x

n|)
2
−z
2
2xz
(mod n)

¸x

n|
2
x
2
=

¸x

n|
x

2
= δ(x)(mod n)
The consequence of this is that ∀x, z ∈ Z
n
[x > 0, z > 0:
(¸x

n| + z)
2
−(¸x

n|)
2
−z
2
2xz
=
¸x

n|
x
(mod n)
δ(x) =
¸x

n|
x
(mod n)
x
2

n
2
+ 2x

nδ(x) + δ(x)
2
= xδ(x)(mod n)
10
2x

n = (x −1)δ(x)
2
(mod n)

n =
(x −1)δ(x)
2
2x
(mod n)
It should be impossible to represent

n mod n because it is a root of
zero. However, if we overlook that for a minute.
¸x

n| = x(

n + δ(x))(mod n)
=
(x
2
−x)δ(x)
2
2x
+ xδ(x)(mod n)
=
(x −1)δ(x)
2
2
+ xδ(x)(mod n)
= δ(x)

(x −1)δ(x)
2
+ x

(mod n)
For x = 1:¸x

n| = δ(1) mod(n). This is true. We need to verify for
x > 1. Unfortunately, we don’t get a fixed value for

n since non-zero roots
of n are not defined mod n. Instead we have a different

n for each x.
Now we get the equation:
2δ(x)
2

(x −1)δ(x)
2
+ x

+ δ(x)
2
= ¸x

n|
2
mod(n)
References
[1] Eric Bach and Jeffrey Shallit. Algorithmic Number Theory, Volume 1
Efficient Algorithms. MIT Press, Cambridge, Mass., 1997.
[2] Neal Koblitz. A Course in Number Theory and Cryptography. Springer-
Verlag, 1987.
[3] Jerrold E. Marsden. Elementary Classical Analysis. W.H. Freeman and
Company, 1974.
[4] Gilbert Strang. Calculus. Wellesly-Cambridge Press, 1991.
11

y). j. or to be counters through a range of integers. b) is the set of all numbers a < x < b. [1][2] 2 .[1][2] Convention 2 i. Convention 11 We define the slope s to be the slope of a line. In this paper. Convention 5 x ∈ Z. y ∈ R. These values are generally understood to either hold any integer. x ∈ R is the ceiling function.divisible by factors of k removed. Convention 3 We use x. Convention 9 In this paper ∆z for some z ∈ R means the change in z. Convention 6 f (x) = O(g(x)) if there exists constants c > 0 and X such that f (x) ≤ cg(x) for all x ≥ X. x and y are used as variables in this paper. We use the variable δ to signify a difference. while when used together. x by itself is used as an unknown or a function input. These are used to find the minimum integer i such that x ≤ i and the maximum integer j such that x ≥ j respectively. s = x2 −y1 2 −x1 Convention 12 φ(n) is the size of the group formed by n. This is the num∗ ber to compute modulus of when dealing with exponents in Zn and given φ(n) it is trivial to factor n. Convention 4 n ∈ Z + is the positive integer we want to factor. when Cartesian coordinates are used x ∈ Z. we are invoking the modulus function. b] is the set of all numbers a ≤ x ≤ b.[1] [2] Convention 7 (a. calculated y from two points as follows. [3] Convention 8 A point is defined as a pair of numbers x. y written (x. A discussion of group theory is beyond the scope of this paper. Convention 10 When we indicate (mod n). which means that we use the remainder after division by n. [a. they represent Cartesian coordinates for a point on a plane. y ∈ R together to define Cartesian coordinates or seperately as real numbers. x is the floor function. k ∈ Z We use these variables when we wish to denote integers in this paper.

let i vary. It’s members are denoted d0 . √ √ Pf: For our base step we have the case δn (i) = ( i n − i n) = 0 This is trivially true √ i = 0 or n is a perfect square. . It’s members are denoted v0 . . so the change in the square is 1. This relationship allows us to select numbers based on what the properties of their squares without computing the square itself.Convention 13 D is the vector of lengths along the X axis of lines. which we shall show later that there is. Convention 15 Q is an integer vector of divisors for the clipping function. If there is a structure in the value of this difference. C is an integer vector of offsets for the clipping function. We assume that for each δ < δ resulting in an increase of one then δ must√ equal zero. For δ = i n −i n. √ Theorem 1 Proportionality of δn (i) to i n 2 (mod n) √ δn (i) increases as ( i n mod n)2 increases. . Convention 14 D is the vector of offsets on the X axis of lines. then we have a structure for choosing the squares. . Then consider how δ varies if i n 2 mod n is 3 . First let us define this difference so that we have something to work with. 3 The Delta-Function The key insight is that there exists a correlation between the square of the number immediately following the multiple of the root and the small real value which is the difference between the multiple of the root and the root itself. v1 . We will prove this by induction. Definition 1 δn (i) We will define a function called the delta function: √ √ δn (i) = ( i n − i n) √Now we need to show that there is a relationship between δn (i) and i n 2 . if √ 2 i n = (i n)2 = i2 n = 0mod n √ √ Inductive step: Keep n constant. d1 . In the proof we also find a scaling factor that allows us to efficiently compare the squares against one another without actually computing them.

one larger. as δ ∈ [0.// The underlying idea of this proof is to carve up the space between zero and one into tiny pieces and show that if we move to the next piece. This helps us understand why we can minimize the delta function by finding a set of periods. 1. The proof shows the size of the tiny pieces. 1) and the difference would be too large. If this is not a relevant quadratic residue. This makes δn i a discrete value and allows us to map it to the square mod n. we can consider the next relevant quadratic residue and scale appropriately.2e+89 1e+89 8e+88 6e+88 4e+88 2e+88 0 0 20 40 60 80 100 120 140 160 180 200 4 . The alternative root can not be true.4e+89 (ceil(i*sqrt(n)))^2 mod n for n=RSA576 1. the square increases by one. Since δ is defined √ by i. it trivially covers all i < n ∈ Z. as we can see in a graph of it for RSA576 (below). We then use the binomial √ √ √ theorem [4] on δ 2 + 2i nδ = 1 to compute ∆δ = −i n + (i n)2 + 1 This is a small positive number. so δ has increased. The real function we are tring to optimize: √ i n 2 is very regular and periodic.

− √ √ √ This is n − n or n − n + 1 which is a constant function of n. Therefore δn (k)−δn (k −1) is constant except where zero is intersected between k −1. 5 . This is (k)√n − (k − 1) n − √ − n. We demonstrate this by showing that there Theorem 2 ∀n∃s : ∀δn (i) ∈ Z > 2.1] and the sum may exceed one but will never exceed two. Actually. δn (k) − δn (k − 1) = (k) √ − (k) n − n √ √ √ (k − 1) √n − (k √ 1) n. Furthermore. We can show that this will make another sequence of parallel lines. 1]. This means that we are dealing with a sequence of parallel lines. √ √ = k n − k n − k √ − (k − 1) n √ k n √ (k − 1) n √ (k − n = − + √ √ 1) n − (k − 1) n or√ k n √ (k − 1) n + k n − (k − 1) n − 1. it represents a series of parallel lines. We get the +1 because we a adding to numbers in [0. √ √ √ √ Pf.// What this proof shows is that there is a constant slope. since the line goes to zero everytime it intercepts a one (or vice-vera). in the algorithm. which is constant. δn (i−1). 1]. Later. except at the discontinous points where δn (i) intercept zero or one.4 First Order Properties The delta-function expresses a line. k. Here is an example of the delta function on the RSA-576 challenge number. δn (i)−yn (i−1) = s∨δn (i)+1− √ √ δn (i−1) = s if s > 0 else δn (i)−1−δn (i−1) = s where δn (j) = j n −j n and s ∈ [−1. The proof further shows√ that the slope√ in [0. This is because the is √ √ proof finds the slope to be n − n or n − n + 1. 1] because the difference between the ceiling of a number and a number can not exceed one. Let δn (k) = k √n − k n. in these cases one needs to be added or subtracted depending on the direction of the slope. we will be interested in the lowest value for these lines for which k is an integer. s ∈ [−1. Therefore the lines will have more than one point in them and be usable.

This is because i n 2 will be a small number which improves 6 . Pf: The horizontal length of the lines remains constant and the slope remains constant. Now we have a relationship that allows us to predict the value of δn (i).5 0.8 0.4 0.9 0.2 0. The maximum y can be computed from this and the slope.7 0. This value can be computed by first finding two points on the line. We will be able to use this relationship to select out a large group of i with small values of δn (i). Now we expand the horizontal length to cover a line segment. This gives√ a shot at either finding a perfect square us or a collision. Therefore the change in δn (i) is a constant. Finally we compute the line between a point on each line and compute what x would have to be to make y zero and take the absolute value as the distance the line travels on x.1 0 First order delta function for RSA-576 0 5 10 15 20 25 30 35 40 45 50 Theorem 3 Derived Lines The minimum point of each line such that δn (i) is an integer forms another set of parallel lines. Then we find a point on the next line and determine that line by the point slope method.1 0.6 0.3 0. and computing the slope. // These meta parallel lines will wrap around at a value less than one. The vertical distance will still be a constant therefore the new slope is a constant.

as you can see in the graph of the derived lines for RSA-576. we want to take the lines whose slope has the lesser absolute value. This is why you will see algorithms which need to compute the slope choosing among two of them based on the absolute value. There are really two sets of lines.our odds. 7 . We will deal with just how much the odds are improved in the analysis of the algorithm.

06 0.25 0.08 0.35 0.05 0 0.1 0.02 0 0 20 40 60 80 100 120 140 Third Order lines function for RSA-576 0 50 100 150 200 250 300 8 .04 0.3 0.12 0.14 0.1 0.2 0.15 0.16 0.0.18 0.4 Second Order lines function for RSA-576 0.

We can see by Theorem 4 that S will have the same property as S. Using this we can find minimum values for k n 2 . f (x) = δn (x) that forms a series of parallel lines that wraps at zero and a fixed value of δn (x) we can find the set S . Pf: (S. in other words. are values of i such that δn (i) are local minimums. Theorem 4 If S has the property of forming these parallel lines. the average value is also the average minimum. The next question is. which is the set composed of the least value in S for each line. given the first point on S and the length of the x component of the lines values on S .// Since it would be prohibitively expensive to store all the values of S or S . The average minimum is going to be: √ √ 1 2 n4n √ √ = n 4 2 n 9 . If we want to compute the jth value on S . f (S)) has a constant slope. we simply multiply j by the length and add the first point P. 6 Minimums Now we have a structure for the delta function that allows us to minimize √ it. Therefore S has a constant slope. because if the minimum was O(log n) then it would be possible to factor n by looking for perfect squares. which are common among small numbers. For any set of values of i. √ 2 n . then so will S . 1). Since this is a single point. ∆y is constant. such that the function f : S → [0. Unfortunately. . This is a very important question. for the purpose of choosing good candidates to be the other root of perfect squares. we compute. √ Consider the set of points k ∈ {1 . . Since ∆x is constant and δn (x) is a multiplication of x by a constant. S is the set of local minimums in S. so the average value for the point is n. what is the minimum going to be on average. The maximum value for this is going to Consider the single point √ √ be 2 n. S. the minimum is not small enough to factor.5 nth Order Properties What is interesting. 4 n}.

We write √ x n 2 = (xδ(x))2 We can compute x2 thus we can compute δ(x)2 by dividing out the x2 component. √ √ ( x n + z)2 = x n + z 2 = (xδ(x) + z)2 = (xδ(x))2 + 2zxδ(x) + z 2 Using this. so we can safely assume that we are not √ going to find a smaller average minimum greater than the one for 4 n which √ is n. but not completely unexpected if a way of exploiting this other than trying to get a perfect square were found. z > 0: √ √ √ ( x n + z)2 − ( x n )2 − z 2 x n = (mod n) 2xz x √ x n δ(x) = (mod n) x √ 2 √ x2 n + 2x nδ(x) + δ(x)2 = xδ(x)(mod n) 10 . 7 Conclusions and Open Problems ∗ This shows a structure in Zn that may be useful in predicting some properties but is probably not sufficient for factoring.√ As k gets larger. we can calculate δ(x)(mod n) = √ √ ( x n + z)2 − ( x n )2 − z 2 (mod n) 2xz √ x n x2 2 = √ x n x 2 = δ(x)(mod n) The consequence of this is that ∀x. You might note that we might find a way of exploiting the structure by the following line of reasoning. It would be surprising. and this is an important open problem. z ∈ Zn |x > 0. Study is also required on higher 2 roots. Open problems include computing the average minimum from k ∈ {1 . so does 2k n. . sqrtn }. .

However. 1991. [3] Jerrold E. This is true. [2] Neal Koblitz. Instead we have a different n for each x. Elementary Classical Analysis. Wellesly-Cambridge Press. 1974. 1997. Calculus. Now we get the equation: 2δ(x)2 √ (x − 1)δ(x) + x + δ(x)2 = x n 2 2 mod(n) References [1] Eric Bach and Jeffrey Shallit. Algorithmic Number Theory. [4] Gilbert Strang. MIT Press. Cambridge. Volume 1 Efficient Algorithms. SpringerVerlag. 1987. Freeman and Company. A Course in Number Theory and Cryptography. W.√We need to verify for x > 1. we don’t get a fixed value for n since non-zero roots √ of n are not defined mod n.H. √ √ x n = x( n + δ(x))(mod n) (x2 − x)δ(x)2 + xδ(x)(mod n) 2x (x − 1)δ(x)2 = + xδ(x)(mod n) 2 (x − 1)δ(x) = δ(x) + x (mod n) 2 = √ 2x n = (x − 1)δ(x)2 (mod n) √ For x = 1: x n = δ(1) mod(n).. 11 . if we overlook that for a minute. Unfortunately.√ (x − 1)δ(x)2 (mod n) n= 2x √ It should be impossible to represent n mod n because it is a root of zero. Marsden. Mass.