Today, we need to define the concept of a *subgroup*. If is a group, then is a *subgroup* of (written ) when

- The set of elements of is a subset of the set of elements of , and
- is also a group, under the
*same*binary operation as .

If then you can think of as a group “hiding inside” a bigger group .

Given some subset of the elements of , to see whether forms a subgroup we need to check just three things:^{1}

- is nonempty.
- is closed under the binary operation. This is a rather special property: if you pick any old subset of the elements of , chances are that combining two elements from your subset might result in something outside the subset (though of course it will still be in ).
- The inverse of any element of is also in . This is a special property too, for the same reason.

We *don’t* need to recheck associativity, since uses the same binary operation as . Note also that we don’t need to check whether has an identity element, since this is already implied by (1), (2) and (3): since is nonempty by (1), choose some . Then by (3), too, then by (2), is also in . (Previously I’ve been using to denote the binary operation of a group, but this is going to get tedious fast: from now on I will just omit writing an explicit symbol at all, and write instead of . This is standard group theory notation.)

Let’s see some examples. Remember the example group , which consists of the numbers through , with a binary operation of addition . Let’s first consider the subset . Is this is a subgroup of ? No, it isn’t: it’s not closed under the binary operation. For example, which is not in the subset.

, on the other hand, is indeed a subgroup of . It is obviously nonempty. We can check that combining any two elements of the set according to the binary operation lands us back in the set (adding two even numbers always results in an even number again), and the inverse of each element is in the set ( and are their own inverses, and and are inverses).

Any group is trivially a subgroup of itself (the “subset” in the definition does not have to be a *strict* subset). Also, the group with a single element is a subgroup of *any* group. So we have found three subgroups of . There is one more—can you find it?

Now we can state **Lagrange’s Theorem**: *if is a subgroup of , then the order of evenly divides the order of *.

We’ll spend the rest of the month proving this. Here’s an outline for the rest of the proof, one blog post for each item below. (The proof will not actually take quite as long as I thought!) Supposing is a subgroup of :

- Define some subsets of called the
*left cosets*of , and show that they all have the same size as . - Define (and prove) a certain
*equivalence relation*on elements of , defined in terms of . - Show that the
*equivalence classes*of any equivalence relation form a*partition*. - Show that the equivalence classes for the equivalence relation we defined are exactly the left cosets of . Conclude that since every coset of is the same size, and they partition , their common size (that is, the size of ) must evenly divide the size of . This will conclude the proof of Lagrange’s Theorem.
- In the final post, we will define the
*cyclic subgroup generated by*an element and show that the order of this subgroup is the same as the order of —hence by Lagrange’s Theorem the order of must divide the order of .

Onward!

- This is usually called the
*two-step subgroup test*(there are, of course,*three*conditions, but the condition that be nonempty is usually so trivial that it doesn’t count). There are other ways to check whether some subset is a subgroup, most notably the*one-step subgroup test*which, besides being nonempty, requires only that for every . It is a nice exercise in basic group theory to prove that this is equivalent.↩

]]>

Consider the set of all linear combinations of and , that is,

,

and suppose is the *smallest positive* integer in this set. For example, if and , then you can check that, for example, , and , and are all in this set, as is, for example, , but the smallest *positive* integer you can get is . We will prove that in fact, is the greatest common divisor of and .

Consider dividing by . This will result in some remainder such that . I claim the remainder is also of the form for some integers and : note that is of this form, and is of this form by definition, and we get the remainder by subtracting some number of copies of from . Subtracting two numbers of the form works by subtracting coefficients, yielding another number of the same form again. But is supposed to be the *smallest* positive number of this form, and is less than —which means has to be zero, that is, evenly divides . The same argument shows that evenly divides as well. So is a common divisor of and .

To see that is the *greatest* common divisor, suppose also divides and . Then since , we can see that must divide as well—so it must be less than or equal to .

Voila! This proof doesn’t show us how to actually *compute* some appropriate and given and —that can be done using the extended Euclidean algorithm; perhaps I’ll write about that some other time. But this proof will do for today.

For the remainder of the month, as suggested by commented janhrcek, we’ll prove the thing I hinted at in an earlier post: namely, that the order of any group element is always a *divisor* of the order of the group. This is a really cool proof that hints at some much deeper group theory.

]]>

Recall that we picked so that —we can always pick a divisor of that is less than (or equal to) the square root of . We then defined in terms of as

.

So how many elements are in the set ? That’s not too hard: there are choices for the coefficient , and choices for the coefficient ; each pair of choices gives a different element of , which therefore contains elements.

So what about the order of ? We got by throwing away elements from without an inverse. At least we know that doesn’t have an inverse. There might be more, depending on , but at least we can say that .

is in the group , and we showed that the order of an element cannot exceed the order of the group. But, check this out:

The order of the group is less than the order of ! This is a contradiction. So, our assumption that has a nontrivial divisor must be wrong— is prime!

It took 23 posts, but we have finally proved one direction of the Lucas-Lehmer test: if computing yields something divisible by , then is definitely prime.

And now I have to decide what to do with the remaining week. Of course, there is another direction to prove: we have only shown that the Lucas-Lehmer test correctly identifies primes (if is divisible by , then is prime), but it is possible to also prove the converse, that the Lucas-Lehmer test identifies *all* the Mersenne primes (if is prime, then will be divisible by ). I am still trying to figure out how difficult this proof is. I don’t think we’ll be able to fit it in the last 7 days of the month, but it still might be worth starting it and finishing it on a more relaxed schedule.

Of course, I’m also open to questions, suggestions, *etc.*!

]]>

and

which hold in the group . So what do these tell us about the order of ? Well, first of all, the second equation tells us that the order of must be a divisor of , and the only divisors of are other powers of . So the order of must be for some .

Now suppose the order of is , so . But then if we square both sides we get . Squaring again gives , and so on. So once we hit , we are stuck there: raising to all bigger powers of will also yield .

But now look at the first equation: . Remember that the order of has to be a power of . From this equation we can see that the order can’t be . Could it be a smaller power of two? In fact, no, it can’t, by the argument in the previous paragraph: once you hit a power of two that yields , all the higher powers also have to yield . So if raised to any smaller power of were the identity, then would also have to be the identity—but it isn’t.

The inescapable conclusion is that the only possibility for the order of is exactly .

So, how does that help? *Hint*: think about the order of the group … the triumphant conclusion tomorrow!

]]>

Remember that we started by assuming that passed the Lucas-Lehmer test, that is, that is divisible by . Remember that we also showed

for all . In fact, this proof is valid in too, if we take everything . The proof deals only with and , integers, and addition and multiplication. We know and are in , and we know that addition and multiplication can be interchanged with taking remainders. So what about integers like ? I claim that every nonzero integer (or, in particular, its remainder ) is in as well, if is prime.^{1} That is, for every integer , there is some other integer such that . This is because of something called *Bézout’s Identity* (which I should probably prove in another post, for completeness; it is not hard to prove): if and have a greatest common divisor , then there exist integers and such that . In this case, if is prime then any nonzero number less than has a gcd of with . So by Bézout’s Identity for any there are numbers and such that . Taken , this says that .

So our equation for in terms of and is valid as an equation in the group ; from here on all our equations will similarly “live in in -world”. We have to take everything though. In particular, If is divisible by , then is also divisible by (since divides ), which means in . Hence

.

Now we multiply both sides by . First, multiplying by itself results in an exponent of . For the other term, . We therefore now have

.

If we add to both sides, we get

(since ).

Squaring both sides also gives us

.

(To see that , you can either think of as acting like , or if you like you can expand it out to .)

Tomorrow we’ll see how to use some of the group properties we proved earlier to deduce from these equations the order of .

- Aha! Here’s where we need to be prime!↩

]]>

that is, combinations of and where the coefficients are between and . We defined a binary operation on which works by multiplying and then reducing the coefficients . This is not a group, since for example doesn’t have an inverse. But in the last post we saw that we can make a group simply by including only the elements from that do have inverses.

Recall that is in (as long as is not —which it can’t be, since is odd), and we know that , so has an inverse and we conclude .

You might enjoy figuring out what looks like in the case . Tomorrow, we’ll start thinking about the implications of our assumption that is divisible by , and in particular what it means about the order of in .

]]>

It turns out there is a very simple answer: *just throw away all the elements that don’t have inverses*! That is, given a monoid , form the subset of all the elements of that *do* have an inverse with respect to the binary operation. I claim that is in fact a group (under the same binary operation). Let’s prove it. We have to check that satisfies all the laws of a group.

- By assumption, there is some which is the identity for the binary operation. So in particular , which means that is its own inverse; so .
- We know all the elements in have an inverse in , but we still need to make sure those inverses actually end up in ! If then by definition has an inverse, , which means that . Note that these equations are completely symmetric: not only is the inverse for , we can also say that is the inverse for . So must be in too.
- If the binary operation is associative for then it will definitely be assocative for too (since associativity holds for
*all*elements of , of which is a subset). - There is one more crucial thing we have to check: it is not a priori clear that is even closed under the binary operation—might there be some such that is in but not in ?. But in fact if and both have inverses, then must have an inverse as well, namely, , since
.

(The fact that is sometimes called the “socks-shoes property”: you put on your socks first (), and then your shoes (); the inverse operation is to first take off your shoes (), then your socks ().)

So if and are in then must be as well.

]]>

along with a binary operation which works by multiplying and reducing coefficients . So, is this a group? Well, let’s check:

- It’s a bit tedious to prove formally, but the binary operation is in fact associative. Intuitively this follows from the fact that we could choose to do the reductions immediately, or delay them until after completing several multiplications—and we know that normal multiplication is indeed associative.
- is the identity for the operation.
- Do all elements in have inverses? Well… no! One simple counterexample is : there cannot possibly be any element such that . But is not the only one. Depending on the choice of , there can be many elements of without inverses. For example, when , you can check that and do not have inverses either (though the other elements do).

So is a *monoid* (it has an associative binary operation with an identity) but it is not a group, because not every element has an inverse. Argh! But we really need a group, so that we have something to which we can apply all those nifty facts we proved! Well, fear not, it turns out that there is a simple way to turn any monoid into a group. Do you have an idea? Tomorrow I’ll explain how, and prove that it does in fact result in a valid group.

]]>

If is not prime then it must have some nontrivial divisors. Note that divisors of any number always come in pairs that multiply to the given number, . If is a perfect square then the two divisors might be equal, but in general one divisor will be smaller than and one will be bigger. In any case, we know we can pick some divisor of , call it , such that .^{1}

Now define the set as follows:

.

That is, is the set of all things of the form where and are both integers between 0 (inclusive) and (exclusive). So (assuming is big enough) contains things like and and (just set ) and (set ). And, yes, you guessed it, also contains . It doesn’t seem to contain , but we’ll see in a minute that it actually sorta kinda does.

We now introduce a binary operation on elements of , which we want to be like multiplication. But if we just multiply two elements of in the obvious way we won’t necessarily end up with something in : the resulting coefficients and might be too big. So the operation we actually introduce is this: multiply in the usual way, and then at the end *reduce the coefficients and *. For example, if then

.

That is, we distribute out the product and collect up like terms, resulting in , and then take the remainder of both and when divided by .

Since we are considering coefficients equivalent , we can say that does contain in a sense, since . Indeed, we can check that

.

So this representation of still interacts with in the right way.

So, is a group? I’ll let you think about it until tomorrow!

Bruce, J. W. 1993. “A Really Trivial Proof of the Lucas-Lehmer Test.” *The American Mathematical Monthly* 100 (4). Mathematical Association of America: 370–71. http://www.jstor.org/stable/2324959.

- Bruce (1993) specifies that should be prime, but I cannot see what difference it makes. In any case we can easily ensure that is prime, if necessary.↩

]]>

So far:

- We defined and ; the Lucas-Lehmer test says that is prime if and only if is divisible by . Currently, we’re trying to prove the backwards direction: if is divisible by , then is prime.
- We defined and , and proved that , and .
- We learned the definition of groups, looked at some examples, and proved some simple facts, such as:
- Every element of a finite group has a finite order.
- The order of an element is at most the size of the group.
- If then the order of divides .

We’re now going to start the proof proper, which will be a proof by contradiction. So we will assume that is divisible by , but is *not* prime. From there:

- We will define a group that contains and as elements. The group will be defined in terms of a nontrivial divisor of .
- Using the facts we proved about groups, and the fact that divides , we will show that the order of has to be .
- Finally, we will show that the order of the group has to be less than —a contradiction, since the order of elements is never greater than the order of the group.

Tomorrow: we’ll start in on defining the crucial group that contains .

]]>