Modular arithmetic

In mathematics, modular arithmetic is a system of arithmetic for integers, where numbers "wrap around" upon reaching a certain value—the modulus (plural moduli). The modern approach to modular arithmetic was developed by Carl Friedrich Gauss in his book Disquisitiones Arithmeticae, published in 1801.

A familiar use of modular arithmetic is in the 12-hour clock, in which the day is divided into two 12-hour periods. If the time is 7:00 now, then 8 hours later it will be 3:00. Usual addition would suggest that the later time should be 7 + 8 = 15, but this is not the answer because clock time "wraps around" every 12 hours. Because the hour number starts over after it reaches 12, this is arithmetic modulo 12. According to the definition below, 12 is congruent not only to 12 itself, but also to 0, so the time called "12:00" could also be called "0:00", since 12 is congruent to 0 modulo 12.

Clock group
Time-keeping on this clock uses arithmetic modulo 12.

Definition of congruence relation

Modular arithmetic can be handled mathematically by introducing a congruence relation on the integers that is compatible with the operations on integers: addition, subtraction, and multiplication. For a positive integer n, two numbers a and b are said to be ‹See Tfd› congruent modulo n, if their difference ab is an integer multiple of n (that is, if there is an integer k such that ab = kn). This congruence relation is typically considered when a and b are integers, and is denoted

(some authors use = instead of ; in this case, if the parentheses are omitted, this generally means that "mod" denotes the modulo operation, that is, that 0 ≤ a < n).

The number n is called the ‹See Tfd› modulus of the congruence.

The congruence relation may be rewritten as

explicitly showing its relationship with Euclidean division. However, b need not be the remainder of the division of a by n. More precisely, what the statement ab mod n asserts is that a and b have the same remainder when divided by n. That is,

where 0 ≤ r < n is the common remainder. Subtracting these two expressions, we recover the previous relation:

by setting k = pq.


For example,

because 38 − 14 = 24, which is a multiple of 12, or, equivalently, because both 38 and 14 have the same remainder 2 when divided by 12.

The same rule holds for negative values:

A remark on the notation: Because it is common to consider several congruence relations for different moduli at the same time, the modulus is incorporated in the notation. In spite of the ternary notation, the congruence relation for a given modulus is binary. This would have been clearer if the notation an b had been used, instead of the common traditional notation.


The congruence relation satisfies all the conditions of an equivalence relation:

  • Reflexivity: aa (mod n)
  • Symmetry: ab (mod n) if and only if ba (mod n)
  • Transitivity: If ab (mod n) and bc (mod n), then ac (mod n)

If a1b1 (mod n) and a2b2 (mod n), or if ab (mod n), then:

  • a + kb + k (mod n) for any integer k (compatibility with translation)
  • k ak b (mod n) for any integer k (compatibility with scaling)
  • a1 + a2b1 + b2 (mod n) (compatibility with addition)
  • a1a2b1b2 (mod n) (compatibility with subtraction)
  • a1 a2b1 b2 (mod n) (compatibility with multiplication)
  • akbk (mod n) for any non-negative integer k (compatibility with exponentiation)
  • p(a) ≡ p(b) (mod n), for any polynomial p(x) with integer coefficients (compatibility with polynomial evaluation)

If ab (mod n), then it is false, in general, that kakb (mod n). However, one has:

For cancellation of common terms, we have the following rules:

  • If a + kb + k (mod n) for any integer k, then ab (mod n)
  • If k ak b (mod n) and k is coprime with n, then ab (mod n)

The modular multiplicative inverse is defined by the following rules:

  • Existence: there exists an integer denoted a–1 such that aa–1 ≡ 1 (mod n) if and only if a is coprime with n. This integer a–1 is called a modular multiplicative inverse of a modulo n.
  • If ab (mod n) and a–1 exists, then a–1b–1 (mod n) (compatibility with multiplicative inverse, and, if a = b, uniqueness modulo n)
  • If a xb (mod n) and a is coprime to n, the solution to this linear congruence is given by xa–1b (mod n)

In particular, if p is a prime number then a is coprime with p for every a such that 0 < a < p. Thus, a multiplicative inverse exists for all a that are not congruent to zero modulo p.

Some of the more advanced properties of congruence relations are the following:

  • Fermat's little theorem: If p is prime and does not divide a, then a p – 1 ≡ 1 (mod p)
  • Euler's theorem: If a and n are coprime, then a φ(n) ≡ 1 (mod n), where φ is Euler's totient function
  • A simple consequence of Fermat's little theorem is that if p is prime, then a−1a p − 2 (mod p) is the multiplicative inverse of 0 < a < p. More generally, from Euler's theorem, if a and n are coprime, then a−1a φ(n) − 1 (mod n).
  • Another simple consequence is that if ab (mod φ(n)), where φ is Euler's totient function, then kakb (mod n) provided k is coprime with n
  • Wilson's theorem: p is prime if and only if (p − 1)! ≡ −1 (mod p)
  • Chinese remainder theorem: If xa (mod m) and xb (mod n) such that m and n are coprime, then xb mn–1 m + a nm–1 n (mod mn) where mn−1 is the inverse of m modulo n and nm−1 is the inverse of n modulo m
  • Lagrange's theorem: The congruence f (x) ≡ 0 (mod p), where p is prime, and f (x) = a0 xn + ... + an is a polynomial with integer coefficients such that a0 ≠ 0 (mod p), has at most n roots.
  • Primitive root modulo n: A number g is a primitive root modulo n if, for every integer a coprime to n, there is an integer k such that gka (mod n). A primitive root modulo n exists if and only if n is equal to 2, 4, pk or 2pk, where p is an odd prime number and k is a positive integer. If a primitive root modulo n exists, then there are exactly φ(φ(n)) such primitive roots, where φ is the Euler's totient function.
  • Quadratic residue: An integer a is a quadratic residue modulo n, if there exists an integer x such that x2a (mod n). Euler's criterion asserts that, if p is an odd prime, and a is not a multiple of p, then a is a quadratic residue modulo p if and only if

Congruence classes

Like any congruence relation, congruence modulo n is an equivalence relation, and the equivalence class of the integer a, denoted by an, is the set {… , a − 2n, an, a, a + n, a + 2n, …}. This set, consisting of the integers congruent to a modulo n, is called the congruence class or residue class or simply residue of the integer a, modulo n. When the modulus n is known from the context, that residue may also be denoted [a].

Residue systems

Each residue class modulo n may be represented by any one of its members, although we usually represent each residue class by the smallest nonnegative integer which belongs to that class (since this is the proper remainder which results from division). Any two members of different residue classes modulo n are incongruent modulo n. Furthermore, every integer belongs to one and only one residue class modulo n.[1]

The set of integers {0, 1, 2, …, n − 1} is called the least residue system modulo n. Any set of n integers, no two of which are congruent modulo n, is called a complete residue system modulo n.

The least residue system is a complete residue system, and a complete residue system is simply a set containing precisely one representative of each residue class modulo n.[2] The least residue system modulo 4 is {0, 1, 2, 3}. Some other complete residue systems modulo 4 are:

  • {1, 2, 3, 4}
  • {13, 14, 15, 16}
  • {−2, −1, 0, 1}
  • {−13, 4, 17, 18}
  • {−5, 0, 6, 21}
  • {27, 32, 37, 42}

Some sets which are not complete residue systems modulo 4 are:

  • {−5, 0, 6, 22} since 6 is congruent to 22 modulo 4.
  • {5, 15} since a complete residue system modulo 4 must have exactly 4 incongruent residue classes.

Reduced residue systems

Any set of φ(n) integers that are relatively prime to n and that are mutually incongruent modulo n, where φ(n) denotes Euler's totient function, is called a reduced residue system modulo n.[3] The example above, {5,15} is an example of a reduced residue system modulo 4.

Integers modulo n

The set of all congruence classes of the integers for a modulus n is called the ring of integers modulo n,[4] and is denoted , , or . The notation is, however, not recommended because it can be confused with the set of n-adic integers. The ring is fundamental to various branches of mathematics (see Applications below).

The set is defined for n > 0 as:

(When n = 0, does not have zero elements; rather, it is isomorphic to , since a0 = {a}.)

We define addition, subtraction, and multiplication on by the following rules:

The verification that this is a proper definition uses the properties given before.

In this way, becomes a commutative ring. For example, in the ring , we have

as in the arithmetic for the 24-hour clock.

We use the notation because this is the quotient ring of by the ideal containing all integers divisible by n, where is the singleton set {0}. Thus is a field when is a maximal ideal, that is, when n is prime.

This can also be constructed from the group under the addition operation alone. The residue class an is the group coset of a in the quotient group , a cyclic group.[5]

Rather than excluding the special case n = 0, it is more useful to include (which, as mentioned before, is isomorphic to the ring of integers), for example, when discussing the characteristic of a ring.

The ring of integers modulo n is a finite field if and only if n is prime (this ensures every nonzero element has a multiplicative inverse). If is a prime power with k > 1, there exists a unique (up to isomorphism) finite field with n elements, but this is not , which fails to be a field because it has zero-divisors.

We denote the multiplicative subgroup of the modular integers by . This consists of for a coprime to n, which are precisely the classes possessing a multiplicative inverse. This forms a commutative group under multiplication, with order .


In theoretical mathematics, modular arithmetic is one of the foundations of number theory, touching on almost every aspect of its study, and it is also used extensively in group theory, ring theory, knot theory, and abstract algebra. In applied mathematics, it is used in computer algebra, cryptography, computer science, chemistry and the visual and musical arts.

A very practical application is to calculate checksums within serial number identifiers. For example, International Standard Book Number (ISBN) uses modulo 11 (if issued before 1 January, 2007) or modulo 10 (if issued on or after 1 January, 2007) arithmetic for error detection. Likewise, International Bank Account Numbers (IBANs), for example, make use of modulo 97 arithmetic to spot user input errors in bank account numbers. In chemistry, the last digit of the CAS registry number (a unique identifying number for each chemical compound) is a check digit, which is calculated by taking the last digit of the first two parts of the CAS registry number times 1, the previous digit times 2, the previous digit times 3 etc., adding all these up and computing the sum modulo 10.

In cryptography, modular arithmetic directly underpins public key systems such as RSA and Diffie–Hellman, and provides finite fields which underlie elliptic curves, and is used in a variety of symmetric key algorithms including Advanced Encryption Standard (AES), International Data Encryption Algorithm (IDEA), and RC4. RSA and Diffie–Hellman use modular exponentiation.

In computer algebra, modular arithmetic is commonly used to limit the size of integer coefficients in intermediate calculations and data. It is used in polynomial factorization, a problem for which all known efficient algorithms use modular arithmetic. It is used by the most efficient implementations of polynomial greatest common divisor, exact linear algebra and Gröbner basis algorithms over the integers and the rational numbers.

In computer science, modular arithmetic is often applied in bitwise operations and other operations involving fixed-width, cyclic data structures. The modulo operation, as implemented in many programming languages and calculators, is an application of modular arithmetic that is often used in this context. XOR is the sum of 2 bits, modulo 2.

In music, arithmetic modulo 12 is used in the consideration of the system of twelve-tone equal temperament, where octave and enharmonic equivalency occurs (that is, pitches in a 1∶2 or 2∶1 ratio are equivalent, and C-sharp is considered the same as D-flat).

The method of casting out nines offers a quick check of decimal arithmetic computations performed by hand. It is based on modular arithmetic modulo 9, and specifically on the crucial property that 10 ≡ 1 (mod 9).

Arithmetic modulo 7 is used in algorithms that determine the day of the week for a given date. In particular, Zeller's congruence and the Doomsday algorithm make heavy use of modulo-7 arithmetic.

More generally, modular arithmetic also has application in disciplines such as law (see for example, apportionment), economics, (see for example, game theory) and other areas of the social sciences, where proportional division and allocation of resources plays a central part of the analysis.

Computational complexity

Since modular arithmetic has such a wide range of applications, it is important to know how hard it is to solve a system of congruences. A linear system of congruences can be solved in polynomial time with a form of Gaussian elimination, for details see linear congruence theorem. Algorithms, such as Montgomery reduction, also exist to allow simple arithmetic operations, such as multiplication and exponentiation modulo n, to be performed efficiently on large numbers.

Some operations, like finding a discrete logarithm or a quadratic congruence appear to be as hard as integer factorization and thus are a starting point for cryptographic algorithms and encryption. These problems might be NP-intermediate.

Solving a system of non-linear modular arithmetic equations is NP-complete.[6]

Example implementations

Below are three reasonably fast C functions, two for performing modular multiplication and one for modular exponentiation on unsigned integers not larger than 63 bits, without overflow of the transient operations.

An algorithmic way to compute :

uint64_t mul_mod(uint64_t a, uint64_t b, uint64_t m)
   uint64_t d = 0, mp2 = m >> 1;
   int i;
   if (a >= m) a %= m;
   if (b >= m) b %= m;
   for (i = 0; i < 64; ++i)
       d = (d > mp2) ? (d << 1) - m : d << 1;
       if (a & 0x8000000000000000ULL)
           d += b;
       if (d >= m) d -= m;
       a <<= 1;
   return d;

On computer architectures where an extended precision format with at least 64 bits of mantissa is available (such as the long double type of most x86 C compilers), the following routine is faster than any algorithmic solution, by employing the trick that, by hardware, floating-point multiplication results in the most significant bits of the product kept, while integer multiplication results in the least significant bits kept:

uint64_t mul_mod(uint64_t a, uint64_t b, uint64_t m)
   long double x;
   uint64_t c;
   int64_t r;
   if (a >= m) a %= m;
   if (b >= m) b %= m;
   x = a;
   c = x * b / m;
   r = (int64_t)(a * b - c * m) % (int64_t)m;
   return r < 0 ? r + m : r;

Below is a C function for performing modular exponentiation, that uses the mul_mod function implemented above.

An algorithmic way to compute :

uint64_t pow_mod(uint64_t a, uint64_t b, uint64_t m)
    uint64_t r = m==1?0:1;
    while (b > 0) {
        if(b & 1)
            r = mul_mod(r, a, m);
        b = b >> 1;
        a = mul_mod(a, a, m);
    return r;

However, for all above routines to work, m must not exceed 63 bits.

See also


  1. ^ Pettofrezzo & Byrkit (1970, p. 90)
  2. ^ Long (1972, p. 78)
  3. ^ Long (1972, p. 85)
  4. ^ It is a ring, as shown below.
  5. ^ Sengadir T., Discrete Mathematics and Combinatorics, p. 293, at Google Books
  6. ^ Garey, M. R.; Johnson, D. S. (1979). Computers and Intractability, a Guide to the Theory of NP-Completeness. W. H. Freeman. ISBN 0716710447.


External links

Carmichael number

In number theory, a Carmichael number is a composite number which satisfies the modular arithmetic congruence relation:

for all integers which are relatively prime to . They are named for Robert Carmichael. The Carmichael numbers are the subset K1 of the Knödel numbers.

Equivalently, a Carmichael number is a composite number for which

for all integers .

Congruence of squares

In number theory, a congruence of squares is a congruence commonly used in integer factorization algorithms.

Congruence relation

In abstract algebra, a congruence relation (or simply congruence) is an equivalence relation on an algebraic structure (such as a group, ring, or vector space) that is compatible with the structure in the sense that algebraic operations done with equivalent elements will yield equivalent elements. Every congruence relation has a corresponding quotient structure, whose elements are the equivalence classes (or congruence classes) for the relation.

Discrete logarithm

In the mathematics of the real numbers, the logarithm logb a is a number x such that bx = a, for given numbers a and b. Analogously, in any group G, powers bk can be defined for all integers k, and the discrete logarithm logb a is an integer k such that bk = a. In number theory, the more commonly used term is index: we can write x = indr a (mod m) (read the index of a to the base r modulo m) for rx ≡ a (mod m) if r is a primitive root of m and gcd(a,m)=1.

Discrete logarithms are quickly computable in a few special cases. However, no efficient method is known for computing them in general. Several important algorithms in public-key cryptography base their security on the assumption that the discrete logarithm problem over carefully chosen groups has no efficient solution.

Euler's criterion

In number theory, Euler's criterion is a formula for determining whether an integer is a quadratic residue modulo a prime. Precisely,

Let p be an odd prime and a an integer coprime to p. Then

Euler's criterion can be concisely reformulated using the Legendre symbol:

The criterion first appeared in a 1748 paper by Euler.

Fermat's little theorem

Fermat's little theorem states that if p is a prime number, then for any integer a, the number apa is an integer multiple of p. In the notation of modular arithmetic, this is expressed as

For example, if a = 2 and p = 7, then 27 = 128, and 128 − 2 = 126 = 7 × 18 is an integer multiple of 7.

If a is not divisible by p, Fermat's little theorem is equivalent to the statement that ap − 1 − 1 is an integer multiple of p, or in symbols:

For example, if a = 2 and p = 7, then 26 = 64, and 64 − 1 = 63 = 7 × 9 is thus a multiple of 7.

Fermat's little theorem is the basis for the Fermat primality test and is one of the fundamental results of elementary number theory. The theorem is named after Pierre de Fermat, who stated it in 1640. It is called the "little theorem" to distinguish it from Fermat's last theorem.

Fermat primality test

The Fermat primality test is a probabilistic test to determine whether a number is a probable prime.

Interval class

In musical set theory, an interval class (often abbreviated: ic), also known as unordered pitch-class interval, interval distance, undirected interval, or "(even completely incorrectly) as 'interval mod 6'" (Rahn 1980, 29; Whittall 2008, 273–74), is the shortest distance in pitch class space between two unordered pitch classes. For example, the interval class between pitch classes 4 and 9 is 5 because 9 − 4 = 5 is less than 4 − 9 = −5 ≡ 7 (mod 12). See modular arithmetic for more on modulo 12. The largest interval class is 6 since any greater interval n may be reduced to 12 − n.

Kummer's congruence

In mathematics, Kummer's congruences are some congruences involving Bernoulli numbers, found by Ernst Eduard Kummer (1851).

Kubota & Leopoldt (1964) used Kummer's congruences to define the p-adic zeta function.

Luhn algorithm

The Luhn algorithm or Luhn formula, also known as the "modulus 10" or "mod 10" algorithm, named after IBM scientist Hans Peter Luhn, is a simple checksum formula used to validate a variety of identification numbers, such as credit card numbers, IMEI numbers, National Provider Identifier numbers in the United States, Canadian Social Insurance Numbers, Israel ID Numbers, Greek Social Security Numbers (ΑΜΚΑ), and survey codes on McDonald's receipts. It was created by IBM scientist Hans Peter Luhn and described in U.S. Patent No. 2,950,048, filed on January 6, 1954, and granted on August 23, 1960.

The algorithm is in the public domain and is in wide use today. It is specified in ISO/IEC 7812-1. It is not intended to be a cryptographically secure hash function; it was designed to protect against accidental errors, not malicious attacks. Most credit cards and many government identification numbers use the algorithm as a simple method of distinguishing valid numbers from mistyped or otherwise incorrect numbers.

Mod n cryptanalysis

In cryptography, mod n cryptanalysis is an attack applicable to block and stream ciphers. It is a form of partitioning cryptanalysis that exploits unevenness in how the cipher operates over equivalence classes (congruence classes) modulo n. The method was first suggested in 1999 by John Kelsey, Bruce Schneier, and David Wagner and applied to RC5P (a variant of RC5) and M6 (a family of block ciphers used in the FireWire standard). These attacks used the properties of binary addition and bit rotation modulo a Fermat prime.

Modular multiplicative inverse

In mathematics, in particular the area of number theory, a modular multiplicative inverse of an integer a is an integer x such that the product ax is congruent to 1 with respect to the modulus m. In the standard notation of modular arithmetic this congruence is written as

which is the shorthand way of writing the statement that m divides (evenly) the quantity ax − 1, or, put another way, the remainder after dividing ax by the integer m is 1. If a does have an inverse modulo m there are an infinite number of solutions of this congruence which form a congruence class with respect to this modulus. Furthermore, any integer that is congruent to a (i.e., in a's congruence class) will have any element of x's congruence class as a modular multiplicative inverse. Using the notation of to indicate the congruence class containing w, this can be expressed by saying that the modulo multiplicative inverse of the congruence class is the congruence class such that:

where the symbol denotes the multiplication of equivalence classes modulo m. Written in this way the analogy with the usual concept of a multiplicative inverse in the set of rational or real numbers is clearly represented, replacing the numbers by congruence classes and altering the binary operation appropriately.

As with the analogous operation on the real numbers, a fundamental use of this operation is in solving, when possible, linear congruences of the form,

Finding modular multiplicative inverses also has practical applications in the field of cryptography, i.e. public-key cryptography and the RSA Algorithm. A benefit for the computer implementation of these applications is that there exists a very fast algorithm (the extended Euclidean algorithm) that can be used for the calculation of modular multiplicative inverses.

Modulo operation

In computing, the modulo operation finds the remainder after division of one number by another (sometimes called modulus).

Given two positive numbers, a (the dividend) and n (the divisor), a modulo n (abbreviated as a mod n) is the remainder of the Euclidean division of a by n. For example, the expression "5 mod 2" would evaluate to 1 because 5 divided by 2 leaves a quotient of 2 and a remainder of 1, while "9 mod 3" would evaluate to 0 because the division of 9 by 3 has a quotient of 3 and leaves a remainder of 0; there is nothing to subtract from 9 after multiplying 3 times 3. (Note that doing the division with a calculator will not show the result referred to here by this operation; the quotient will be expressed as a decimal fraction.)

Although typically performed with a and n both being integers, many computing systems allow other types of numeric operands. The range of numbers for an integer modulo of n is 0 to n − 1. (a mod 1 is always 0; a mod 0 is undefined, possibly resulting in a division by zero error in programming languages.) See modular arithmetic for an older and related convention applied in number theory.

When either a or n is negative, the naive definition breaks down and programming languages differ in how these values are defined.

Multiplicative order

In number theory, given an integer a and a positive integer n with gcd(a,n) = 1, the multiplicative order of a modulo n is the smallest positive integer k with

In other words, the multiplicative order of a modulo n is the order of a in the multiplicative group of the units in the ring of the integers modulo n.

The order of a modulo n is usually written ordn(a), or On(a).

Product cipher

In cryptography, a product cipher combines two or more transformations in a manner intending that the resulting cipher is more secure than the individual components to make it resistant to cryptanalysis. The product cipher combines a sequence of simple transformations such as substitution (S-box), permutation (P-box), and modular arithmetic. The concept of product ciphers is due to Claude Shannon, who presented the idea in his foundational paper, Communication Theory of Secrecy Systems.

For transformation involving reasonable number of n message symbols, both of the foregoing cipher systems (the S-box and P-box) are by themselves wanting. Shannon suggested using a combination of S-box and P-box transformation—a product cipher. The combination could yield a cipher system more powerful than either one alone. This approach of alternatively applying substitution and permutation transformation has been used by IBM in the Lucifer cipher system, and has become the standard for national data encryption standards such as the Data Encryption Standard and the Advanced Encryption Standard. A product cipher that uses only substitutions and permutations is called a SP-network. Feistel ciphers are an important class of product ciphers.

Residue number system

A residue numeral system (RNS) is a numeral system representing integers by their values modulo several pairwise coprime integers called the moduli. This representation is allowed by the Chinese remainder theorem, which asserts that, if N is the product of the moduli, there is, in an interval of length N, exactly one integer having any given set of modular values. The arithmetic of a residue numeral system is also called multi-modular arithmetic.

Multi-modular arithmetic is widely used for computation with large integers, typically in linear algebra, because it provides faster computation than with the usual numeral systems, even when the time for converting between numeral systems is taken into account. Other applications of multi-modular arithmetic include polynomial greatest common divisor, Gröbner basis computation and cryptography.

Solovay–Strassen primality test

The Solovay–Strassen primality test, developed by Robert M. Solovay and Volker Strassen, is a probabilistic test to determine if a number is composite or probably prime. It has been largely superseded by the Baillie-PSW primality test and the Miller–Rabin primality test, but has great historical importance in showing the practical feasibility of the RSA cryptosystem. The Solovay–Strassen test is essentially an Euler–Jacobi pseudoprime test.

Unit fraction

A unit fraction is a rational number written as a fraction where the numerator is one and the denominator is a positive integer. A unit fraction is therefore the reciprocal of a positive integer, 1/n. Examples are 1/1, 1/2, 1/3, 1/4 ,1/5, etc.

Wilson's theorem

In number theory, Wilson's theorem states that a natural number n > 1 is a prime number if and only if the product of all the positive integers less than n is one less than a multiple of n. That is (using the notations of modular arithmetic), the factorial satisfies

exactly when n is a prime number.

This page is based on a Wikipedia article written by authors (here).
Text is available under the CC BY-SA 3.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.