Carmichael function

In number theory, a branch of mathematics, the Carmichael function of a positive integer is the smallest positive integer such that

:<math>a^m \equiv 1 \pmod{n}</math>

holds for every integer coprime to . In algebraic terms, is the exponent of the multiplicative group of integers modulo . As this is a finite abelian group, there must exist an element whose order equals the exponent, . Such an element is called a primitive -root modulo .

thumb|upright=2|Carmichael function: for (compared to Euler function)|none

The Carmichael function is named after the American mathematician Robert Carmichael who defined it in 1910. It is also known as Carmichael's λ function, the reduced totient function, and the least universal exponent function.

The order of the multiplicative group of integers modulo is , where is Euler's totient function. Since the order of an element of a finite group divides the order of the group, divides . The following table compares the first 36 values of and (in bold if they are different; the values of such that they are different are listed in ).

{| class="wikitable" style="text-align: center;"

! scope="col" |

! scope="col" | 1

! scope="col" | 2

! scope="col" | 3

! scope="col" | 4

! scope="col" | 5

! scope="col" | 6

! scope="col" | 7

! scope="col" | 8

! scope="col" | 9

! scope="col" | 10

! scope="col" | 11

! scope="col" | 12

! scope="col" | 13

! scope="col" | 14

! scope="col" | 15

! scope="col" | 16

! scope="col" | 17

! scope="col" | 18

! scope="col" | 19

! scope="col" | 20

! scope="col" | 21

! scope="col" | 22

! scope="col" | 23

! scope="col" | 24

! scope="col" | 25

! scope="col" | 26

! scope="col" | 27

! scope="col" | 28

! scope="col" | 29

! scope="col" | 30

! scope="col" | 31

! scope="col" | 32

! scope="col" | 33

! scope="col" | 34

! scope="col" | 35

! scope="col" | 36

! scope="row" |

| 1 || 1 || 2 || 2 || 4 || 2 || 6 || 2 || 6 || 4 || 10 || 2 || 12 || 6 || 4 || 4 || 16 || 6 || 18 || 4 || 6 || 10 || 22 || 2 || 20 || 12 || 18 || 6 || 28 || 4 || 30 || 8 || 10 || 16 || 12 || 6

! scope="row" |

| 1 || 1 || 2 || 2 || 4 || 2 || 6 || 4 || 6 || 4 || 10 || 4 || 12 || 6 || 8 || 8 || 16 || 6 || 18 || 8 || 12 || 10 || 22 || 8 || 20 || 12 || 18 || 12 || 28 || 8 || 30 || 16 || 20 || 16 || 24 || 12

Numerical examples

. The set of numbers less than and coprime to 5 is }. Hence Euler's totient function has value and the value of Carmichael's function, , must be a divisor of 4. The divisor 1 does not satisfy the definition of Carmichael's function since <math>a^1 \not\equiv 1\pmod{5}</math> except for <math>a\equiv1\pmod{5}</math>. Neither does 2 since <math>2^2 \equiv 3^2 \equiv 4 \not\equiv 1\pmod{5}</math>. Hence . Indeed, <math>1^4\equiv 2^4\equiv 3^4\equiv 4^4\equiv1\pmod{5}</math>. Both 2 and 3 are primitive -roots modulo 5 and also primitive roots modulo 5.
. The set of numbers less than and coprime to 8 is . Hence and must be a divisor of 4. In fact since <math>1^2\equiv 3^2\equiv 5^2\equiv 7^2\equiv1\pmod{8}</math>. The primitive -roots modulo 8 are 3, 5, and 7. There are no primitive roots modulo 8.

Recurrence for

The Carmichael lambda function of a prime power can be expressed in terms of the Euler totient. Any number that is not 1 or a prime power can be written uniquely as the product of distinct prime powers, in which case of the product is the least common multiple of the of the prime power factors. Specifically, is given by the recurrence

:<math>\lambda(n) = \begin{cases}

\varphi(n) & \text{if }n\text{ is 1, 2, 4, or an odd prime power,}\\

\tfrac12\varphi(n) & \text{if }n=2^r,\ r\ge3,\\

\operatorname{lcm}\Bigl(\lambda(n_1),\lambda(n_2),\ldots,\lambda(n_k)\Bigr) & \text{if }n=n_1n_2\ldots n_k\text{ where }n_1,n_2,\ldots,n_k\text{ are powers of distinct primes.}

\end{cases}</math>

Euler's totient for a prime power, that is, a number with prime and , is given by

:<math>\varphi(p^r) p^{r-1}(p-1).</math>

Carmichael's theorems

Carmichael proved two theorems that, together, establish that if is considered as defined by the recurrence of the previous section, then it satisfies the property stated in the introduction, namely that it is the smallest positive integer such that <math>a^m\equiv 1\pmod{n}</math> for all relatively prime to .

This implies that the order of every element of the multiplicative group of integers modulo divides . Carmichael calls an element for which <math>a^{\lambda(n)}</math> is the least power of congruent to 1 (mod ) a primitive λ-root modulo n. (This is not to be confused with a primitive root modulo , which Carmichael sometimes refers to as a primitive <math>\varphi</math>-root modulo .)

If is one of the primitive -roots guaranteed by the theorem, then <math>g^m\equiv1\pmod{n}</math> has no positive integer solutions less than , showing that there is no positive such that <math>a^m\equiv 1\pmod{n}</math> for all relatively prime to .

The second statement of Theorem 2 does not imply that all primitive -roots modulo are congruent to powers of a single root . For example, if , then while <math>\varphi(n)=8</math> and <math>\varphi(\lambda(n))=2</math>. There are four primitive -roots modulo 15, namely 2, 7, 8, and 13 as <math>1\equiv2^4\equiv8^4\equiv7^4\equiv13^4</math>. The roots 2 and 8 are congruent to powers of each other and the roots 7 and 13 are congruent to powers of each other, but neither 7 nor 13 is congruent to a power of 2 or 8 and vice versa. The other four elements of the multiplicative group modulo 15, namely 1, 4 (which satisfies <math>4\equiv2^2\equiv8^2\equiv7^2\equiv13^2</math>), 11, and 14, are not primitive -roots modulo 15.

For a contrasting example, if , then <math>\lambda(n)=\varphi(n)=6</math> and <math>\varphi(\lambda(n))=2</math>. There are two primitive -roots modulo 9, namely 2 and 5, each of which is congruent to the fifth power of the other. They are also both primitive <math>\varphi</math>-roots modulo 9.

Properties of the Carmichael function

In this section, an integer <math>n</math> is divisible by a nonzero integer <math>m</math> if there exists an integer <math>k</math> such that <math>n = km</math>. This is written as

:<math>m \mid n.</math>

A consequence of minimality of

Suppose for all numbers coprime with . Then .

Proof: If with , then

:<math>a^r = 1^k \cdot a^r \equiv \left(a^{\lambda(n)}\right)^k\cdot a^r = a^{k\lambda(n)+r} = a^m \equiv 1\pmod{n}</math>

for all numbers coprime with . It follows that since and is the minimal positive exponent for which the congruence holds for all coprime with .

divides

This follows from elementary group theory, because the exponent of any finite group must divide the order of the group. is the exponent of the multiplicative group of integers modulo while is the order of that group. In particular, the two must be equal in the cases where the multiplicative group is cyclic due to the existence of a primitive root, which is the case for odd prime powers.

We can thus view Carmichael's theorem as a sharpening of Euler's theorem.

Divisibility

:<math> a\,|\,b \Rightarrow \lambda(a)\,|\,\lambda(b) </math>

Proof.

By definition, for any integer <math>k</math> with <math>\gcd(k,b) = 1</math> (and thus also <math>\gcd(k,a) = 1</math>), we have that <math> b \,|\, (k^{\lambda(b)} - 1)</math> , and therefore <math> a \,|\, (k^{\lambda(b)} - 1)</math>. This establishes that <math>k^{\lambda(b)}\equiv1\pmod{a}</math> for all relatively prime to . By the consequence of minimality proved above, we have <math> \lambda(a)\,|\,\lambda(b) </math>.

Composition

For all positive integers and it holds that

:<math>\lambda(\mathrm{lcm}(a,b)) = \mathrm{lcm}(\lambda(a), \lambda(b))</math>.

This is an immediate consequence of the recurrence for the Carmichael function.

<!--

Proof goes as follows:

Write a and b as product of prime powers

a = p1^x1·...·pt^xt

b = p1^y1·...·pt^yt

lambda(lcm(a,b))

= lambda(p1^max(x1,y1)·...·pt^max(xt,yt))

= lcm(lambda(p1^max(x1,y1)), ..., lambda(pt^max(xt,yt)))

= lcm(lcm(lambda(p1^x1),lambda(p1^y1)), ..., lcm(lambda(pt^xt),lambda(pt^yt)))

= lcm(lcm(lambda(p1^x1),...,lambda(pt^xt)), lcm(lambda(p1^y1),...,lambda(pt^yt)))

= lcm(lambda(p1^x1·...·pt^xt), lambda(p1^y1·...·pt^yt))

= lcm(lambda(a), lambda(b))

-->

Exponential cycle length

If <math>r_{\mathrm{max=\max_i\{r_i\}</math> is the biggest exponent in the prime factorization <math> n= p_1^{r_1}p_2^{r_2} \cdots p_{k}^{r_k} </math> of , then for all (including those not coprime to ) and all ,

:<math>a^r \equiv a^{\lambda(n)+r} \pmod n.</math>

In particular, for square-free (), for all we have

:<math>a \equiv a^{\lambda(n)+1} \pmod n.</math>

Average value

For any :

:<math>\frac{1}{n} \sum_{i \leq n} \lambda (i) = \frac{n}{\ln n} e^{B (1+o(1)) \ln\ln n / (\ln\ln\ln n) }</math>

(called Erdős approximation in the following) with the constant

:<math>B := e^{-\gamma} \prod_{p\in\mathbb P} \left({1 - \frac{1}{(p-1)^2(p+1)\right) \approx 0.34537 </math>

and , the Euler–Mascheroni constant.

The following table gives some overview over the first values of the function, for both, the exact average and its Erdős-approximation.

Additionally given is some overview over the more easily accessible with

There, the table entry in row number 26 at column

→ 60.49

indicates that 60.49% (≈ ) of the integers have meaning that the majority of the values is exponential in the length of the input , namely

:<math>\left(2^\frac45\right)^l = 2^\frac{4l}{5} = \left(2^l\right)^\frac45 = n^\frac45.</math>

:{| class="wikitable" style="text-align:right"

|- style="vertical-align:top"

! || || sum<br /><math>\sum_{i\le n} \lambda(i) </math> || average<br /><math>\tfrac1n \sum_{i\le n} \lambda(i) </math> || Erdős average || Erdős /<br>exact average || average || % > || % >

|5||31||270||8.709677||68.643||7.8813||0.678244||41.94 ||35.48

|6||63||964||15.301587||61.414||4.0136||0.699891||38.10 ||30.16

|7||127||3574||28.141732||86.605||3.0774||0.717291||38.58 ||27.56

|8||255||12994||50.956863||138.190||2.7119||0.730331||38.82 ||23.53

|9||511||48032||93.996086||233.149||2.4804||0.740498||40.90 ||25.05

|10||1023||178816||174.795699||406.145||2.3235||0.748482||41.45 ||26.98

|11||2047||662952||323.865169||722.526||2.2309||0.754886||42.84 ||27.70

|12||4095||2490948||608.290110||1304.810||2.1450||0.761027||43.74 ||28.11

|13||8191||9382764||1145.496765||2383.263||2.0806||0.766571||44.33 ||28.60

|14||16383||35504586||2167.160227||4392.129||2.0267||0.771695||46.10 ||29.52

|15||32767||134736824||4111.967040||8153.054||1.9828||0.776437||47.21 ||29.15

|16||65535||513758796||7839.456718||15225.43||1.9422||0.781064||49.13 ||28.17

|17||131071||1964413592||14987.40066||28576.97||1.9067||0.785401||50.43 ||29.55

|18||262143||7529218208||28721.79768||53869.76||1.8756||0.789561||51.17 ||30.67

|19||524287||28935644342||55190.46694||101930.9||1.8469||0.793536||52.62 ||31.45

|20||1048575||111393101150||106232.8409||193507.1||1.8215||0.797351||53.74 ||31.83

|21||2097151||429685077652||204889.9090||368427.6||1.7982||0.801018||54.97 ||32.18

|22||4194303||1660388309120||395867.5158||703289.4||1.7766||0.804543||56.24 ||33.65

|23||8388607||6425917227352||766029.1187||1345633||1.7566||0.807936||57.19 ||34.32

|24||16777215||24906872655990||1484565.386||2580070||1.7379||0.811204||58.49 ||34.43

|25||33554431||96666595865430||2880889.140||4956372||1.7204||0.814351||59.52 ||35.76

|26||67108863||375619048086576||5597160.066||9537863||1.7041||0.817384||60.49 ||36.73

Prevailing interval

For all numbers and all but positive integers (a "prevailing" majority):

:<math>\lambda(n) = \frac{n} {(\ln n)^{\ln\ln\ln n + A + o(1)</math>

with the constant

Minimal order

For any sequence of positive integers, any constant , and any sufficiently large :

:<math>\lambda(n_i) > \left(\ln n_i\right)^{c\ln\ln\ln n_i}.</math>

Small values

For a constant and any sufficiently large positive , there exists an integer such that

:<math>\frac{x}{(\ln x)^{\eta+o(1) ,</math>

where

:<math>\eta=1-\frac{1+\ln\ln2}{\ln2} \approx 0.08607</math>

Use in cryptography

The Carmichael function is important in cryptography due to its use in the RSA encryption algorithm.

Proof of Theorem 1

For , a prime, Theorem 1 is equivalent to Fermat's little theorem:

:<math>a^{p-1}\equiv1\pmod{p}\qquad\text{for all }a\text{ coprime to }p.</math>

For prime powers , , if

:<math>a^{p^{r-1}(p-1)}=1+hp^r</math>

holds for some integer , then raising both sides to the power gives

:<math>a^{p^r(p-1)}=1+h'p^{r+1}</math>

for some other integer <math>h'</math>. By induction it follows that <math>a^{\varphi(p^r)}\equiv1\pmod{p^r}</math> for all relatively prime to and hence to . This establishes the theorem for or any odd prime power.

Sharpening the result for higher powers of two

For coprime to (powers of) 2 we have for some integer . Then,

:<math>a^2 = 1+4h_2(h_2+1) = 1+8\binom{h_2+1}{2}=:1+8h_3</math>,

where <math>h_3</math> is an integer. With , this is written

:<math>a^{2^{r-2 = 1+2^r h_r.</math>

Squaring both sides gives

:<math>a^{2^{r-1=\left(1+2^r h_r\right)^2=1+2^{r+1}\left(h_r+2^{r-1}h_r^2\right)=:1+2^{r+1}h_{r+1},</math>

where <math>h_{r+1}</math> is an integer. It follows by induction that

:<math>a^{2^{r-2=a^{\frac{1}{2}\varphi(2^r)}\equiv 1\pmod{2^r}</math>

for all <math>r\ge3</math> and all coprime to <math>2^r</math>.

Integers with multiple prime factors

By the unique factorization theorem, any can be written in a unique way as

:<math> n= p_1^{r_1}p_2^{r_2} \cdots p_{k}^{r_k} </math>

where are primes and are positive integers. The results for prime powers establish that, for <math>1\le j\le k</math>,

:<math>a^{\lambda\left(p_j^{r_j}\right)}\equiv1 \pmod{p_j^{r_j\qquad\text{for all }a\text{ coprime to }n\text{ and hence to }p_i^{r_i}.</math>

From this it follows that

:<math>a^{\lambda(n)}\equiv1 \pmod{p_j^{r_j\qquad\text{for all }a\text{ coprime to }n,</math>

where, as given by the recurrence,

:<math>\lambda(n) = \operatorname{lcm}\Bigl(\lambda\left(p_1^{r_1}\right),\lambda\left(p_2^{r_2}\right),\ldots,\lambda\left(p_k^{r_k}\right)\Bigr).</math>

From the Chinese remainder theorem one concludes that

:<math>a^{\lambda(n)}\equiv1 \pmod{n}\qquad\text{for all }a\text{ coprime to }n.</math>