## coNP Hardness and NP Hardness

^{a}

Proposition 46 *If a coNP-hard problem is in NP, then*
*NP = coNP.*

*•* *Let L ∈ NP be coNP-hard.*

*•* *Let NTM M decide L.*

*•* *For any L*^{0}*∈ coNP, there is a reduction R from L*^{0}*to L.*

*•* *L*^{0}*∈ NP as it is decided by NTM M (R(x)).*

– Alternatively, NP is closed under complement.

*•* *Hence coNP ⊆ NP.*

*•* *The other direction NP ⊆ coNP is symmetric.*

aBrassard (1979); Selman (1978).

## coNP Hardness and NP Hardness (concluded)

Similarly,

Proposition 47 *If an NP-hard problem is in coNP, then*
*NP = coNP.*

As a result:

*•* NP-complete problems are unlikely to be in coNP.

*•* coNP-complete problems are unlikely to be in NP.

## The Primality Problem

*•* *An integer p is prime if p > 1 and all positive numbers*
*other than 1 and p itself cannot divide it.*

*•* *primes asks if an integer N is a prime number.*

*•* *Dividing N by 2, 3, . . . ,√*

*N is not efficient.*

– *The length of N is only log N , but* *√*

*N = 2** ^{0.5 log N}*.

*•* A polynomial-time algorithm for primes was not found
until 2002 by Agrawal, Kayal, and Saxena!

*•* We will focus on efficient “probabilistic” algorithms for
*primes (used in Mathematica, e.g.).*

1: *if n = a*^{b}*for some a, b > 1 then*

2: return “composite”;

3: end if

4: *for r = 2, 3, . . . , n − 1 do*

5: *if gcd(n, r) > 1 then*

6: return “composite”;

7: end if

8: *if r is a prime then*

9: *Let q be the largest prime factor of r − 1;*

10: *if q ≥ 4**√*

*r log n and n*^{(r−1)/q}*6= 1 mod r then*

11: *break; {Exit the for-loop.}*

12: end if

13: end if

14: *end for{r − 1 has a prime factor q ≥ 4**√*

*r log n.}*

15: *for a = 1, 2, . . . , 2**√*

*r log n do*

16: *if (x − a)*^{n}*6= (x*^{n}*− a) mod (x*^{r}*− 1) in Z**n**[ x ] then*

17: return “composite”;

18: end if

19: end for

20: *return “prime”; {The only place with “prime” output.}*

## The Primality Problem (concluded)

*•* *NP ∩ coNP is the class of problems that have succinct*
certificates and succinct disqualifications.

– Each “yes” instance has a succinct certificate.

– Each “no” instance has a succinct disqualification.

– No instances have both.

*•* *We will see that primes ∈ NP ∩ coNP.*

– *In fact, primes ∈ P as mentioned earlier.*

## Primitive Roots in Finite Fields

Theorem 48 (Lucas and Lehmer (1927)) ^{a} *A number*
*p > 1 is prime if and only if there is a number 1 < r < p*
*(called the primitive root or generator) such that*

*1.* *r*^{p−1}*= 1 mod p, and*

*2.* *r*^{(p−1)/q}*6= 1 mod p for all prime divisors q of p − 1.*

*•* We will prove the theorem later.

aFran¸cois Edouard Anatole Lucas (1842–1891); Derrick Henry Lehmer (1905–1991).

## Derrick Lehmer (1905–1991)

## Pratt’s Theorem

Theorem 49 (Pratt (1975)) *primes ∈ NP ∩ coNP.*

*•* primes is in coNP because a succinct disqualification is
a divisor.

*•* *Suppose p is a prime.*

*•* *p’s certificate includes the r in Theorem 48 (p. 380).*

*•* *Use recursive doubling to check if r*^{p−1}*= 1 mod p in*
time polynomial in the length of the input, log_{2} *p.*

*•* *We also need all prime divisors of p − 1: q*_{1}*, q*_{2}*, . . . , q** _{k}*.

*•* *Checking r*^{(p−1)/q}^{i}*6= 1 mod p is also easy.*

## The Proof (concluded)

*•* *Checking q*_{1}*, q*_{2}*, . . . , q*_{k}*are all the divisors of p − 1 is easy.*

*•* *We still need certificates for the primality of the q** _{i}*’s.

*•* The complete certificate is recursive and tree-like:

*C(p) = (r; q*_{1}*, C(q*_{1}*), q*_{2}*, C(q*_{2}*), . . . , q*_{k}*, C(q*_{k}*)).*

*•* *C(p) can also be checked in polynomial time.*

*•* *We next prove that C(p) is succinct.*

## The Succinctness of the Certificate

Lemma 50 *The length of C(p) is at most quadratic at*
5 log^{2}_{2} *p.*

*•* *This claim holds when p = 2 or p = 3.*

*•* *In general, p − 1 has k < log*_{2} *p prime divisors*
*q*_{1} *= 2, q*_{2}*, . . . , q** _{k}*.

*•* *C(p) requires: 2 parentheses and 2k < 2 log*_{2} *p separators*
(length at most 2 log_{2} *p long), r (length at most log*_{2} *p),*
*q*_{1} = 2 and its certificate 1 (length at most 5 bits), the
*q** _{i}*’s (length at most 2 log

_{2}

*p), and the C(q*

*)s.*

_{i}## The Proof (concluded)

*•* *C(p) is succinct because*

*|C(p)| ≤ 5 log*_{2} *p + 5 + 5*

X*k*
*i=2*

log^{2}_{2} *q*_{i}

*≤ 5 log*_{2} *p + 5 + 5*

ÃX*k*

*i=2*

log_{2} *q*_{i}

!_{2}

*≤ 5 log*_{2} *p + 5 + 5 log*^{2}_{2} *p − 1*
2

*< 5 log*_{2} *p + 5 + 5(log*_{2} *p − 1)*^{2}

= 5 log^{2}_{2} *p + 10 − 5 log*_{2} *p ≤ 5 log*^{2}_{2} *p*
*for p ≥ 4.*

## A Certificate for 23

^{a}

*•* *As 7 is a primitive root modulo 23 and 22 = 2 × 11, so*
*C(23) = (7, 2, C(2), 11, C(11)).*

*•* *As 2 is a primitive root modulo 11 and 10 = 2 × 5, so*
*C(11) = (2, 2, C(2), 5, C(5)).*

*•* As 2 is a primitive root modulo 5 and 4 = 2^{2}, so
*C(5) = (2, 2, C(2)).*

*•* In summary,

*C(23) = (7, 2, C(2), 11, (2, 2, C(2), 5, (2, 2, C(2)))).*

aThanks to a lively discussion on April 24, 2008.

## Basic Modular Arithmetics

^{a}

*•* *Let m, n ∈ Z*^{+}.

*•* *m|n means m divides n and m is n’s divisor.*

*•* *We call the numbers 0, 1, . . . , n − 1 the residue modulo*
*n.*

*•* *The greatest common divisor of m and n is denoted*
*gcd(m, n).*

*•* *The r in Theorem 48 (p. 380) is a primitive root of p.*

*•* We now prove the existence of primitive roots and then
Theorem 48.

aCarl Friedrich Gauss.

## Euler’s

^{a}

## Totient or Phi Function

*•* Let

*Φ(n) = {m : 1 ≤ m < n, gcd(m, n) = 1}*

*be the set of all positive integers less than n that are*
*prime to n (Z*_{n}* ^{∗}* is a more popular notation).

– *Φ(12) = {1, 5, 7, 11}.*

*•* *Define Euler’s function of n to be φ(n) = |Φ(n)|.*

*•* *φ(p) = p − 1 for prime p, and φ(1) = 1 by convention.*

*•* Euler’s function is not expected to be easy to compute
*without knowing n’s factorization.*

aLeonhard Euler (1707–1783).

Q

I+Q/

### HXOHUSKLQE

## Two Properties of Euler’s Function

The inclusion-exclusion principle^{a} can be used to prove the
following.

Lemma 51 *φ(n) = n* Q

*p|n**(1 −* ^{1}_{p}*).*

*•* *If n = p*^{e}_{1}^{1}*p*^{e}_{2}^{2} *· · · p*^{e}_{t}^{t}*is the prime factorization of n, then*
*φ(n) = n*

Y*t*
*i=1*

µ

*1 −* 1
*p*_{i}

¶
*.*

Corollary 52 *φ(mn) = φ(m) φ(n) if gcd(m, n) = 1.*

a*See my Discrete Mathematics lecture notes.*

## A Key Lemma

Lemma 53 P

*m|n* *φ(m) = n.*

*•* Let Q_{`}

*i=1* *p*^{k}_{i}^{i}*be the prime factorization of n and consider*
Y*`*

*i=1*

*[ φ(1) + φ(p*_{i}*) + · · · + φ(p*^{k}_{i}^{i}*) ].* (4)

*•* *Equation (4) equals n because φ(p*^{k}_{i}*) = p*^{k}_{i}*− p*^{k−1}* _{i}* by
Lemma 51.

*•* Expand Eq. (4) to yield P

*k*^{0}_{1}*≤k*_{1}*,...,k*_{`}^{0}*≤k*_{`}

Q_{`}

*i=1* *φ(p*^{k}_{i}^{0}* ^{i}*).

## The Proof (concluded)

*•* By Corollary 52 (p. 390),
Y*`*

*i=1*

*φ(p*^{k}_{i}^{0}^{i}*) = φ*

Ã * _{`}*
Y

*i=1*

*p*^{k}_{i}^{0}^{i}

!
*.*

*•* Each Q_{`}

*i=1* *p*^{k}_{i}^{0}^{i}*is a unique divisor of n =* Q_{`}

*i=1* *p*^{k}_{i}* ^{i}*.

*•* Equation (4) becomes

X

*m|n*

*φ(m).*

## The Density Attack for primes

## Witnesses to compositeness

*of n*

*All numbers < n*

*•* It works, but does it work well?

## Factorization and Euler’s Function

*•* *The ratio of numbers ≤ n relatively prime to n is*
*φ(n)/n.*

*•* *When n = pq, where p and q are distinct primes,*
*φ(n)*

*n* = *pq − p − q + 1*

*pq* *> 1 −* 1

*q* *−* 1
*p.*

*•* *So the ratio of numbers ≤ n not relatively prime to n is*

*< (1/q) + (1/p).*

– *The “density attack” to factor n = pq hence takes*
Ω(*√*

*n) steps on average when p ∼ q = O(√*
*n ).*

– This running time is exponential: Ω(2^{0.5 log}^{2}* ^{n}*).

## The Chinese Remainder Theorem

*•* *Let n = n*_{1}*n*_{2} *· · · n*_{k}*, where n** _{i}* are pairwise relatively
prime.

*•* *For any integers a*_{1}*, a*_{2}*, . . . , a** _{k}*, the set of simultaneous
equations

*x = a*_{1} *mod n*_{1}*,*
*x = a*_{2} *mod n*_{2}*,*

...

*x = a*_{k}*mod n*_{k}*,*

*has a unique solution modulo n for the unknown x.*

## Fermat’s “Little” Theorem

^{a}

Lemma 54 *For all 0 < a < p, a*^{p−1}*= 1 mod p.*

*•* *Consider aΦ(p) = {am mod p : m ∈ Φ(p)}.*

*•* *aΦ(p) = Φ(p).*

– *aΦ(p) ⊆ Φ(p) as a remainder must be between 0 and*
*p − 1.*

– *Suppose am = am*^{0}*mod p for m > m** ^{0}*, where

*m, m*

^{0}*∈ Φ(p).*

– *That means a(m − m*^{0}*) = 0 mod p, and p divides a or*
*m − m** ^{0}*, which is impossible.

aPierre de Fermat (1601–1665).

## The Proof (concluded)

*•* *Multiply all the numbers in Φ(p) to yield (p − 1)!.*

*•* *Multiply all the numbers in aΦ(p) to yield a*^{p−1}*(p − 1)!.*

*•* *As aΦ(p) = Φ(p), a*^{p−1}*(p − 1)! = (p − 1)! mod p.*

*•* *Finally, a*^{p−1}*= 1 mod p because p 6 |(p − 1)!.*

## The Fermat-Euler Theorem

^{a}

Corollary 55 *For all a ∈ Φ(n), a*^{φ(n)}*= 1 mod n.*

*•* The proof is similar to that of Lemma 54 (p. 396).

*•* *Consider aΦ(n) = {am mod n : m ∈ Φ(n)}.*

*•* *aΦ(n) = Φ(n).*

– *aΦ(n) ⊆ Φ(n) as a remainder must be between 0 and*
*n − 1 and relatively prime to n.*

– *Suppose am = am*^{0}*mod n for m*^{0}*< m < n, where*
*m, m*^{0}*∈ Φ(n).*

– *That means a(m − m*^{0}*) = 0 mod n, and n divides a or*
*m − m** ^{0}*, which is impossible.

aProof by Mr. Wei-Cheng Cheng (R93922108) on November 24, 2004.

## The Proof (concluded)

*•* *Multiply all the numbers in Φ(n) to yield* Q

*m∈Φ(n)* *m.*

*•* *Multiply all the numbers in aΦ(n) to yield*
*a** ^{Φ(n)}* Q

*m∈Φ(n)* *m.*

*•* *As aΦ(n) = Φ(n),*
Y

*m∈Φ(n)*

*m = a*^{Φ(n)}

Y

*m∈Φ(n)*

*m*

* mod n.*

*•* *Finally, a*^{Φ(n)}*= 1 mod n because n 6 |* Q

*m∈Φ(n)* *m.*

## An Example

*•* As 12 = 2^{2} *× 3,*

*φ(12) = 12 ×*
µ

*1 −* 1
2

¶ µ

*1 −* 1
3

¶

= 4

*•* *In fact, Φ(12) = {1, 5, 7, 11}.*

*•* For example,

5^{4} *= 625 = 1 mod 12.*

## Exponents

*•* *The exponent of m ∈ Φ(p) is the least k ∈ Z*^{+} such that
*m*^{k}*= 1 mod p.*

*•* *Every residue s ∈ Φ(p) has an exponent.*

– *1, s, s*^{2}*, s*^{3}*, . . . eventually repeats itself modulo p, say*
*s*^{i}*= s*^{j}*mod p, which means s*^{j−i}*= 1 mod p.*

*•* *If the exponent of m is k and m*^{`}*= 1 mod p, then k|`.*

– *Otherwise, ` = qk + a for 0 < a < k, and*

*m*^{`}*= m*^{qk+a}*= m*^{a}*= 1 mod p, a contradiction.*

Lemma 56 *Any nonzero polynomial of degree k has at most*
*k distinct roots modulo p.*

## Exponents and Primitive Roots

*•* From Fermat’s “little” theorem, all exponents divide
*p − 1.*

*•* *A primitive root of p is thus a number with exponent*
*p − 1.*

*•* *Let R(k) denote the total number of residues in Φ(p)*
*that have exponent k.*

*•* *We already knew that R(k) = 0 for k 6 |(p − 1).*

*•* So P

*k|(p−1)* *R(k) = p − 1 as every number has an*
exponent.

*Size of R(k)*

*•* *Any a ∈ Φ(p) of exponent k satisfies x*^{k}*= 1 mod p.*

*•* *Hence there are at most k residues of exponent k, i.e.,*
*R(k) ≤ k, by Lemma 56 on p. 401.*

*•* *Let s be a residue of exponent k.*

*•* *1, s, s*^{2}*, . . . , s*^{k−1}*are all distinct modulo p.*

– *Otherwise, s*^{i}*= s*^{j}*mod p with i < j.*

– *Then s*^{j−i}*= 1 mod p with j − i < k, a contradiction.*

*•* *As all these k distinct numbers satisfy x*^{k}*= 1 mod p,*
*they are all the solutions of x*^{k}*= 1 mod p.*

*Size of R(k) (continued)*

*•* *But do all of them have exponent k (i.e., R(k) = k)?*

*•* *And if not (i.e., R(k) < k), how many of them do?*

*•* *Suppose ` < k and ` 6∈ Φ(k) with gcd(`, k) = d > 1.*

*•* Then

*(s** ^{`}*)

^{k/d}*= (s*

*)*

^{k}

^{`/d}*= 1 mod p.*

*•* *Therefore, s*^{`}*has exponent at most k/d, which is less*
*than k.*

*•* We conclude that

*R(k) ≤ φ(k).*

*Size of R(k) (concluded)*

*•* *Because all p − 1 residues have an exponent,*
*p − 1 =* X

*k|(p−1)*

*R(k) ≤* X

*k|(p−1)*

*φ(k) = p − 1*

by Lemma 52 on p. 390.

*•* Hence

*R(k) =*

*φ(k) when k|(p − 1)*
0 otherwise

*•* *In particular, R(p − 1) = φ(p − 1) > 0, and p has at least*
one primitive root.

*•* This proves one direction of Theorem 48 (p. 380).

## A Few Calculations

*•* *Let p = 13.*

*•* *From p. 398, we know φ(p − 1) = 4.*

*•* *Hence R(12) = 4.*

*•* *And there are 4 primitives roots of p.*

*•* *As Φ(p − 1) = {1, 5, 7, 11}, the primitive roots are*
*g*^{1}*, g*^{5}*, g*^{7}*, g*^{11} *for any primitive root g.*

## The Other Direction of Theorem 48 (p. 380)

*•* *We must show p is a prime only if there is a number r*
(called primitive root) such that

1. *r*^{p−1}*= 1 mod p, and*

2. *r*^{(p−1)/q}*6= 1 mod p for all prime divisors q of p − 1.*

*•* *Suppose p is not a prime.*

*•* We proceed to show that no primitive roots exist.

*•* *Suppose r*^{p−1}*= 1 mod p (note gcd(r, p) = 1).*

*•* We will show that the 2nd condition must be violated.

## The Proof (concluded)

*•* *r*^{φ(p)}*= 1 mod p by the Fermat-Euler theorem (p. 398).*

*•* *Because p is not a prime, φ(p) < p − 1.*

*•* *Let k be the smallest integer such that r*^{k}*= 1 mod p.*

*•* *Note that k | (p − 1) (p. 401).*

*•* *As k ≤ φ(p), k < p − 1.*

*•* *Let q be a prime divisor of (p − 1)/k > 1.*

*•* *Then k|(p − 1)/q.*

*•* *Therefore, by virtue of the definition of k,*
*r*^{(p−1)/q}*= 1 mod p.*

*•* But this violates the 2nd condition.

## Function Problems

*•* Decisions problem are yes/no problems (sat, tsp (d),
etc.).

*•* Function problems require a solution (a satisfying
truth assignment, a best tsp tour, etc.).

*•* Optimization problems are clearly function problems.

*•* What is the relation between function and decision
problems?

*•* Which one is harder?

## Function Problems Cannot Be Easier than Decision Problems

*•* If we know how to generate a solution, we can solve the
corresponding decision problem.

– If you can find a satisfying truth assignment efficiently, then sat is in P.

– If you can find the best tsp tour efficiently, then tsp (d) is in P.

*•* But decision problems can be as hard as the
corresponding function problems.

## fsat

*•* fsat is this function problem:

– *Let φ(x*_{1}*, x*_{2}*, . . . , x** _{n}*) be a boolean expression.

– *If φ is satisfiable, then return a satisfying truth*
assignment.

– Otherwise, return “no.”

*•* *We next show that if sat ∈ P, then fsat has a*
polynomial-time algorithm.

## An Algorithm for fsat Using sat

1: *t := ²;*

2: *if φ ∈ sat then*

3: *for i = 1, 2, . . . , n do*

4: *if φ[ x*_{i}*= true ] ∈ sat then*
5: *t := t ∪ { x*_{i}*= true };*

6: *φ := φ[ x** _{i}* = true ];

7: else

8: *t := t ∪ { x*_{i}*= false };*

9: *φ := φ[ x** _{i}* = false ];

10: end if
11: end for
12: *return t;*

13: else

14: return “no”;

15: end if

## Analysis

*•* *There are ≤ n + 1 calls to the algorithm for sat.*^{a}

*•* *Shorter boolean expressions than φ are used in each call*
to the algorithm for sat.

*•* So if sat can be solved in polynomial time, so can fsat.

*•* Hence sat and fsat are equally hard (or easy).

aContributed by Ms. Eva Ou (R93922132) on November 24, 2004.

## tsp and tsp (d) Revisited

*•* *We are given n cities 1, 2, . . . , n and integer distances*
*d*_{ij}*= d*_{ji}*between any two cities i and j.*

*•* The tsp asks for a tour with the shortest total distance
(not just the shortest total distance, as earlier).

– The shortest total distance must be at most 2* ^{| x |}*,

*where x is the input.*

*•* tsp (d) asks if there is a tour with a total distance at
*most B.*

*•* *We next show that if tsp (d) ∈ P, then tsp has a*
polynomial-time algorithm.

## An Algorithm for tsp Using tsp (d)

1: *Perform a binary search over interval [ 0, 2** ^{| x |}* ] by calling

*tsp (d) to obtain the shortest distance, C;*

2: *for i, j = 1, 2, . . . , n do*

3: *Call tsp (d) with B = C and d*_{ij}*= C + 1;*

4: if “no” then

5: *Restore d*_{ij}*to old value; {Edge [ i, j ] is critical.}*

6: end if

7: end for

8: *return the tour with edges whose d*_{ij}*≤ C;*

## Analysis

*•* *An edge that is not on any optimal tour will be*
*eliminated, with its d*_{ij}*set to C + 1.*

*•* An edge which is not on all remaining optimal tours will
also be eliminated.

*•* *So the algorithm ends with n edges which are not*
eliminated (why?).

*•* *There are O(| x | + n*^{2}) calls to the algorithm for tsp (d).

*•* So if tsp (d) can be solved in polynomial time, so can
tsp.

*•* Hence tsp (d) and tsp are equally hard (or easy).

## Function Problems Are Not Harder than Decision Problems If P = NP

Theorem 57 *Suppose that P = NP. Then, for every NP*
*language L there exists a polynomial-time TM B that on*
*input x ∈ L outputs a certificate for x.*

*•* We are looking for a certificate in the sense of
Proposition 31 (p. 271).

*•* *That is, a certificate y for every x ∈ L such that*
*(x, y) ∈ R,*

*where R is a polynomially decidable and polynomially*
balanced relation.

## The Proof (concluded)

*•* Recall the algorithm for fsat on p. 412.

*•* *The reduction of Cook’s Theorem L to sat is a Levin*
reduction (p. 275).

*•* *So there is a polynomial-time computable function R*
*such that x ∈ L iff R(x) ∈ sat.*

*•* *In fact, more is true: R maps a satisfying assignment of*
*R(x) into a certificate for x.*

*•* Therefore, we can use the algorithm for fsat to come up
*with an assignment for R(x) and then map it back into*
*a certificate for x.*