\documentclass[11pt]{article} \input{headers02} \usepackage{fancyhdr} \pagestyle{fancy} \lhead{CS 355, Fall 2026} \rhead{Name: Hemanta K. Maji} %%% <-- REPLACE Hemanta K. Maji WITH YOUR NAME HERE \usepackage[strict]{changepage} \newcommand{\nextoddpage}{\checkoddpage\ifoddpage{\ \newpage\ \newpage}\else{\ \newpage}\fi} \begin{document} \title{Homework 2} \date{} \maketitle \thispagestyle{fancy} \pagestyle{fancy} %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%% STATUS: ALL QUESTIONS REVISED FOR FALL 2026 %%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%% Started from a verbatim copy of %%% Spring26-HWs-Exams/HW2/hw2-Spring2026{,-Sol}.tex %%% headers.tex is byte-identical to the Spring 2026 one. %%% %%% 2026-09-01 --- Practice questions (1-3) reviewed for Fall 2026: %%% * All three answers verified: 100; order 6; S=(19,22). %%% * Q1 hint retargeted "part C of question 1" -> "part (a) of %%% question 1". Q1 lost its old parts (a),(b) in Spring 2025 %%% (they moved to HW1), so "part C" had dangled for 3 semesters. %%% The same stale ref in Q1(b)'s solution was fixed too. %%% * Q1 keeps the year 2025 deliberately: 2026 makes the exponent %%% reduce to 2, collapsing the repeated-squaring step this %%% question exists to exercise. %%% * Q2's one-item enumerate unwrapped (it printed a lone "(a)"). %%% * Q3(b) now asks for the "third point"; the line meets the %%% curve at P and Q as well. %%% * Handout and -Sol re-synced across the practice section. %%% %%% 2026-09-01 --- Graded problem 1 revised for Fall 2026: %%% * Practice Q1's hint now names "Question 1 of the graded %%% homework questions". The earlier "part (a) of question 1" %%% was ambiguous: that hint sits inside practice question 1, %%% which is printed first and has no parts of its own. %%% * Q1(a) now carries a hint pointing at Homework 1, Problem %%% 5(b) (x^p = x mod p) -- the one-line path to Fermat -- and %%% the -Sol cites that problem by number instead of saying %%% "the previous homework". Checked: HW1 Fall 2026 Problem %%% 5(b) does state exactly this, for x in {1,...,p-1}. %%% * Q1(b)'s solution showed pq divides each of p^q-p and q^p-q %%% but never concluded anything about their sum, which is what %%% the question actually asks; the closing sentence was added. %%% * Q1(b) itself is unchanged, and is identical to Fall 2024 %%% through Spring 2026. If circulating solutions are a %%% concern, consider swapping in "for distinct primes p,q, %%% show p^{q-1} + q^{p-1} = 1 mod pq". %%% %%% 2026-09-06 --- Graded problem 2 revised for Fall 2026 (DONE): %%% * Q2(d) read "Prove that inv(x) o x = e" with x unbound; it %%% now says "for all x in G", matching Q2(b)'s phrasing. %%% * Q2 points rebalanced 5+6+6+8+5 -> 6+8+5+6+5 (still 30, so %%% no other problem is affected). The old split gave (d) the %%% most weight, but (d) reuses the substitution trick that (b) %%% has to invent, so (b) is the harder part; and (c) outscored %%% (e) even though the two proofs are the same computation. %%% Revisit if a hint is ever added to (b) or (d). %%% * The three align* blocks in the -Sol opened with %%% "& \ \ \ \ \ \ \ \" (and, in (a) and (e), a source-line %%% break) to fake the first line's indent; all three now use %%% "& \phantom{\implies}" on one line, which is exact rather %%% than an eyeballed approximation. -Sol only. %%% * Raised, reviewed, and left as-is this semester -- pick these %%% up first if Q2 is ever reworked further: associativity and %%% closure are never stated though every part uses them; the %%% preamble's "(a) identity from the left / (b) inverse from %%% the left" labels collide with parts (a)-(e); (a) is a %%% double negative that its own solution restates positively; %%% (c) and (e) stack awkward quantifiers; both "these two %%% steps" remarks never name the parts they mean; and (b)/(d) %%% offer no hint to apply part (a). %%% %%% 2026-09-06 --- Graded problem 3 revised for Fall 2026 (DONE): %%% * The preamble claimed Q3 proves that inverses "are unique." %%% It does not: uniqueness of an element's inverse already %%% follows from Q2(e). Part (a) proves that inversion is %%% injective, so the preamble now says "distinct elements of a %%% group have distinct inverses". %%% * The same sentence said part (b) uses "this property"; (b) %%% uses cancellation and the two-sided inverse from Q2, not %%% part (a), so it now points at Question 2. %%% * Part (a)'s solution cited "previous problems" vaguely; it %%% now names parts (b) and (d) of Question 2. -Sol only. %%% * Part (a)'s chain was the file's ONLY numbered align, purely %%% so the closing note could say "(3) implies (2)" -- which %%% silently breaks if any numbered equation is ever added %%% earlier. It is now align*, matching Q2, and the note %%% refers to lines in words. The first line also moved into %%% the second alignment cell with \phantom{\iff}, as in Q2. %%% -Sol only. %%% * That note justified only (3) => (2). The reverse direction %%% also needs (2) => (1), which was missing; both are now %%% given. Every other step is a substitution or associativity %%% and reverses for free. -Sol only. %%% * Part (a)'s last line concluded inv(b) = inv(a); flipped to %%% inv(a) = inv(b) to match the statement. -Sol only. %%% * Part (b)'s solution opened with "We know that m o sk = c", %%% assuming what it had to prove, and then asserted the answer %%% with no verification -- a poor key for a 6-point existence %%% AND uniqueness proof. It now proves both halves. -Sol only. %%% * -Sol said "cipher text" and "a result that is crucial to the %%% proof of security of one-time pad"; the handout already had %%% the better "ciphertext" and "a crucial result for the %%% security of the one-time pad". Re-synced onto the handout's %%% wording. %%% * Raised, reviewed, and left as-is this semester: part (a) is %%% 9 points for a six-line chain, more than Q2(b)'s 8 for a %%% harder proof, and the shorter route via Q2(e) (a is a left %%% inverse of inv(a), so a = inv(inv(a))) would make it shorter %%% still. Rebalancing 9+6 would change the intended difficulty, %%% so it was deferred rather than decided. %%% %%% 2026-09-06 --- Graded problem 4 revised for Fall 2026 (DONE): %%% * Part (a)'s solution wrote "n = qh + r, where q, h are %%% integers"; the division algorithm introduces q and r, and h %%% is already fixed as the order. Now "q, r". -Sol only. %%% * Part (c)'s chain ended ... = (x^h)^{k/d} = 1^{h/d} = 1. The %%% exponent must be k/d to match the preceding term. -Sol only. %%% * Part (d) asks to show that b = 1 or b has order 2, but the %%% solution stopped at "the order of b is 1 or 2" and the line %%% closing that gap was commented out. It is now a sentence of %%% the proof. Same defect class as the Q1(b) fix above. %%% -Sol only. %%% * p was never quantified: the preamble spoke of (Z_p^*,x) and %%% only part (d) said "let p > 2 be a prime". The preamble now %%% opens "Throughout this problem, p is a prime." %%% * Parts (b) and (c) opened "Let h be the order of x" with x %%% bound only inside part (a); both now say "Let x in Z_p^*". %%% Same fix as Q2(d) this semester. %%% * Reference style inside Q4 was "part (a) of Question 1", %%% "part a" (twice) and "part a of question 1"; all normalized %%% to "part (a) [of Question 1]", matching Q1-Q3. -Sol only. %%% * "r and h/d divides each other" -> "divide". -Sol only. %%% * Title punctuation "$(Z_p^*,x)$. (10+5+10+5 points)" -> %%% "$(Z_p^*,x)$ (10+5+10+5 points)." to match every other %%% problem. Practice question 2 carried the same quirk and was %%% fixed too. %%% * Part (a)'s \vfill dropped: a \newpage follows it, so the %%% rest of the page is blank either way, and no other part of %%% Q4 had one. The compiled handout was checked: (a)-(d) each %%% still leave a full blank page for the student's answer. %%% * Raised, reviewed, and left as-is this semester: part (c)'s %%% "Show that r = h/d in Z" folds two claims into the notation; %%% "a in (Z_p^*,x)" in part (d) declares an element to belong %%% to a pair (likewise part (c)'s "y = x^k mod p in Z_p^*"); %%% and the step from gcd(h/d,k/d) = 1 and (h/d) | (k/d)r to %%% (h/d) | r is Euclid's lemma, applied without being named -- %%% the only non-mechanical step in a 10-point part. %%% * The definition of order presumes that a smallest positive h %%% with x^h = 1 exists, which is exactly Question 1(a) -- and %%% that is what part (b) asks students to find. Deliberately %%% NOT noted in the preamble: it would give (b) away. %%% %%% 2026-09-06 --- Graded problem 5 revised for Fall 2026 (DONE): %%% * All three parts got fresh values. Spring 2026 reused the %%% Fall 2025 triples verbatim, and every triple that has ever %%% appeared in this problem (Fall 23, Spring 24, Fall 24, %%% Spring 25, Fall 25/Spring 26) was excluded when picking the %%% new ones, as were the two operands of the worked example: %%% (a) (2,0,1) x (2,0,2) = (1,2,2) -> (0,2,2) x (2,1,2) = (0,2,1) %%% (b) inverse of (0,0,2) = (2,2,1) -> inverse of (1,0,2) = (0,2,0) %%% (c) order of (0,0,1) = 13 -> order of (2,1,0) = 13 %%% Values verified by brute force over Z_3[X]/(X^3+2X+2). %%% * (a) was chosen so that C(X) collapses to X + X^4 mod 3 and %%% the quotient is the monomial X, i.e. one subtraction, the %%% same shape and length as the Fall 2025 solution. %%% * (b) is a binomial rather than the Fall 2025 monomial, so %%% C(X) carries two more terms, but the linear system is %%% easier: two of the three congruences pin a and c directly. %%% This matches the Fall 23/Fall 24 shape of the part. %%% * (c) is again an element of order 13, so the solution keeps %%% the "not 1, not 2, so 13 or 26" structure unchanged. The %%% square is now justified in line ((2+X)^2 = 1+X+X^2), and the %%% repeated-squaring chain is spelled out so the 13 can be %%% checked without redoing it. %%% * The closing remark asserted "(2,2,2)^13 = (2,0,0)" -- a %%% leftover from Spring 2025, when (2,2,2) was the element in %%% part (c). It was false for Fall 2025's (0,0,1) and is false %%% for (2,1,0); rewritten as the hypothetical it was meant to %%% be, which is what makes the -1 argument worth stating. %%% Two dead commented-out lines beside it were dropped. %%% * Raised, reviewed, and left as-is this semester: the problem %%% statement says "define ... in an different manner" (-Sol) vs %%% "in a different manner" (handout); the -Sol text is stale but %%% the surrounding paragraph differs between the two files in %%% several other places too, so re-syncing it is its own edit. %%% %%% 2026-09-08 --- Graded problem 6 revised for Fall 2026 (DONE): %%% * "For this reason, $\bbZ_p^*$ can also be written as %%% $\bbZ/p\bbZ$" was false: $\bbZ/p\bbZ$ is $\bbZ_p$, not its %%% unit group ($\bbZ_p^*$ is $(\bbZ/p\bbZ)^*$). The preceding %%% sentence had the same slip -- x and x+p represent the same %%% element of $\bbZ_p$, not of $\bbZ_p^*$. Both now say %%% $\bbZ_p$, and the sentence names $p\bbZ$ as the subgroup %%% being quotiented out, which is what makes the analogy land: %%% $\bbZ_p$ is itself a quotient group. %%% * p was never quantified anywhere in the problem, yet %%% $\{-1,+1\}$ is a subgroup of order 2 and $\frac{p-1}{2}$ is %%% an integer only for odd primes. Added "Throughout this %%% problem, $p$ is an odd prime." Same fix as Q4 this %%% semester. %%% * $G/H$ is a group only when $H$ is normal in $G$; the problem %%% called it a quotient GROUP in its own title without ever %%% saying why the cosets form one. One sentence added: $\bbZ_p^*$ %%% is abelian, so the induced operation is well defined. %%% * "$\times$ is defined as multiplication in $\bbZ_p^*$, then %%% fitting it into elements in $\bbZ_p^*/\{-1,+1\}$" -- "fitting %%% it into" never said what to do. Now states the rule: take %%% whichever of the product and its negation lies in %%% $\{1,\dotsc,\frac{p-1}{2}\}$. %%% * "you can think of it as for any x" -> "as follows: for any x". %%% * New values, p = 7 -> p = 11. With p = 7 the quotient has %%% only 3 elements, one of them the identity, so the worked %%% example plus the two graded parts spelled out the ENTIRE %%% multiplication table -- a student who noticed that could %%% answer both parts without understanding the folding. p = 11 %%% gives 5 elements and 10 products, of which 3 are shown or %%% asked. The three now cover the three distinct cases: %%% example 2 x 3 = 6 = -5 = 5 (fold only, no reduction) %%% (a) 4 x 5 = 20 = 9 = -2 = 2 (reduce mod p, then fold) %%% (b) 3 x 4 = 12 = 1 (reduce only; lands on the %%% identity, so 3 and 4 are %%% inverses -- worth seeing) %%% Spring 2026's 2x2, 2x3, 3x3 mod 7 are all retired. Values %%% verified by brute force over Z_11^*. %%% * The -Sol's answer to (b) now names 1 as the identity; a bare %%% "= 1" reads like an unfinished reduction. %%% * Two dead commented-out lines ("We can then say that we will %%% select the smaller of the two elements...") dropped from the %%% -Sol; the handout never had them. %%% * The stem now says "Answer the following questions in %%% $(\bbZ_{11}^*/\{-1,+1\},\times)$"; the old "Answer the %%% following questions" left the modulus to be inferred from a %%% paragraph introduced as a mere example. %%% * Raised, reviewed, and left as-is this semester: at 1+1 points %%% Q6 is worth 2 of the assignment's points against Q7's 13, and %%% it asks only for arithmetic -- nothing here tests the coset %%% machinery the two pages of preamble develop. A part asking %%% WHY the operation is well defined (that x~-x and y~-y implies %%% xy~-xy) would be the natural third part, but adding points %%% changes the assignment total, so it was deferred. %%% %%% 2026-09-08 --- Graded problem 7 revised for Fall 2026 (DONE): %%% * The addition rule was wrong for doubling. It read "If %%% x_p = x_q, the two points are on the same vertical line, then %%% y_p = -y_q and Q = -P. In this case, we define P + Q = oo." %%% P = Q also has x_p = x_q, so the rule declared P + P = oo for %%% EVERY point -- contradicting part (a)(iii) and (b)(iii), which %%% are the tangent line case. The vertical case now requires %%% y_p != y_q (whence y_q = -y_p), and the rule says explicitly %%% that P = Q is handled by the tangent line rule below. %%% * The carrier of the group was never named. The preamble said %%% oo is NOT on the graph E, and part (a) then wrote "P + oo = %%% oo + P = P for any element P in E", which leaves oo + oo %%% undefined. The group is now introduced as E u {oo} and the %%% identity law quantifies over that set. %%% * Non-singularity was never required, though the chord-tangent %%% rule needs it: added "4a^3 + 27b^2 != 0" (and char K not 2 %%% or 3, which (b)(iii) divides by) to the preamble, with one %%% sentence saying what it rules out. The concrete curve is %%% fine: 4(-2)^3 + 27*5^2 = 643 = 16 != 0 mod 19. This is what %%% the commented-out "% \item Singularity Condition" placeholder %%% was for; that placeholder is now dropped. %%% * (b)(iii) derived the tangent slope by implicitly %%% differentiating Y^2 = X^3 + aX + b -- calculus over an %%% arbitrary field K, and in particular over F_19, which is %%% where part (a) applies the formula. It now uses the FORMAL %%% derivatives F_X = -(3X^2+a), F_Y = 2Y and the tangent line %%% F_X(P)(X-x_p) + F_Y(P)(Y-y_p) = 0, noting F_Y(P) = 2y_p != 0 %%% since y_p != 0 and char K != 2. %%% * Part (b) was titled "Elliptic Curve forms a group with %%% identity element oo", but its three parts only derive the %%% coordinate formulas -- associativity is never shown, so %%% nothing there proves group-hood. Retitled "Deriving the %%% addition formulas", and two sentences now say what the %%% formulas do establish and that associativity is left unproved. %%% * The Vieta hint's polynomial was "a_1X^3 + a_2X^2 + a_1X + a_0" %%% (a_1 twice); now a_3X^3, with a_3 != 0 stated. "formula" -> %%% "formulas" (three are given), "i.e." -> "where". %%% * The -Sol had NO solutions for (a)(i),(ii),(iii) -- 7 of the %%% problem's 13 points. All three are now worked, every value %%% verified by hand over F_19: %%% (i) 3^2 = 9 = 2^3-4+5; 4^2 = 16 = 985 mod 19 %%% (ii) m = 1/8 = 12, R = (18,5), so P+Q = (18,14) %%% (iii) P+P = (3,8), Q+Q = (15,14), R+R = (6,0) %%% R+R = (6,0) is its own negative, a point of order 2; the key %%% now says so, since that is the one interesting answer here. %%% * Preamble grammar, both files: "Consider a point P = (x,y) lies %%% on the elliptic curve" -> "Let P = (x,y) be a point on"; %%% "Given, two points" (stray comma) dropped; and the comma %%% splice "if x_p != x_q, the two points are not on the same %%% vertical line, define the addition as" rewritten. %%% * -Sol/handout re-sync: -Sol had "denote as oo" (handout: %%% "denoted as"), "The the following equality holds" (handout had %%% it right), and never closed the "(Hint: ..." paren that the %%% handout closes. Handout had a stray space in "$\infty. $" and %%% a double space in "$y_r =y_p - m(...)$". All fixed. %%% * $F_{19}$ -> $\bbF_{19}$ (headers.tex defines \bbF; a bare $F$ %%% typesets as a variable). Both files. %%% * Handout answer space: (b)(i) had no \vfill at all while (b)(ii) %%% and (b)(iii) did; all six parts now have one. %%% * Points rebalanced 2+2+3+3+1+2 -> 1+2+4+3+1+2 (still 13, so no %%% other problem is affected). (a)(i) is two substitutions and %%% was worth as much as (a)(ii); (a)(iii) is three separate %%% doublings and was worth as much as the (b)(i) proof. %%% * Dead content dropped from the -Sol (the handout never had it): %%% the commented "Please fill in the following multiplication %%% table", which is Q6's OLD p = 7 table and went stale when Q6 %%% moved to p = 11 this semester; the "% \item Singularity %%% Condition" and "% \item Number of points on the Elliptic %%% Curve" placeholders with their "% (This mighbe)" typo; and %%% ~30 lines of trailing whitespace. %%% * The whole Q7 block in the -Sol was space-indented while %%% Q1--Q5 use tabs; it now matches the handout, so the two files %%% diff cleanly again. %%% * Raised, reviewed, and left as-is this semester: (a)(iii) %%% defines R only implicitly, by "-R = P + Q", so R can be %%% misread as P + Q itself (here both readings give (6,0), but %%% only by luck); (a)(iii) needs the doubling slope that (b)(iii) %%% only derives two pages later; (b)(ii) is 1 point for a case %%% analysis of the definition; (b)(iii)'s Vieta step still does %%% not say that tangency makes x_p a DOUBLE root, which is what %%% licenses x_p + x_q + x_r = m^2 when P = Q. The curve, %%% P = (2,3) and Q = (10,4) were inherited unchanged from %%% Spring 2026 at this point; they were freshened later the %%% same day (see the last entry below). %%% %%% 2026-09-08 --- Quotient group problem moved to the practice %%% section: %%% * The quotient group problem, Q6 of the graded section, is now %%% practice question 4 at 0 points. Last cycle's review of it %%% noted that it was worth 2 of the assignment's 125 points and %%% asked only for two products -- none of the coset machinery its %%% two pages of preamble develop. As a practice question that %%% mismatch is gone, and the preamble still does the teaching. %%% * It follows the practice convention: the handout prints only %%% the final answer, and the -Sol carries the derivation as %%% commented-out LaTeX beside it, so BOTH compiled PDFs show the %%% answer alone. Verified: the two PDFs are identical through %%% the end of the practice section apart from the title. %%% * Both parts are relabelled "(0 points)" on their own line, with %%% the question on the next, matching practice question 3; the %%% problem title takes the "(0 points)." punctuation the other %%% practice questions use. %%% * The elliptic curve problem is now graded problem 6. Its %%% "Problem 7" banner was renumbered and re-indented -- it mixed %%% a tab-only line with 4-space ones, the last of the space %%% indentation this file carried. %%% * Q5's trailing \newpage was dropped along with the moved %%% problem. Every graded problem's banner already ends with its %%% own \newpage, so keeping both would have left a blank page %%% between Q5 and the elliptic curve problem. Checked: neither %%% PDF has a blank page. %%% * The -Sol's copy of this problem was space-indented; the moved %%% copy is the handout's tab-indented text, so the two files %%% diff cleanly here as well. %%% * The graded total drops from 125 to 123 points: 10 + 30 + 15 + %%% 30 + 25 + 13. Gradescope's rubric will need the same change. %%% %%% 2026-09-08 --- Whole-assignment consistency pass: %%% * Verified that NO solution reaches the handout: all 22 graded %%% parts carry only the "ERASE THIS LINE" placeholder, the %%% handout .tex body has no commented-out solution text, and in %%% the compiled handout every one of the 22 graded "Solution." %%% headings is followed by blank space. The practice section is %%% identical in the two PDFs apart from the title. %%% * Every answer re-verified by brute force: practice 1-4 (100; %%% 6; S=(19,22); 2 and 1 mod 11) and graded 5 ((0,2,1); inverse %%% (0,2,0); order 13, including the -Sol's squaring chain) and 6 %%% (P,Q on E; P+Q=(18,14); P+P=(3,8), Q+Q=(15,14), R+R=(6,0)). %%% Q1(a)'s hint was checked against HW1 Fall 2026 Problem 5(b). %%% Points per part match every title; the graded total is 123. %%% * Practice question 3 still wrote the field as $F_{23}$, which %%% typesets as a variable. Now $\bbF_{23}$, the fix Q7 (now Q6) %%% got last cycle. Both files, and the -Sol's commented-out %%% derivation beside it. %%% * The elliptic curve problem's title ended "points)" where every %%% other title ends "points).", the same quirk Q4 and practice %%% question 2 were fixed for last cycle. %%% * "Understanding Groups: Part one" -> "Part One", matching %%% Question 3's "Part Two"; practice question 3's "Elliptic %%% curve" -> "Elliptic Curve", the only title that was not in %%% title case. %%% * The practice quotient group problem overfull its first line by %%% 13.4pt -- $\left(\bbZ_p^*/\left\{-1,+1\right\},\times\right)$ will %%% not break, and the "Throughout this problem" sentence added %%% last cycle pushed it into the margin. That sentence is now its %%% own paragraph. Only a 0.2pt overfull remains in either file. %%% * Q2(b) and Q2(d) cited "part a"; normalized to "part (a)", the %%% style used everywhere else. -Sol only. %%% * Q5's preamble was re-synced onto the handout's wording, which %%% last cycle's review had flagged and deferred. This clears the %%% -Sol's "in an different manner", "for one alphabet message", %%% "shall assist you to define" and "Recall that in the class, we %%% had seen". The handout is unchanged. %%% * Dead "% \newpage" dropped from Q5 in both files, and the %%% handout's missing trailing newline restored. %%% %%% 2026-09-08 --- Sub-problem labelling made consistent: %%% * Q5's three graded parts were the assignment's only itemize, so %%% they printed as bullets while every other problem's parts print %%% as (a), (b), (c). They are now an enumerate, and read %%% "(a) (5 points)", "(b) (10 points)", "(c) (10 points)". %%% * That freed the letters for sub-problems but collided with Q5's %%% own preamble, whose two procedure lists -- the boxed algorithm %%% and the worked example -- also printed (a)-(d) at the same %%% depth; the worked example's (a)-(d) ran straight into the %%% graded (a) on the next page. Both procedure lists now take %%% label=\roman*., so throughout the assignment a letter means a %%% sub-problem and a roman numeral means a step. This also %%% matches the -Sol, whose Q5 solution step lists now nest one %%% level deeper and so number themselves i., ii., iii. anyway. %%% * Checked after the change: 22 graded sub-problems, labelled %%% (a)-(b), (a)-(e), (a)-(b), (a)-(d), (a)-(c) for Q1-Q5, and %%% i.-iii. under each of Q6's (a) and (b), which is the only %%% problem with two levels. Both PDFs still 25 and 27 pages, the %%% handout's 22 solution slots still blank, and the practice %%% section still identical in the two PDFs apart from the title. %%% %%% 2026-09-08 --- Q6's values freshened: %%% * The curve and points in (a)(i)-(iii) had been carried %%% unchanged since Spring 2026, the problem's first outing -- %%% the one item this file's Q6 review had flagged and deferred. %%% E: Y^2 = X^3 - 2X + 5 over F_19 with P = (2,3), Q = (10,4) %%% becomes E: Y^2 = X^3 - 4X - 5 over F_17 with P = (4,3), %%% Q = (9,12). Only part (a) carries numbers; (b) is symbolic %%% and is untouched. %%% * New answers, verified by brute force over F_17 and again by %%% hand: P + Q = (12,3) (so R = (12,14)), P + P = (8,13), %%% Q + Q = (7,15), R + R = (6,0). %%% * Difficulty held constant, part for part. The work is still %%% one chord addition and three doublings, needing the same %%% FOUR modular inverses (5^-1, 6^-1, 7^-1, 11^-1 mod 17, against %%% 11^-1, 6^-1, 8^-1, 10^-1 mod 19), and the largest number a %%% student reduces by hand DROPS from 985 (= 10^3 - 20 + 5) to %%% 688 (= 9^3 - 36 - 5). No step was added or removed. %%% * Kept deliberately: R + R = (6,0) is again a point of order 2, %%% so the closing remark about 2-torsion still lands, and the %%% "-R = P + Q" ambiguity noted above still resolves to (6,0) %%% under both readings, for the same reason (-(6,0) = (6,0)). %%% * F_17 is used nowhere else in HW1 or HW2; practice question 3 %%% works over F_23 and is unaffected. Nonsingularity rechecked: %%% 4a^3 + 27b^2 = -256 + 675 = 419 = 11 mod 17, nonzero. %%% * Points, structure, and the handout's \vfill slots are %%% unchanged, so the graded total is still 123. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%% PLEASE LIST COLLABORATORS BELOW %%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% {\bfseries Collaborators :} %%% List your collaborators and any online resources here. \newpage \centering {\Huge{Practice Questions}} These are practice questions. They will \textbf{NOT} be graded. We have also provided the final answers. However, it is up to you to understand how or why the given solution is correct. You do not need to submit these on Gradescope. However, you may find it easier to just include them in the pdf. In that case, please do not mark these questions on Gradescope. \newpage \begin{enumerate} \item {\bfseries Calculating Large Powers mod $p$ (0 points).} Recall that we learned the repeated squaring algorithm in class. Calculate the following using this concept $$ 10^{2025^{2025}+2025} \pmod{101} $$ (Hint: Note that $101$ is a prime number, and before applying the repeated squaring algorithm, try to simplify the problem using what you learned in part (a) of Question 1 of the graded homework questions.) (Note: as can be seen from the latex file, the entirety of $2025^{2025}+2025$ is in the exponent of $10$. Also recall that $a^{b^c} = a^{\left(b^c\right)}$, not $\left(a^b\right)^c$, which is $a^{b\cdot c}$) {\bfseries Solution.} $100$ \vfill \item {\bfseries Order of an Element in $(\bbZ_p^*,\times)$ (0 points).} The \textit{order} of an element $x$ in the multiplicative group $(\bbZ_p^*,\times)$ is the smallest positive integer $h$ such that $x^h = 1 \mod p $. For example, the order of 2 in $(\bbZ_5^*,\times)$ is 4, and the order of $4$ in $(\bbZ_5^*,\times)$ is 2. What is the order of 3 in $(\bbZ_{7}^*,\times)$? {\bfseries Solution.} The order of 3 in $(\bbZ_{7}^*,\times)$ is 6. \vfill \newpage \item {\bfseries Elliptic Curve (0 points).} In class, we have briefly discussed elliptic curves. Here we will see some concrete examples of elliptic curves on finite prime fields. Let $Y^2 = X^3 + X$ be an elliptic curve over the field $(\bbF_{23}, +, \cdot).$ A point $(X, Y)$ lies on the elliptic curve if it satisfies the equation $Y^2 = X^3 + X.$ \begin{enumerate} \item (0 points) Are the two points $P = (9, 18)$ and $Q = (11, 10)$ on the curve? {\bfseries Solution.} Yes, they are. \vfill \item (0 points) Find the third point $R$ (that is, the intersection point other than $P$ and $Q$) where the line connecting $P$ and $Q$ intersects the elliptic curve $Y^2 = X^3 + X.$ For $R=(x,y)$, define the ``inverse of $R$'' to be the point $S = (x,-y)$. Find the inverse of point $R.$ Recall from the lecture that ``$P + Q$'' is defined to be the point $S \defeq $ ``inverse of $R$.'' {\bfseries Solution.} The inverse of $R$ is $S = (19, 22).$ \vfill \end{enumerate} \newpage \item {\bfseries Special Group: Quotient Group $\left(\bbZ_p^*/\left\{-1, +1\right\}, \times\right)$ (0 points).} Throughout this problem, $p$ is an odd prime. We will define the group $\left(\bbZ_p^*/\left\{-1, +1\right\}, \times\right)$ using the quotient group and coset notation. In general, given a group $G$ and a subgroup $H$, $G/H$ means the set of cosets formed by $H$ in $G$. The cosets of $H$ in $G$ are $gH \defeq \left\{g\times h: h\in H\right\}$ for $g\in G$. When $G$ is abelian, as $\bbZ_p^*$ is, this set of cosets is itself a group under the operation inherited from $G$; this is why $G/H$ is called a quotient \emph{group}. Now, consider the elements in $\bbZ_p^*$, which are $$\left\{1, 2, 3, \dotsc, \frac{p-1}{2}-1, \frac{p-1}{2}, \frac{p-1}{2}+1, \frac{p-1}{2}+2, \dotsc, p-3, p-2, p-1\right\}.$$ The cosets $\bbZ_p^*/\left\{-1, +1\right\}$ are $$\left\{1\times \left\{ -1, +1\right\}, 2\times \left\{ -1, +1\right\}, 3\times \left\{ -1, +1\right\}, \dotsc, \frac{p-1}{2}\times \left\{ -1, +1\right\}\right\}.$$ Observe that $1\times \left\{ -1, +1\right\}$ contains both $1$ and $-1=p-1$. Similarly, $2\times\left\{ -1, +1\right\}$ contains both $2$ and $p-2$. Finally, $\frac{p-1}{2}\times \left\{ -1, +1\right\}$ contains both $\frac{p-1}{2}$ and $\frac{-p+1}{2}=p+\frac{-p+1}{2}=\frac{p-1}{2}+1$. The final set of elements in $\bbZ_p^*/\left\{-1, +1\right\}$ are $\left\{1, 2, \dotsc, \frac{p-1}{2}-1, \frac{p-1}{2}\right\}$. Intuitively, you can think of it as follows: for any $x\in \bbZ_p^*$, both $x$ and $-x\in \bbZ_p^*$ represent the same element in $\bbZ_p^*/\left\{-1, +1\right\}$. The same way that the integers $x$ and $x+p$ represent the same element in $\bbZ_p$. For this reason, $\bbZ_p$ can also be written as $\bbZ/p\bbZ$, the quotient of the group $\left(\bbZ,+\right)$ by its subgroup $p\bbZ$. Let us look at a concrete example: $\left(\bbZ_{11}^*/\left\{-1, +1\right\}, \times\right)$. The elements in $\bbZ_{11}^*$ are $\left\{1, 2, 3, 4, 5, 6, 7, 8, 9, 10\right\}$. The elements in $\bbZ_{11}^*/\left\{-1, +1\right\}$ are $\left\{1, 2, 3, 4, 5\right\}$. $\times$ is multiplication in $\bbZ_p^*$, followed by replacing the product with whichever of it and its negation lies in $\left\{1, 2, \dotsc, \frac{p-1}{2}\right\}$. For example, $2\times 3 = 6 = -5 = 5$. Answer the following questions in $\left(\bbZ_{11}^*/\left\{-1, +1\right\}, \times\right)$: \begin{enumerate} \item (0 points) What is $4\times 5$? {\bfseries Solution.} $4\times 5 = 2$. \vfill \item (0 points) What is $3\times 4$? {\bfseries Solution.} $3\times 4 = 1$, the identity of the group. \vfill \end{enumerate} \end{enumerate} \newpage \centering {\Huge{Homework Questions}} These are homework questions and will be graded. Please make sure to clearly mark each problem on Gradescope. \newpage \begin{enumerate} %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%% PROBLEM 1 %%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% \item {\bfseries Some properties of $(\bbZ_p^*,\times)$ (5+5 points).} Recall that $\bbZ_p^*$ is the set $\{1,\dotsc,p-1\}$ and $\times$ is integer multiplication $\mod p$, where $p$ is a prime. For example, if $p=5$, then $2\times 3$ is $1$. In this problem, we shall prove that $(\bbZ_p^*,\times)$ is a group when $p$ is any prime. The only part missing in the lecture was the proof that every $x\in\bbZ_p^*$ has an inverse. We will find the inverse of any element $x\in\bbZ_p^*$. \begin{enumerate} \item(5 points) For $x\in\bbZ_p^*$, prove that the inverse of $x\in\bbZ_p^*$ is given by $$\overbrace{x\times x \times \dotsi \times x}^{(p-2)\text{-times}}$$ That is, prove that $x^{p-1}=1\mod p$, for any prime $p$ and $x\in\bbZ_p^*$. (Hint: Use Homework 1, Problem 5(b), which states that $x^p\mod p=x$ for any prime $p$ and $x\in\{1,2,\dotsc,p-1\}$.) {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \newpage \item (5 points) Let $p$, and $q$ be two distinct primes. Prove that $(p^q-p)+(q^p-q)$ is divisible by $pq$. {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \end{enumerate} \newpage %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%% PROBLEM 2 %%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% \item {\bfseries Understanding Groups: Part One (6+8+5+6+5 points).} Recall that when we defined a group $(G,\circ)$, we stated that there exists an element $e$ such that for all $x\in G$ we have $x\circ e=x$. Note that $e$ is ``applied on $x$ from the right.'' Similarly, for every $x\in G$, we are guaranteed that there exists $\inv(x)\in G$ such that $x\circ\inv(x)=e$. Note that $\inv(x)$ is again ``applied to $x$ from the right.'' In this problem, however, we shall explore the following questions: (a) Is there an ``identity from the left?,'' and (b) Is there an ``inverse from the left?'' We shall formalize and prove these results in this question. \begin{enumerate} \item (6 points) Prove that it is impossible that there exists $a,b,c\in G$ such that $a\neq b$ but $a\circ c = b\circ c$. {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \newpage \item (8 points) Prove that $e\circ x = x$, for all $x\in G$. {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \newpage \item (5 points) Prove that if there exists an element $\alpha \in G$ such that for \textbf{some} $x\in G$, we have $\alpha \circ x=x$, then $\alpha=e$. (Remark: Note that these two steps prove that the ``left identity'' is identical to the right identity $e$.) {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \newpage \item (6 points) Prove that $\inv(x)\circ x = e$, for all $x\in G$. {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \newpage \item (5 points) Prove that if there exists an element $\alpha\in G$ and $x\in G$ such that $\alpha\circ x=e$, then $\alpha=\inv(x)$. (Remark: Note that these two steps prove that the ``left inverse of $x$'' is identical to the right inverse $\inv(x)$.) {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \end{enumerate} \newpage %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%% PROBLEM 3 %%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% \item {\bfseries Understanding Groups: Part Two (9+6 points).} In this part, we will prove that distinct elements of a group have distinct inverses. And finally, using the results of Question 2, we will prove a crucial result for the security of the one-time pad over the group $(G,\circ)$. \begin{enumerate} \item(9 points) Suppose $a,b\in G$. Let $\inv(a)$ and $\inv(b)$ be the inverses of $a$ and $b$, respectively (\ie, $a\circ\inv(a)=e$ and $b\circ\inv(b)=e$). Prove that $\inv(a)=\inv(b)$ if and only if $a=b$. {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \newpage \item (6 points) Suppose $m\in G $ is a message and $c\in G$ is a ciphertext. Prove that there exists a unique $\sk\in G$ such that $m\circ \sk = c$. {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \end{enumerate} \newpage %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%% PROBLEM 4 %%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% \item {\bfseries Order of an Element in $(\bbZ_p^*,\times)$ (10+5+10+5 points).} Throughout this problem, $p$ is a prime. The \textit{order} of an element $x$ in the multiplicative group $(\bbZ_p^*,\times)$ is the smallest positive integer $h$ such that $x^h = 1 \mod p $. For example, the order of 2 in $(\bbZ_5^*,\times)$ is 4, and the order of $4$ in $(\bbZ_5^*,\times)$ is 2. \begin{enumerate} \item (10 points) Let $x$ be an element in $(\bbZ_p^*,\times)$ such that $x^n=1 \mod{p}$ for some positive integer $n$ and let $h$ be the order of $x$ in $(\bbZ_p^*,\times)$. Prove that $h$ divides $n$. {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \newpage \item (5 points) Let $x\in\bbZ_p^*$ and let $h$ be the order of $x$ in $(\bbZ_p^*,\times)$. Prove that $h$ divides $(p-1)$. {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \newpage \item (10 points) Let $x\in\bbZ_p^*$, let $h$ be the order of $x$ in $(\bbZ_p^*,\times)$, and let $k$ be a positive integer. Let $r$ denote the order of $y=x^k \mod p\in \bbZ_p^*$. Show that $r=\frac{h}{d}\in \bbZ$ where $d$ denotes the greatest common divisor of $h$ and $k$.\newline \textbf{Hint:} Use part (a) and prove that $r$ divides $\frac{h}{d}$ and $\frac{h}{d}$ divides $r$. {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \newpage \item (5 points) Let $p>2$ be a prime, and $a\in (\bbZ_p^*,\times)$. Then, show that the element $b=a^{\frac{p-1}{2}} \in (\bbZ_p^*,\times)$ is equal to $1$ or has order $2$. {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \end{enumerate} \newpage %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%Problem 5%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% \item {\bfseries Defining Multiplication over $\bbZ_{27}^*$ (5+10+10 points).} In the class, we had considered the group $(\bbZ_{26},+)$ to construct a one-time pad for a one-alphabet message. Can we define a group with 26 elements using a ``multiplication''-like operation? This problem will help you define the $(\bbZ_{27}^*,\times)$ group, which has 26 elements. {\bfseries The first attempt from class.} Recall that in class we saw that the following is also a group. $$ (\bbZ_{27}\setminus\{0,3,6,9,12,15,18,21,24\},\times),$$ where $\times$ is integer multiplication $\mod 27$. However, the set had only 18 elements. In this problem, we shall define $(\bbZ_{27}^*,\times)$ in a different manner such that the set has 26 elements. {\bfseries A new approach.} Interpret $\bbZ_{27}^*$ as the set of all triplets $(a_0,a_1,a_2)$ such that $a_0,a_1,a_2 \in \bbZ_3$ and at least one of them is non-zero. Intuitively, you can think of the triplets as the ternary representation of the elements in $\bbZ_{27}^*$. We interpret the triplet $(a_0,a_1,a_2)$ as the polynomial $a_0 + a_1X + a_2X^2$. So, every element in $\bbZ_{27}^*$ has an associated non-zero polynomial of degree at most 2, and every non-zero polynomial of degree at most 2 has an element in $\bbZ_{27}^*$ associated with it. The multiplication ($\times$ operator) of the element $(a_0,a_1,a_2)$ with the element $(b_0,b_1,b_2)$ is defined as the element corresponding to the polynomial $$(a_0 + a_1X + a_2X^2) \times (b_0 + b_1X + b_2X^2) \mod 2 + 2X + X^3$$ The multiplication ($\times$ operator) of the element $(a_0,a_1,a_2)$ with the element $(b_0,b_1,b_2)$ is defined as follows. %%%%%% \begin{boxedminipage}{\linewidth} Input $(a_0,a_1,a_2)$ and $(b_0,b_1,b_2)$. \begin{enumerate}[label=\roman*.] \item Define $A(X) \defeq a_0 + a_1X + a_2X^2$ and $B(X) \defeq b_0+b_1X+b_2X^2$ \item Compute $C(X) \defeq A(X)\times B(X)$ (interpret this step as ``multiplication of polynomials with integer coefficients'') \item Compute $R(X) \defeq C(X) \mod 2+2X+X^3$ (interpret this as step as taking a remainder where one treats both polynomials as polynomials with integer coefficients). Let $R(X) = r_0 + r_1X + r_2X^2$ \item Return $(c_0,c_1,c_2) = (r_0\mod 3, \; r_1\mod 3, \; r_2\mod 3)$ \end{enumerate} \end{boxedminipage} %%%%%% For example, the multiplication $(0,1,1)\times (1,1,2)$ is computed in the following way. \begin{enumerate}[label=\roman*.] \item $A(X) = X + X^2$ and $B(X) = 1+X+2X^2$. \item $C(X) = X + 2X^2 + 3X^3 + 2X^4$. \item $R(X) = -6-9X-2X^2$. \item $(c_0,c_1,c_2) = (0,0,1)$. \end{enumerate} According to \underline{this definition} of the $\times$ operator, solve the following problems. \begin{enumerate} \item (5 points) Evaluate $(0,2,2) \times (2,1,2).$ {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \newpage \item (10 points) Note that $e=(1,0,0)$ is an identity element. Find the inverse of $(1,0,2)$. {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \newpage \item (10 points) Assume that $(\bbZ_{27}^*,\times)$ is a group. Find the order of the element $(2,1,0)$. (Recall that, in a group $(G,\circ)$, the order of an element $x\in G$ is the smallest positive integer $h$ such that $\overbrace{x\circ x \circ \dotsi \circ x}^{h\text{-times}} = e$) {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \end{enumerate} %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%Problem 6 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% \newpage \item {\bfseries Special Group: Elliptic Curve Group (1+2+4+3+1+2 points).} Throughout this problem, $K$ is a field whose characteristic is neither $2$ nor $3$, and $a, b \in K$ satisfy $4a^3 + 27b^2 \neq 0.$ An elliptic curve over $K$ is the graph $E$ of an equation $Y^2 = X^3 + aX + b$ where $X, Y \in K.$ The condition $4a^3 + 27b^2 \neq 0$ says that the cubic $X^3 + aX + b$ has no repeated root; without it the graph has a singular point, at which the addition rule below breaks down. The elliptic curve group is the set $E \cup \left\{\infty\right\},$ where $\infty$ is one extra point, the point at infinity, which serves as the identity of the group. Note that the point $\infty$ is not a point on the graph $Y^2 = X^3 + aX + b.$ \begin{enumerate} \item \textbf{Addition Rule.} Let $P = (x, y)$ be a point on the elliptic curve $E \colon \;Y^2 = X^3 + aX + b,$ and define $-P \defeq (x, -y),$ the reflection of $P$ in the $x$-axis. Let $P = (x_p, y_p)$ and $Q = (x_q, y_q)$ be two points on $E.$ If $x_p \neq x_q,$ so that the two points are not on the same vertical line, define $P + Q \defeq -R,$ where $R$ is the third point at which the straight line through $P$ and $Q$ meets $E.$ If $x_p = x_q$ and $y_p \neq y_q,$ so that the two points are distinct and lie on the same vertical line, then $y_q = -y_p$ and $Q = -P;$ in this case, define $P + Q \defeq \infty,$ the identity of the elliptic curve group. The one remaining case, $P = Q,$ is handled by the tangent line rule in part (iii) below. Moreover, define $P + \infty = \infty + P = P$ for every $P \in E \cup \left\{\infty\right\}.$ \begin{enumerate} \item (1 point) Consider $E \colon\; Y^2 = X^3 - 4X - 5$ over $\bbF_{17}.$ Let $P = (4, 3)$ and $Q = (9, 12).$ Check that $P$ and $Q$ are points on $E.$ {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \vfill \item (2 points) Compute $P + Q.$ {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \vfill \item (4 points) To add a point $P \neq \infty$ to itself, draw a tangent line on the elliptic curve $E$ at point $P.$ If the line is vertical, then $P + P = \infty.$ If the tangent line is not vertical, then it intersects $E$ at exactly one more point. For $P = (4, 3), Q = (9, 12)$ and $-R = P + Q,$ compute $P + P, Q + Q$ and $R + R.$ {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \vfill \end{enumerate} \newpage \item \textbf{Deriving the addition formulas.} Consider elliptic curve $E \colon \; Y^2 = X^3 + aX +b$ over field $K.$ Let $P = (x_p, y_p), Q = (x_q, y_q)$ be two points on $E.$ Let $-R = P + Q = (x_r, -y_r).$ The formulas below, together with the case analysis of part (a), show that $+$ is a well defined operation on $E \cup \left\{\infty\right\},$ that $\infty$ is its identity, and that $-P$ is the inverse of $P.$ Associativity holds as well, but proving it is a longer computation that we do not carry out here. We will show the following. \begin{enumerate} \item (3 points) Let $Y = mX + t$ be the line intersecting $P$ and $Q.$ Assume $x_p \neq x_q.$ Let $m = \frac{y_p - y_q}{x_p - x_q}$ be the slope of the line. Show that $x_r = m^2 - x_p - x_q$ and $y_r = y_p - m (x_p - x_r).$ (Hint: Recall Vieta's formulas for a degree $3$ polynomial $a_3X^3 + a_2 X^2 + a_1X + a_0 = 0$ over a field $K,$ where $a_0, a_1, a_2, a_3 \in K$ and $a_3 \neq 0.$ Let $r_1, r_2, r_3 \in K$ be the roots of the polynomial. The following equalities hold. $$\begin{cases} r_1 + r_2 + r_3 = - \frac{a_2}{a_3} \\ r_1r_2 + r_2r_3 + r_1r_3 = \frac{a_1}{a_3} \\ r_1r_2r_3 = -\frac{a_0}{a_3} \end{cases}.$$ ) {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \vfill \item (1 point) Show that if $x_p = x_q$ and $y_p = -y_q,$ then $P + Q = \infty.$ {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \vfill \item (2 points) Show that if $x_p = x_q$ and $y_p = y_q \neq 0,$ then $x_r = m^2 - 2x_p$ and $y_r = y_p - m(x_p - x_r)$ with $m = \frac{3x_p^2 + a}{2y_p}.$ {\bfseries Solution.} \ %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE \vfill \end{enumerate} \end{enumerate} \end{enumerate} \end{document}