Linear Congruences and Diophantine Equations
Linear Congruences
Recall from Bezouts Identity and the Extended Euclidean Algorithm the method for finding the inverse of an integer in :
- Find . If it is not , there is no inverse.
- Find integers and such that , e.g. via the extended Euclidean algorithm.
- The inverse of in is the value of the coefficient , reduced modulo .
That method solves the congruence . The natural next question is the more general linear congruence
for given integers and and positive integer ; i.e. instead of asking "what undoes ", we are asking "what does send to ". We will look at two hands-on approaches first, and then build a general method that runs on the same EEA machinery as the inverse method.
Checking All Multiples
This one is just brute force, so I'm not gonna say much; since only matters modulo , there are only candidates to test, namely .
Example. Find all solutions to the linear congruence .
Testing every residue modulo :
The only residue that works is , since . Therefore, the congruence has exactly one solution, .
Example. Find all solutions to the linear congruence .
Testing every residue modulo :
This time two residues work. Therefore, the solutions are and ; notice that these can be packaged as the single statement .
Example. Find all solutions to the linear congruence .
Testing every residue modulo :
The outputs only ever cycle through and never hit . Therefore, this congruence has no solutions.
Notice how the same left-hand side against three different moduli produced one, two and zero solutions. Look at which values each table can reach: for we hit everything, for we only hit the even residues, and for we only hit the multiples of . In each case the reachable values are exactly the multiples of (which is , and respectively); this observation is basically the entire theory of linear congruences, and we will state it as a theorem shortly.
Using Rules of Modular Arithmetic
Brute force dies quickly as grows, so the second approach is to massage the congruence using the standard rules of modular arithmetic; adding multiples of the modulus to either side, replacing numbers by anything congruent to them, and cancelling common factors (carefully).
Example. Solve the same three congruences again, this time using rules of modular arithmetic.
For the modulus , notice that , so
For the modulus , every term and the modulus share a factor of , so we may divide the whole congruence (modulus included) through by , and then use :
which is or , agreeing with the table.
For the modulus , suppose a solution existed. Then , i.e. for some integer . But and , so divides the left-hand side, forcing ; this is false, so there are no solutions. Therefore, the three answers match the brute-force tables, with far less work.
It is important to remember that you can only cancel a common factor from both sides of a congruence if you also divide the modulus by the gcd of that factor and the modulus. Cancelling as if the modulus were untouched is probably the single most common error in this topic; here is what goes wrong.
Example. Find all solutions to .
The tempting (wrong) move is to cancel the and write . But check :
so is a perfectly good solution that the naive answer misses. The correct move: the factor being cancelled is , and , so the modulus must be divided by as well;
As residues modulo , this is . Therefore, there are four solutions modulo , and the naive cancellation silently threw away three of them.
Existence and Number of Solutions
The pattern spotted in the tables above is completely general.
Note
Theorem (Existence of Solutions to Linear Congruences)
Let and , and let . The linear congruence
has a solution if and only if . When , the solutions form exactly one congruence class modulo ; equivalently, there are exactly distinct solutions modulo .
Basically, is just the statement that for some integer ; i.e. that is an integer linear combination of and . We already know from Bezouts Identity and the Extended Euclidean Algorithm that the reachable values of such combinations are precisely the multiples of ; so if , the value is simply unreachable (this is exactly why the table never hit : every output was a multiple of ).
As for the count: the solutions form one class , and a single class modulo splits into separate classes modulo , namely
You can see this in the example: , the answer was one class , and modulo that class splits into the solutions and .
A General Method for Solving Linear Congruences
To solve in general, first consider simplifying with the rules of modular arithmetic as above; if the numbers are too large for that to be practical, the following method always works:
- Find . If , there is no solution; stop.
- Divide the congruence through by (modulus included) to get .
- Find the multiplicative inverse of modulo .
- The general solution is .
Equivalently, run the EEA directly on and to find integers and such that ; dividing that identity by gives , which says precisely that this same is the inverse of modulo . Either way,
If we want to list all solutions in the original modulus , take the solution and repeatedly add until there are different values;
Reading Everything Off the EEA Table
Almost all the information the method needs is already sitting in the EEA table for and :
Usually we have , so in practice the table is seeded with first and the roles of the two bottom rows swap. The safe habit is to identify via the column property ; is whichever entry multiplies , not whichever row you memorised.
Notice also why the last column is always and : that column has , so its entries satisfy , and after dividing by the smallest integer pair achieving is , (since and are coprime). This makes the last column a free arithmetic check on the whole table.
Example. Solve .
Run the EEA on and :
So , and , so solutions exist. The second-last column gives
and since is the coefficient of , we have . (Quick check on the last column: and , as promised.) Therefore,
Sanity check: . Therefore, the general solution is ; as the separate solutions modulo the original modulus, .
Alternatively, the rules of modular arithmetic crack this one with almost no work. Divide through by (which divides the modulus too):
cancelling the in the last step is legal because . Same answer; it is always worth scanning for shortcuts like this before committing to a full table.
Example. Find all solutions to .
Here and , so solutions exist and there will be seven of them modulo . Divide everything through by :
Sanity check: . Listing the solutions modulo the original modulus by repeatedly adding :
exactly solutions, matching the existence theorem. Therefore, the general solution is .
Linear Diophantine Equations
Note
Definition
A Diophantine equation is a polynomial equation whose solutions are required to be integers. A linear Diophantine equation is an equation of the form
for given integers , and .
Basically, over the reals is just a line with infinitely many points on it; the Diophantine question is which points on that line have both coordinates integers. The integer restriction is the entire difficulty (and the entire point).
Note
Theorem (Solutions of Linear Diophantine Equations)
Let with and not both zero, and let . The equation
has integer solutions if and only if . Moreover, if is any one particular solution, then the complete set of solutions is
The existence half is exactly the solvability theorem from Bezouts Identity and the Extended Euclidean Algorithm (the reachable values of are precisely the multiples of ), so we only prove the description of the solution family.
Proof. First, every member of the family really is a solution; the two shifts cancel exactly:
Conversely, no solutions are missed. Suppose is any solution; then subtracting from ,
Now divides the right-hand side, so it divides the left-hand side; but , so must divide itself. Writing for some and substituting back,
Basically, once you have found one lattice point on the line, all the others are evenly spaced along it, with the -coordinates stepping by and the -coordinates stepping by in the opposite direction. So a full answer to a Diophantine question always has two ingredients: a particular solution, and the step sizes.
The general method for finding the integer solutions of is:
- Consider the equation modulo (this eliminates the term, since ).
- Solve the resulting linear congruence .
- Write the solution for in terms of an arbitrary integer parameter .
- Substitute this back into the original equation and solve for in terms of .
Of course, we could equally consider the equation modulo and solve for first; pick whichever coefficient gives the easier congruence.
Example. Find all integer solutions to .
Here , and ; the left-hand side is always a multiple of no matter which integers are substituted, and is not. Therefore, there are no integer solutions. (Notice this is the same obstruction as the congruence from earlier; taking the equation mod produces exactly that unsolvable congruence.) Do not start hunting for particular solutions before the divisibility check passes.
Example. Find all integer solutions to .
Now , which certainly divides , so solutions exist. Consider the equation modulo :
which we solved at the start of this note; , i.e. for arbitrary . Substituting back into the original equation:
Check with : . Therefore, the complete set of solutions is
(Taking the equation mod instead gives , i.e. , and substituting back produces the same family; mod out by whichever coefficient you prefer.)
Solving Linear Diophantines with the EEA
Just as with congruences, the EEA table for and contains everything at once: the gcd for the divisibility check, a Bézout pair with in the second-last column, and the step sizes and sitting in the last column. Scaling the Bézout identity by gives the particular solution, and the theorem above gives the family:
Example. Find all integer solutions to , using the EEA instead.
The table is short enough to do by inspection: , so
giving , , . Multiplying through by :
so is a particular solution, and the steps are and . Therefore,
This looks different from the answer in the previous section, but it is the same set; two correct general solutions can look completely different, differing only by a shift of the parameter. Replacing by here gives , exactly the earlier family. To confirm two families agree, check that they share a particular solution and have the same step sizes.
Example. Solve over the integers.
Run the EEA on and :
So , and , so solutions exist with . The second-last column gives
i.e. and , and the last column confirms the steps and . Scaling by :
Check: . Therefore, the complete set of solutions is
Alternatively, by the congruence method: taking the equation modulo ,
so . Substituting back:
Therefore, ; the same set as before, since replacing by in the first family gives exactly this one.
One Congruence, Two Ways
It is important to note that linear congruences and linear Diophantine equations are the same problem wearing different clothes; says precisely that for some integer . So any congruence can be attacked as an equation, and vice versa, and the answers must agree.
Example. Solve (a) using a multiplicative inverse, and (b) as a Diophantine equation, and confirm the answers match.
(a) Since , the inverse of exists; by inspection , so . Multiplying both sides by :
(b) Rewrite the congruence as the equation . By inspection (or a two-line EEA), ; multiplying through by gives the particular solution , and the steps are , . So
The -values are exactly the congruence class (take ), matching part (a). Therefore, both methods give .
The decision between them: if the question only asks for , the congruence machinery is leaner (you never compute or carry ); if the question is stated as an equation, or you genuinely need both unknowns, work with the Diophantine form. Either way the underlying computation is the same EEA table, so choose whichever bookkeeping you find harder to fumble.
Restrictions on Solutions
Linear Diophantine equations often arise in contexts where the otherwise infinite solution set is restricted further; by far the most common restriction is that only positive (or non-negative) solutions make sense. The strategy is not to change the method at all: solve normally to get the complete family in terms of , then impose the restrictions, which turn into inequalities on ; typically only finitely many integers survive.
Example. Find all positive integer solutions to .
Since , solutions exist. Take the equation modulo :
so . Substituting back:
The complete integer family is . Now impose positivity;
so , giving and . Check: and . Therefore, there are exactly two positive solutions, and .
Example. A parcel requires exactly of postage, and you only have c stamps and c stamps. In how many ways can you make up the postage?
Working in cents, we need non-negative integer solutions to . First, and , so solutions exist; divide the whole equation by to keep the numbers small:
Take this modulo :
so . Substituting back:
Both stamp counts must be non-negative;
which forces , i.e. . Check: cents. Therefore, there is exactly one way: three c stamps and three c stamps.
Example. How many positive integer solutions does have?
Since , solutions exist. Take the equation modulo :
so . Substituting back:
Imposing positivity;
so , giving the solutions
Check one: . Therefore, there are exactly positive integer solutions.
Notice how in all of these, the restriction step is pure bookkeeping; once the family is parametrised, convert every condition into a bound on , intersect the bounds, and count the surviving integers. When rounding the bounds on , remember that means (round the upper bound down) and means (round the lower bound up); rounding these the wrong way quietly adds or deletes a solution.