Prime Numbers

100 Chapter 2 NUMBER-THEORETICAL TOOLS
such square roots, both computationally efficient but raising different issues
of implementation.
The first algorithm starts from Euler’s test (2.6). If the prime p is 3 (mod 4)
and
a
t
p = 1, then Euler’s test says that a ≡ 1(modp), where t =(p− 1)/2.
Then at+1 ≡ a (mod p), and as t + 1 is even in this case, we may take for
our square root x ≡ a (t+1)/2 (mod p). Surely, this delightfully simple solution
to the square root problem can be generalized! Yes, but it is not so easy. In
general, we may write p − 1=2st,withtodd. Euler’s test (2.6) guarantees
us that a2s−1t ≡ 1(modp), but it does not appear to say anything about
A = at (mod p).
Well, it does say something; it says that the multiplicative order of A
modulo p is a divisor of 2s−1 . Suppose that d is a quadratic nonresidue modulo
p, andletD = dt mod p. Then Euler’s test (2.6) says that the multiplicative
order of D modulo p is exactly 2s ,sinceD2s−1 ≡ −1(modp). The same
is true about D −1 (mod p), namely, its multiplicative order is 2 s . Since the
multiplicative group Z ∗ p is cyclic, it follows that A is in the cyclic subgroup
generated by D −1 , and in fact, A is an even power of D −1 ,thatis,A ≡ D −2µ
(mod p) for some integer µ with 0 ≤ µ