The Chinese Remaindering Algorithm

We start with the elementary case of the Chinese Remaindering Theorem (Theorem 1). Then we give a much more abstract version (Theorem 2). Then we state the Chinese Remaindering Theorem and the Chinese Remaindering Algorithm in the context of Euclidean domains.

Theorem 1 (Sun-Tsu, first century AD)   Let m mathend000# and n mathend000# be two relatively prime integers. Let s, t $\in$ $\mbox{${\mathbb Z}$}$ mathend000# be such that s m + t n = 1 mathend000#. For every a, b $\in$ $\mbox{${\mathbb Z}$}$ mathend000# there exists c $\in$ $\mbox{${\mathbb Z}$}$ mathend000# such that

$$\forall \in \mbox{${\mathbb Z}$} \left\{\vphantom{ \begin{array}{l} x \equiv a \mod{\, m} \\ x \equiv b \mod{\, n} \\ \end{array} }\right. \begin{array}{l} x \equiv a \mod{\, m} \\ x \equiv b \mod{\, n} \\ \end{array} \iff \equiv$$ (45)

where a convenient c mathend000# is given by

c  =  a + (b - a) s m = b + (a - b)t n (46)

Therefore for every a, b $\in$ $\mbox{${\mathbb Z}$}$ mathend000# the system of equations

$$\left\{\vphantom{ \begin{array}{l} x \equiv a \mod{\, m} \\ x \equiv b \mod{\, n} \\ \end{array} }\right. \begin{array}{l} x \equiv a \mod{\, m} \\ x \equiv b \mod{\, n} \\ \end{array}$$ (47)

has a solution.

Proof. First observe that Relation (46) implies

$$\equiv \equiv$$ (48)

Now assume that x $\equiv$ c mod m n mathend000# holds. This implies

$$\equiv \equiv$$ (49)

Thus Relations (48) and (49) lead to

$$\equiv \equiv$$ (50)

Conversly

• x $\equiv$ a mod m mathend000# implies x $\equiv$ c mod m mathend000# that is m mathend000# divides x - c mathend000# and
• x $\equiv$ b mod n mathend000# implies x $\equiv$ c mod n mathend000# that is n mathend000# divides x - c mathend000#.

Since m mathend000# and n mathend000# are relatively prime it follows that m n mathend000# divides x - c mathend000#. (Gauss Lemma). $\qedsymbol$

Theorem 2   Let R mathend000# be a commutative ring with unity and I₀, I₁,..., I_n-1 mathend000# be ideals of R mathend000#. We consider the direct product of residue class rings R/I₀ x ^... x R/I_n-1 mathend000# (additions and multiplications are computed componentwise) together with the homomorphism

$$\begin{array}{lll} R & \rightarrow & R/{I_0} \times \cdots \times... ...ngmapsto & ({\overline{r}}^{I_0}, \ldots, {\overline{r}}^{I_{n-1}}) \end{array}$$ (51)

Then we have

• The kernel of M mathend000# is ( $\cap_{{i = 0}}^{{n-1}}$ I_i) mathend000#.
• If the tuple ($\overline{{r_0}}^{{{I_0}}}_{{}}$,...,$\overline{{r_{n-1}}}^{{{I_{n-1}}}}_{{}}$) $\in$ R/I₀ x ^... x R/I_n-1 mathend000# has a pre-image r $\in$ R mathend000# then we have

  $$\forall \leq \leq \Longrightarrow \overline{{r_i}}^{{{I_i + I_j}}}_{{}} \overline{{r_j}}^{{{I_i + I_j}}}_{{}}$$ (52)

  
  

• M mathend000# is surjective iff for every i, j mathend000# such that 0 $\leq$ i < j $\leq$ n - 1 mathend000# we have I_i + I_j = R mathend000#.

Proof. The first statement is obvious. Let us prove the second one. Let r, r₀, r₁,..., r_n-1 mathend000# be in R mathend000#. We look for the pre-image of ($\overline{{r_0}}^{{{I_0}}}_{{}}$,...,$\overline{{r_{n-1}}}^{{{I_{n-1}}}}_{{}}$) mathend000#. Hence we look for r mathend000# such that

$$\overline{{r_0}}^{{{I_0}}}_{{}} \overline{{r_{n-1}}}^{{{I_{n-1}}}}_{{}}$$ (53)

that is

$$\overline{{r}}^{{{I_0}}}_{{}} \overline{{r_{n-1}}}^{{{I_{n-1}}}}_{{}} \overline{{r_0}}^{{{I_0}}}_{{}} \overline{{r_{n-1}}}^{{{I_{n-1}}}}_{{}}$$ (54)

or

$$\overline{{r - r_0}}^{{{I_0}}}_{{}} \overline{{r - r_1}}^{{{I_1}}}_{{}} \overline{{r - r_{n-1}}}^{{{I_{n-1}}}}_{{}}$$ (55)

At this point of the proof we need the following lemma. $\qedsymbol$

Lemma 1   Let a, b mathend000# be two elements of the ring R mathend000# (again commutative and with unity). Let I, J mathend000# be two ideals of R mathend000# such that $\overline{{a}}^{{I}}_{{}}$ = $\overline{{b}}^{{J}}_{{}}$ mathend000#. Then we have

$$\overline{{a}}^{{{I+J}}}_{{}} \overline{{b}}^{{{I+J}}}_{{}}$$ (56)

Proof. The equation $\overline{{a}}^{{I}}_{{}}$ = $\overline{{b}}^{{J}}_{{}}$ mathend000# means that the residue classe of a mathend000# in R/I mathend000# is equal to the residue classe of b mathend000# in R/J mathend000#. More formally we have

$$\in \in \in \in$$ (57)

or equivalently

$$\in \exists \in \in \exists \in$$ (58)

Since these sets are non empty this implies

$$\exists \in$$ (59)

Since J mathend000# is an ideal we have - v $\in$ J mathend000# and thus

$$\in$$ (60)

The lemma is proved. $\qedsymbol$

CONTINUING THEOREM'S

Proof. With the previous lemma Relation (55), for all i, j mathend000# such that 0 $\leq$ i < j $\leq$ n - 1 mathend000# holds, leads to

$$\overline{{r - r_i}}^{{{I_i + I_j}}}_{{}} \overline{{r - r_j}}^{{{I_i + I_j}}}_{{}}$$ (61)

or equivalently

$$\overline{{r_i}}^{{{I_i + I_j}}}_{{}} \overline{{r_j}}^{{{I_i + I_j}}}_{{}}$$ (62)

Relation (62) is a necessary condition for the existence of a pre-image of r mathend000# via the homomorphism M mathend000#. Therefore we proved the second statement of the theorem. Let us prove the third one.

Let us ssume first that M mathend000# is surjective. Let i, j mathend000# be such that 0 $\leq$ i < j $\leq$ n - 1 mathend000#. There exists r $\in$ R mathend000# such that

$$\overline{{r}}^{{{I_i}}}_{{}} \overline{{1}}^{{{I_i}}}_{{}} \overline{{r}}^{{{I_j}}}_{{}} \overline{{0}}^{{{I_j}}}_{{}}$$ (63)

Hence

$$\in \in$$ (64)

which implies I_i + I_j = 1 mathend000#. Conversly, let us assume that the ideals I₀,..., I_n-1 mathend000# are pairwise coprime. Let i mathend000# be in the range 0 ^... n - 1 mathend000# and consider the product I mathend000# of all ideals I₀,..., I_n-1 mathend000# except I_i mathend000#. It is a classical result that I_i mathend000# and I mathend000# are coprime. Let u_i $\in$ I_i mathend000# and v_i $\in$ I mathend000# such that u_i + v_i = 1 mathend000#. Observe that for all j = 0 ^... n - 1 mathend000# we have

$$\overline{{v_i}}^{{{I_i}}}_{{}} \overline{{1}}^{{{I_i}}}_{{}} \neq \Longrightarrow \overline{{v_i}}^{{{I_j}}}_{{}} \overline{{0}}^{{{I_j}}}_{{}}$$ (65)

Now consider ($\overline{{r_0}}^{{{I_0}}}_{{}}$,...,$\overline{{r_{n-1}}}^{{{I_{n-1}}}}_{{}}$) $\in$ R/I₀ x ^... x R/I_n-1 mathend000#. Then

r  =  v₀r₀ + ^... + v_n-1r_n-1 (66)

satisfies

$$\overline{{r_0}}^{{{I_0}}}_{{}} \overline{{r_{n-1}}}^{{{I_{n-1}}}}_{{}}$$ (67)

This concludes the proof of the theorem. $\qedsymbol$

Corollary 1   Let R mathend000# be a commutative ring with unity and I₀,..., I_n-1 mathend000# be ideals of R mathend000# such that we have I_i + I_j = R mathend000# for every i, j mathend000# with 0 $\leq$ i < j $\leq$ n - 1 mathend000#. Let I mathend000# be the product of the ideals I₀,..., I_n-1 mathend000#. Then we have the ring isomorphism

$$\simeq$$ (68)

and the group isomorphism of the multiplicative groups

$$\simeq$$ (69)

Proof. The following ring isomorphism follows from Theorem 2

$$\cap_{{{0 \leq i \leq n-1}}}^{{}} \simeq$$ (70)

It is a well known fact that if the ideals I₀,..., I_n-1 mathend000# are pairwise coprime ( I_i + I_j = R mathend000# for every i, j mathend000# with 0 $\leq$ i < j $\leq$ n - 1 mathend000#) then their product is equal to their intersection [van91]. Therefore, we have the ring isomorphism of the statement. The group isomorphism follows from the previous ring isomorphism and the fact that the element

$$\overline{{r_0}}^{{{I_0}}}_{{}} \overline{{r_{n-1}}}^{{{I_{n-1}}}}_{{}} \in$$ (71)

is a unit iff every $\overline{{r_{i}}}^{{{I_{i}}}}_{{}}$ mathend000# is a unit of R/I_i mathend000#. $\qedsymbol$

From now on R mathend000# denotes an Euclidean domain.

Corollary 2   Let m₀,..., m_n-1 mathend000# be n mathend000# elements pairwise coprime in the Euclidean domain R mathend000#. (Hence, for all 0 $\leq$ i < j < n mathend000# we have gcd(m_i, m_j) = 1 mathend000#.) Let m = m₀ ^... m_r-1 mathend000#. Then, we have the ring isomorphism

$$\simeq$$ (72)

and the group isomorphism of the multiplicative groups

$$\simeq$$ (73)

Proof. These are well known facts in an Euclidean domain R mathend000#.

• Every ideal I mathend000# of R mathend000# is generated by a single element. (That is, there exists an element r $\in$ R mathend000# such that I mathend000# is the set of the multiples of r mathend000# denoted by $\langle$r$\rangle$ mathend000#.)
• Two ideals $\langle$r$\rangle$ mathend000# and $\langle$s$\rangle$ mathend000# are coprime iff gcd(r, s) = 1 mathend000#.

Then the ring isomorphism and the groups isomorphism follow from Corollary 1 by considering the ideals I₀ = $\langle$m₀$\rangle$ mathend000#, ... I_n-1 = $\langle$m_n-1$\rangle$ mathend000#. $\qedsymbol$

Algorithm 4  

mathend000#

Proof. Assume that the algorithm terminates without error, that is the case if every g_i mathend000# is the gcd of m_i mathend000# and ${\frac{{m}}{{m_i}}}$ mathend000# (which are assumed to be coprime). Then, for i = 0 ^... n - 1 mathend000# we have

$${\frac{{m}}{{m_i}}}$$ (74)

Hence

$${\frac{{m}}{{m_i}}} \equiv$$ (75)

and for j = 0 ^... n - 1 mathend000# with j $\neq$ i mathend000# we have

$${\frac{{m}}{{m_i}}} \equiv$$ (76)

The specification of Algorithm 4 follow easily from Relation (75) and (76). $\qedsymbol$

Remark 6   It is important to observe that Algorithm 4 computes a solution r mathend000# of the system of equations given by

$$\equiv$$ (77)

Any other solution r' mathend000# of (77) satisfies r $\equiv$ r'mod m mathend000# where m mathend000# is the product of the moduli m₀,..., m_r-1 mathend000#. This follows from the fact the m_i mathend000#'s are pairwise coprime and from Corollary 2. Therefore the set all solutions of (77) is of the form

$$\in$$ (78)

However, in practice, we need only one solution. In the next two results (Theorem 3 and Theorem 4) by imposing

d (r)  <  d (m) (79)

where d mathend000# is the Euclidean size of R mathend000#, we manage to restrict to a unique solution.

Theorem 3   Let R = $\bf k$[x] mathend000# for a field $\bf k$ mathend000#. Let m₀,..., m_r-1 $\in$ R mathend000# be polynomials pairwise coprime ( gcd(m_i, m_j) = 1 mathend000# for 0 $\leq$ i < j $\leq$ r - 1 mathend000#). Let m mathend000# be their product. For 0 $\leq$ i $\leq$ r - 1 mathend000# let d_i $\geq$ 1 mathend000# be the degree of m_i mathend000# and n = $\Sigma_{{{i=0}}}^{{{r-1}}}$d_i mathend000# be the degree of m mathend000#. For 0 $\leq$ i $\leq$ r - 1 mathend000# let f_i $\in$ $\bf k$[x] mathend000# be a polynomial with degree deg(f_i) < d_i mathend000#. Then there is a unique polynomial f $\in$ $\bf k$[x] mathend000# such that

$$\equiv$$ (80)

Moreover it can be computed in $\cal {O}$(n²) mathend000# operations in $\bf k$ mathend000#.

Proof. Except for the complexity result (that can be found in [GG99] as Theorem 5.7) and the uniqueness, this theorem follows from Algorithm 4. The uniqueness follows from the constraint deg(f ) < n mathend000#. Indeed, assume that there are two polynomials f mathend000# and g mathend000# solutions of (80). Then we have

$$\equiv$$ (81)

and thus

$$\equiv$$ (82)

Hence m mathend000# divides f - g mathend000# although deg(m) = n > deg(f - g) mathend000# holds. Therefore f = g mathend000#. $\qedsymbol$

Theorem 4   Let m₀,..., m_r-1, m mathend000# be in R = $\mbox{${\mathbb Z}$}$ mathend000# such that the m_i mathend000#'s are pairwise coprime and m mathend000# is their product. Let n mathend000# be the word length of m mathend000#. Let a₀,..., a_r-1 $\in$ R mathend000# be such that 0 $\leq$ a_i < m_i mathend000# for i = 0 ^... r - 1 mathend000#. Then there is a unique a $\in$ R mathend000# such that

$$\leq \equiv$$ (83)

Moreover it can be computed in $\cal {O}$(n²) mathend000# word operations.

Proof. Except for the complexity result (that can be found in [GG99] as Theorem 5.8) and the uniqueness, this theorem follows from Algorithm 4. The proof of the uniqueness is quite easy to establish. $\qedsymbol$

We reproduce below the ALDOR code for the Chinese Remaindering Algorithm. More precisely, the operation interpolate satisfies exactly the specification of Algorithm 4. After the definition of the ChineseRemaindering domain we prove that its operation combine satisifies the specification of Algorithm 4 for the case of two moduli m₁ mathend000# and m₂ mathend000#. The reader is left with the proof of the operation interpolate which implements the general case (with r $\geq$ 2 mathend000# moduli).

ChineseRemaindering(E: EuclideanDomain): with {
        combine: 	(E, E) -> (E, E) -> E;
        interpolate: 	(List E, List E) -> E;
} == add {
        combine(m1: E, m2: E): (E, E) -> E == {
                local u1: E;
                assert(m1 = unitCanonical m1);
                assert(m2 = unitCanonical m2);
                fn(r1: E, r2: E): E == {
                        r1__new := r1 rem m1;
                        r := (r2 - r1__new) rem m2 ;
                        r :=  (r * u1) rem m2 ;
                        r := r1__new +  r * m1;
                }
                (u1, u2, g) := extendedEuclidean(m1, m2);
                fn
        }
        interpolate(lm: List E, lr: List E): E == {
                m := first lm;
                r := first lr rem m;
                for mi in rest lm for ri in rest lr repeat {
                        r := combine(m, mi)(r, ri);
                        m := m * mi;
                }
                return r;
        }
}

Proof. We need to prove that combine(m1,m2)(r1,r2) returns a qunatity congruent to that computed by Algorithm 4 modulo m₁ m₂ mathend000#.

According to Algorithm 4 the case of two moduli m₁ mathend000# and m₂ mathend000# requires the following computations

• r mathend000# := 0 mathend000#
• (u₁, v₁, g₁) mathend000# := extendedEuclidean(m₁, m₂ mathend000#)
• c₁ mathend000# := r₁v₁ mathend000# rem m₁ mathend000#
• r mathend000# := r + c₁m₂ mathend000#
• (u₂, v₂, g₂) mathend000# := extendedEuclidean(m₂, m₁ mathend000#)
• c₂ mathend000# := r₂v₂ mathend000# rem m₂ mathend000#
• r mathend000# := r + c₂m₁ mathend000#

This can be simplified as follows:

• (u₁, v₁, g₁) mathend000# := extendedEuclidean(m₁, m₂ mathend000#)
• c₁ mathend000# := r₁v₁ mathend000# rem m₁ mathend000#
• c₂ mathend000# := r₂u₁ mathend000# rem m₂ mathend000#
• r mathend000# := c₁m₂ + c₂m₁ mathend000#

From the relations

c1m2 $$\equiv$$ r1v1m2mod m1m2, c2m1 $$\equiv$$ r2u1m1mod m1m2, u1m1 + v1m2  =  1,

(84)

we deduce the following congruences mod m₁m₂ mathend000#

r	$$\equiv$$	c1m2 + c2m1
	$$\equiv$$	r1v1m2 + r2u1m1
	$$\equiv$$	r1(1 - u1m1) + r2u1m1
	$$\equiv$$	r1 + (r2 - r1)u1m1

(85)

This last expression is exactly the quantity computed by combine(m1,m2)(r1,r2). This proves the implementation of the above operation combine. $\qedsymbol$