Find gcd(a,n). If it is not 1, there is no inverse.
Find integers x and y such that 1=ax+ny, e.g. via the extended Euclidean algorithm.
The inverse of a in Zn is the value of the coefficient x, reduced modulo n.
That method solves the congruence ax≡1(modn). The natural next question is the more general linear congruence
ax≡c(modn),
for given integers a and c and positive integer n; i.e. instead of asking "what undoes a", we are asking "what does a send to c". We will look at two hands-on approaches first, and then build a general method that runs on the same EEA machinery as the inverse method.
This one is just brute force, so I'm not gonna say much; since x only matters modulo n, there are only n candidates to test, namely x∈{0,1,…,n−1}.
Example. Find all solutions to the linear congruence 6x≡4(mod7).
Testing every residue modulo 7:
x
0
1
2
3
4
5
6
6xmod7
0
6
5
4
3
2
1
The only residue that works is x=3, since 6×3=18=2×7+4. Therefore, the congruence has exactly one solution, x≡3(mod7).
Example. Find all solutions to the linear congruence 6x≡4(mod8).
Testing every residue modulo 8:
x
0
1
2
3
4
5
6
7
6xmod8
0
6
4
2
0
6
4
2
This time two residues work. Therefore, the solutions are x≡2 and x≡6(mod8); notice that these can be packaged as the single statement x≡2(mod4).
Example. Find all solutions to the linear congruence 6x≡4(mod9).
Testing every residue modulo 9:
x
0
1
2
3
4
5
6
7
8
6xmod9
0
6
3
0
6
3
0
6
3
The outputs only ever cycle through {0,3,6} and never hit 4. Therefore, this congruence has no solutions.
Notice how the same left-hand side against three different moduli produced one, two and zero solutions. Look at which values each table can reach: for n=7 we hit everything, for n=8 we only hit the even residues, and for n=9 we only hit the multiples of 3. In each case the reachable values are exactly the multiples of gcd(6,n) (which is 1, 2 and 3 respectively); this observation is basically the entire theory of linear congruences, and we will state it as a theorem shortly.
Brute force dies quickly as n grows, so the second approach is to massage the congruence using the standard rules of modular arithmetic; adding multiples of the modulus to either side, replacing numbers by anything congruent to them, and cancelling common factors (carefully).
Example. Solve the same three congruences again, this time using rules of modular arithmetic.
For the modulus 7, notice that 6≡−1(mod7), so
6x−xxx≡4(mod7)≡4(mod7)≡−4(mod7)≡3(mod7).
For the modulus 8, every term and the modulus share a factor of 2, so we may divide the whole congruence (modulus included) through by 2, and then use 3≡−1(mod4):
which is x≡2 or 6(mod8), agreeing with the table.
For the modulus 9, suppose a solution existed. Then 9∣6x−4, i.e. 6x−9k=4 for some integer k. But 3∣6x and 3∣9k, so 3 divides the left-hand side, forcing 3∣4; this is false, so there are no solutions. Therefore, the three answers match the brute-force tables, with far less work.
It is important to remember that you can only cancel a common factor from both sides of a congruence if you also divide the modulus by the gcd of that factor and the modulus. Cancelling as if the modulus were untouched is probably the single most common error in this topic; here is what goes wrong.
Example. Find all solutions to 4x≡8(mod12).
The tempting (wrong) move is to cancel the 4 and write x≡2(mod12). But check x=5:
4×5=20=12+8≡8(mod12),
so x=5 is a perfectly good solution that the naive answer misses. The correct move: the factor being cancelled is 4, and gcd(4,12)=4, so the modulus must be divided by 4 as well;
4xx≡8(mod12)≡2(mod3).
As residues modulo 12, this is x≡2,5,8,11(mod12). Therefore, there are four solutions modulo 12, and the naive cancellation silently threw away three of them.
The pattern spotted in the tables above is completely general.
Note
Theorem (Existence of Solutions to Linear Congruences) Let a,c∈Z and n∈Z+, and let d=gcd(a,n). The linear congruence
ax≡c(modn)
has a solution if and only if d∣c. When d∣c, the solutions form exactly one congruence class modulo dn; equivalently, there are exactly d distinct solutions modulo n.
Basically, ax≡c(modn) is just the statement that ax+ny=c for some integer y; i.e. that c is an integer linear combination of a and n. We already know from Bezouts Identity and the Extended Euclidean Algorithm that the reachable values of such combinations are precisely the multiples of d=gcd(a,n); so if d∤c, the value c is simply unreachable (this is exactly why the 6x≡4(mod9) table never hit 4: every output was a multiple of 3).
As for the count: the solutions form one class x≡x0(moddn), and a single class modulo dn splits into d separate classes modulo n, namely
x0,x0+dn,x0+2dn,…,x0+(d−1)dn.
You can see this in the 6x≡4(mod8) example: d=2, the answer was one class x≡2(mod4), and modulo 8 that class splits into the d=2 solutions 2 and 6.
To solve ax≡c(modn) in general, first consider simplifying with the rules of modular arithmetic as above; if the numbers are too large for that to be practical, the following method always works:
Find d=gcd(a,n). If d∤c, there is no solution; stop.
Divide the congruence through by d (modulus included) to get dax≡dc(moddn).
Find the multiplicative inverse x′ of da modulo dn.
The general solution is x≡dcx′(moddn).
Equivalently, run the EEA directly on a and n to find integers x′ and y′ such that d=ax′+ny′; dividing that identity by d gives 1=dax′+dny′, which says precisely that this samex′ is the inverse of da modulo dn. Either way,
x≡dcx′(moddn).
If we want to list all d solutions in the original modulus n, take the solution dcx′ and repeatedly add dn until there are d different values;
Almost all the information the method needs is already sitting in the EEA table for a and n:
qi
⋯
qk
qk+1
ri
a
n
⋯
d
0
xi
1
0
⋯
x′
±dn
yi
0
1
⋯
y′
∓da
Usually we have a<n, so in practice the table is seeded with n first and the roles of the two bottom rows swap. The safe habit is to identify x′ via the column property ri=(first seed)xi+(second seed)yi; x′ is whichever entry multiplies a, not whichever row you memorised.
Notice also why the last column is always ±dn and ∓da: that column has ri=0, so its entries satisfy axi+nyi=0, and after dividing by d the smallest integer pair achieving daxi=−dnyi is xi=±dn, yi=∓da (since da and dn are coprime). This makes the last column a free arithmetic check on the whole table.
Example. Solve 111x≡75(mod321).
Run the EEA on 321 and 111:
qi
2
1
8
4
ri
321
111
99
12
3
0
xi
1
0
1
−1
9
−37
yi
0
1
−2
3
−26
107
So d=gcd(111,321)=3, and 3∣75, so solutions exist. The second-last column gives
3=321×9+111×(−26),
and since x′ is the coefficient of a=111, we have x′=−26. (Quick check on the last column: −37=−3111 and 107=3321, as promised.) Therefore,
Sanity check: 111×99=10989=34×321+75. ✓ Therefore, the general solution is x≡99(mod107); as the d=3 separate solutions modulo the original modulus, x≡99,206,313(mod321).
Alternatively, the rules of modular arithmetic crack this one with almost no work. Divide through by d=3 (which divides the modulus too):
111x37x111x4x4xx≡75(mod321)≡25(mod107)≡75(mod107), (multiplying by 3; fine since gcd(3,107)=1)≡75(mod107), (as 111≡4(mod107))≡396(mod107), (adding 3×107 to reach a multiple of 4)≡99(mod107),
cancelling the 4 in the last step is legal because gcd(4,107)=1. Same answer; it is always worth scanning for shortcuts like this before committing to a full table.
Example. Find all solutions to 14x≡21(mod35).
Here d=gcd(14,35)=7 and 7∣21, so solutions exist and there will be seven of them modulo 35. Divide everything through by 7:
14x2xxxx≡21(mod35)≡3(mod5)≡3×3(mod5), (as 2−1≡3(mod5), since 2×3=6≡1)≡9(mod5)≡4(mod5).
Sanity check: 14×4=56=35+21. ✓ Listing the solutions modulo the original modulus by repeatedly adding 735=5:
x≡4,9,14,19,24,29,34(mod35),
exactly d=7 solutions, matching the existence theorem. Therefore, the general solution is x≡4(mod5).
Definition
A Diophantine equation is a polynomial equation whose solutions are required to be integers. A linear Diophantine equation is an equation of the form
ax+by=c,
for given integers a, b and c.
Basically, over the reals ax+by=c is just a line with infinitely many points on it; the Diophantine question is which points on that line have both coordinates integers. The integer restriction is the entire difficulty (and the entire point).
Note
Theorem (Solutions of Linear Diophantine Equations) Let a,b,c∈Z with a and b not both zero, and let d=gcd(a,b). The equation
ax+by=c
has integer solutions if and only if d∣c. Moreover, if (x0,y0) is any one particular solution, then the complete set of solutions is
x=x0+dbk,y=y0−dak,k∈Z.
The existence half is exactly the solvability theorem from Bezouts Identity and the Extended Euclidean Algorithm (the reachable values of ax+by are precisely the multiples of d), so we only prove the description of the solution family.
Proof. First, every member of the family really is a solution; the two shifts cancel exactly:
Conversely, no solutions are missed. Suppose (x1,y1) is any solution; then subtracting ax0+by0=c from ax1+by1=c,
a(x1−x0)+b(y1−y0)a(x1−x0)da(x1−x0)=0=−b(y1−y0)=−db(y1−y0), (dividing by d).
Now db divides the right-hand side, so it divides the left-hand side; but gcd(da,db)=1, so db must divide x1−x0 itself. Writing x1−x0=dbk for some k∈Z and substituting back,
da⋅dbky1−y0=−db(y1−y0)=−dak.■
Basically, once you have found one lattice point on the line, all the others are evenly spaced along it, with the x-coordinates stepping by db and the y-coordinates stepping by da in the opposite direction. So a full answer to a Diophantine question always has two ingredients: a particular solution, and the step sizes.
The general method for finding the integer solutions of ax+by=c is:
Consider the equation modulo b (this eliminates the by term, since by≡0(modb)).
Solve the resulting linear congruence ax≡c(modb).
Write the solution for x in terms of an arbitrary integer parameter k.
Substitute this x back into the original equation and solve for y in terms of k.
Of course, we could equally consider the equation modulo a and solve for y first; pick whichever coefficient gives the easier congruence.
Example. Find all integer solutions to 6x+9y=4.
Here d=gcd(6,9)=3, and 3∤4; the left-hand side is always a multiple of 3 no matter which integers are substituted, and 4 is not. Therefore, there are no integer solutions. (Notice this is the same obstruction as the congruence 6x≡4(mod9) from earlier; taking the equation mod 9 produces exactly that unsolvable congruence.) Do not start hunting for particular solutions before the divisibility check passes.
Example. Find all integer solutions to 6x+7y=4.
Now gcd(6,7)=1, which certainly divides 4, so solutions exist. Consider the equation modulo 7:
6x≡4(mod7),
which we solved at the start of this note; x≡3(mod7), i.e. x=3+7k for arbitrary k∈Z. Substituting back into the original equation:
6(3+7k)+7y18+42k+7y7yy=4=4=−14−42k=−2−6k.
Check with k=0: 6×3+7×(−2)=18−14=4. ✓ Therefore, the complete set of solutions is
(x,y)=(3+7k,−2−6k),k∈Z.
(Taking the equation mod 6 instead gives 7y≡4(mod6), i.e. y≡4(mod6), and substituting back produces the same family; mod out by whichever coefficient you prefer.)
Just as with congruences, the EEA table for a and b contains everything at once: the gcd d for the divisibility check, a Bézout pair (x′,y′) with d=ax′+by′ in the second-last column, and the step sizes db and da sitting in the last column. Scaling the Bézout identity by dc gives the particular solution, and the theorem above gives the family:
x=dcx′+dbkandy=dcy′−dak,k∈Z.
Example. Find all integer solutions to 6x+7y=4, using the EEA instead.
The table is short enough to do by inspection: 7−6=1, so
1=6×(−1)+7×1,
giving d=1, x′=−1, y′=1. Multiplying through by dc=4:
4=6×(−4)+7×4,
so (x0,y0)=(−4,4) is a particular solution, and the steps are db=7 and da=6. Therefore,
(x,y)=(−4+7k,4−6k),k∈Z.
This looks different from the answer in the previous section, but it is the same set; two correct general solutions can look completely different, differing only by a shift of the parameter. Replacing k by k+1 here gives (3+7k,−2−6k), exactly the earlier family. To confirm two families agree, check that they share a particular solution and have the same step sizes.
Example. Solve 533x+182y=481 over the integers.
Run the EEA on 533 and 182:
qi
2
1
13
ri
533
182
169
13
0
xi
1
0
1
−1
14
yi
0
1
−2
3
−41
So d=gcd(533,182)=13, and 481=13×37, so solutions exist with dc=37. The second-last column gives
13=533×(−1)+182×3,
i.e. x′=−1 and y′=3, and the last column confirms the steps db=13182=14 and da=13533=41. Scaling by 37:
x0y0=37×(−1)=−37,=37×3=111.
Check: 533×(−37)+182×111=−19721+20202=481. ✓ Therefore, the complete set of solutions is
(x,y)=(−37+14k,111−41k),k∈Z.
Alternatively, by the congruence method: taking the equation modulo 182,
533x169x13x−xxx≡481(mod182)≡117(mod182), (reducing both numbers mod 182)≡9(mod14), (dividing by 13=gcd(169,182), modulus included)≡9(mod14), (as 13≡−1(mod14))≡−9(mod14)≡5(mod14),
It is important to note that linear congruences and linear Diophantine equations are the same problem wearing different clothes; ax≡c(modn) says precisely that ax+ny=c for some integer y. So any congruence can be attacked as an equation, and vice versa, and the answers must agree.
Example. Solve 5x≡3(mod11) (a) using a multiplicative inverse, and (b) as a Diophantine equation, and confirm the answers match.
(a) Since gcd(5,11)=1, the inverse of 5 exists; by inspection 5×9=45=44+1≡1(mod11), so 5−1≡9. Multiplying both sides by 9:
x≡9×3(mod11)≡27(mod11)≡5(mod11).
(b) Rewrite the congruence as the equation 5x+11y=3. By inspection (or a two-line EEA), 5×(−2)+11×1=1; multiplying through by 3 gives the particular solution (x0,y0)=(−6,3), and the steps are db=11, da=5. So
(x,y)=(−6+11k,3−5k),k∈Z.
The x-values −6+11k are exactly the congruence class x≡5(mod11) (take k=1), matching part (a). ✓ Therefore, both methods give x≡5(mod11).
The decision between them: if the question only asks for x, the congruence machinery is leaner (you never compute or carry y); if the question is stated as an equation, or you genuinely need both unknowns, work with the Diophantine form. Either way the underlying computation is the same EEA table, so choose whichever bookkeeping you find harder to fumble.
Linear Diophantine equations often arise in contexts where the otherwise infinite solution set is restricted further; by far the most common restriction is that only positive (or non-negative) solutions make sense. The strategy is not to change the method at all: solve normally to get the complete family in terms of k, then impose the restrictions, which turn into inequalities on k; typically only finitely many integers k survive.
Example. Find all positive integer solutions to 2x+5y=17.
Since gcd(2,5)=1∣17, solutions exist. Take the equation modulo 2:
5yy≡17(mod2)≡1(mod2), (as 5≡1 and 17≡1(mod2)),
so y=1+2k. Substituting back:
2x+5(1+2k)2xx=17=12−10k=6−5k.
The complete integer family is (x,y)=(6−5k,1+2k). Now impose positivity;
x≥1y≥1⟹6−5k≥1⟹k≤1,⟹1+2k≥1⟹k≥0,
so k∈{0,1}, giving (x,y)=(6,1) and (1,3). Check: 2×6+5×1=17 and 2×1+5×3=17. ✓ Therefore, there are exactly two positive solutions, (6,1) and (1,3).
Example. A parcel requires exactly $1.35 of postage, and you only have 20c stamps and 25c stamps. In how many ways can you make up the postage?
Working in cents, we need non-negative integer solutions to 20x+25y=135. First, gcd(20,25)=5 and 5∣135, so solutions exist; divide the whole equation by 5 to keep the numbers small:
4x+5y=27.
Take this modulo 4:
5yy≡27(mod4)≡3(mod4), (as 5≡1 and 27≡3(mod4)),
so y=3+4k. Substituting back:
4x+5(3+4k)4xx=27=12−20k=3−5k.
Both stamp counts must be non-negative;
x≥0y≥0⟹3−5k≥0⟹k≤0,⟹3+4k≥0⟹k≥0,
which forces k=0, i.e. (x,y)=(3,3). Check: 3×20+3×25=60+75=135 cents. ✓ Therefore, there is exactly one way: three 20c stamps and three 25c stamps.
Example. How many positive integer solutions does 7x+11y=300 have?
Since gcd(7,11)=1∣300, solutions exist. Take the equation modulo 7:
11y4yyyy≡300(mod7)≡6(mod7), (as 11≡4 and 300=42×7+6)≡2×6(mod7), (as 4−1≡2(mod7), since 4×2=8≡1)≡12(mod7)≡5(mod7),
so y=5+7k. Substituting back:
7x+11(5+7k)7xx=300=245−77k=35−11k.
Imposing positivity;
x≥1y≥1⟹35−11k≥1⟹k≤1134⟹k≤3,⟹5+7k≥1⟹k≥−74⟹k≥0,
so k∈{0,1,2,3}, giving the solutions
(x,y)=(35,5),(24,12),(13,19),(2,26).
Check one: 7×24+11×12=168+132=300. ✓ Therefore, there are exactly 4 positive integer solutions.
Notice how in all of these, the restriction step is pure bookkeeping; once the family is parametrised, convert every condition into a bound on k, intersect the bounds, and count the surviving integers. When rounding the bounds on k, remember that k≤1134 means k≤3 (round the upper bound down) and k≥−74 means k≥0 (round the lower bound up); rounding these the wrong way quietly adds or deletes a solution.