Massachusetts Institute of Technology Lecture ?? 6.042J/18.062J: Mathematics for Computer Science September 19, 1996 Professors Nancy Lynch and Tom Leighton

Notes 5

Today we give an overview of set theory, including relations on sets. Probably much of the first part of this will be review from high school math.

We will define an interesting kind of relation called an equivalence relation. Give examples.

An important example is number equivalence mod m, for some positive integer m. Define this and give some of its properties. End with an application of modular equivalence ideas to get fast RSA encryption and decryption.

8 Sets

8.1 Definitions

A set is a collection of objects. (Collection, object are undefined terms.)

The order of elements is not important. Each element is included only once.

Examples of sets:

• {1, 2, 3}.

A simple finite set, obtained by enumerating all the elements.

• ∅, the empty set.

A special case of a finite set, with no elements.

• {∅}.

This funny set is different from ∅. It has one element, which is a set.

• {1, {1, 2}}.

This one contains two elements, one of which is a set itself.

The set happens to contain the other element 1, but that does not contradict the condition that an element is included only once.

• {n ∈ ℕ | n is even }.

An infinite set, specified by giving a universal set (domain of discourse) and a property.

We write that a ∈ A (“a is in A” or “a is an element of A”) if a is an object in the set A.

The empty set satisfies the proposition (∀x)x ∉ ∅.

Sets can be defined by axioms and deduction rules, giving a very formal axiomatic set theory. But usually, people reason about sets less formally, using naive set theory. Either way, set theory can be used as the basis for defining almost everything else in mathematics. Regarded as the most fundamental part of math.

E.g., natural numbers can be defined as certain kinds of sets (!). (With the right number of elements, e.g.) Then the Peano axioms about natural numbers can be proved as theorems of set theory, rather than being assumed.

Some typical axioms of axiomatic set theory: (Seem ridiculously obvious but aren’t)

• The axiom of extensionality says that two sets are equal iff they have the same elements.

E.g., the two sets {n ∈ ℕ | 2 divides n} and {2n | n ∈ ℕ}

are defined in different ways.

But they are “equal” as sets because they have exactly the same elements.

• The axiom of comprehension says that we can form a new set by including all objects of a given set that share a common property.

For example, {x ∈ ℝ | P (x)} where P (x) = “x is rational” denotes the set of all rational numbers. The axioms says that this is really considered to be a set.

The set building notation that we used above has given the universe of discourse explicitly. Sometimes, when this seems obvious, we will leave this out. Just like what we did for predicate quantifiers. E.g., we might write: {n | n is even }. if the universe ℕ seems clear. (Could be confusing – the universe could alternatively be the integers, positive and negative.)

Definition 8.1 We say that A ⊆ B (“A is a subset of B”) if every element of A is also an element of B (that is, (∀x)(x ∈ A ⟹ x ∈ B)).

Definition 8.2 We say that A is a proper subset of B (A ⊂ B) if A ⊆ B and A ≠ B.

Note (∀X)∅ ⊆ X

Q: Can we have both A ∈ B and A ⊆ B?

A: Yes, consider {1, {1}}.

Theorem 8.3 A = B if and only if A ⊆ B and B ⊆ A.

Proof by axiom of extensionality. Ignore here.

This observation is very important as it provides a simple way to prove that 2 sets are equal.

Example 1 Prove that the two sets {n ∈ ℕ | 2 divides n} and {2n | n ∈ ℕ} are equal.

Must show subset both ways. ⊆: Assume x ∈ ℕ and 2 divides n, and show that there is some y ∈ ℕ such that x = 2y. By def of divisibility. ⊇: Assume x = 2y. Then divisible, by def of divisibility.

Example 2 Slightly more interestingly:

The set of evens ≥ 2, i.e., {2n | n ∈ ℕ, n ≥ 1}, is equal to {x ∈ ℕ | ∃y, z odd , x = y + z}. If x = 2n, then write x = 1 + (x − 1), sum of two odds. If x = y + z, where both y and z are odd, then write y = 2a + 1, z = 2b + 1. Then x = 2(a + b + 1), which is even.

The size of a set A (the number of elements it contains) is written |A|. For finite sets, this is just a natural number. For infinite sets, this is written ∞.

8.2 Russell’s paradox

We might think that set theory is obvious, but this is not the case. Consider the set S = {x | x is a set}. This seems like a perfectly reasonable set (well, maybe a bit strange—note S ∈ S). If our set theory allows for such an entity, we get into trouble as follows.

Consider the set Q = {x | x is a set and x ∉ x}.

If S is a set, then so is this by standard axioms like comprehension. Note Q ⊆ S.

Then some sets are in Q and some aren’t.

Example of something in Q: The set A = {1, 2, 3} is not an element of itself, so A ∈ Q.

Example of something that is not in Q: The set P = { all infinite sets} is a set (by comprehension). Therefore, P ∈ P. So P ∉ Q.

The troublesome question is: is Q ∈ Q?

1. If Q ∈ Q then Q ∉ Q, a contradiction.

2. If Q ∉ Q then Q ∈ Q also a contradiction.

This is clearly a paradox. In fact, this paradox, at the time it was discovered by Russell (∼ 1900), was a blow to the then current attempts to formalize all of mathematics axiomatically.

Mathematicians had to work very hard to find a consistent set of axioms (note that a consistent set of axioms does not allow this paradox to arise).

The problem with naive set theory is that you can form a set by describing its members, as we did for Q above. Axiomatic set theory has a specific set of rules for how you can form sets—rules that don’t allow the set Q above to specified, and therefore avoid the paradox.

Fortunately, we’ll be working naively...

8.3 Basic set operations

There are several standard operations on sets. In axiomatic set theory, the claims that these operations yield new sets are axioms.

1. Union A ∪ B = {x | x ∈ A or x ∈ B}.

2. Intersection A ∩ B = {x | x ∈ A and x ∈ B}.

3. Difference A − B = {x | x ∈ A and x ∉ B}. Also written as A \ B.

4. Complement A^{c} = {x | x ∉ A}. Also written as Ā.

5. Symmetric difference A ⊕ B = A ∪ B − A ∩ B.

Venn diagrams

Union and intersection can be extended to apply to more than two sets. Given a finite collection of sets A_{i}, i = 1, …, n,

⋃_{i=1}^{n} A_{i}

is the set of elements in at least one of the A_{i}, and

⋂_{i=1}^{n} A_{i}

is the set of elements in all of the A_{i}. Both of these make sense if i = 1 – reduce to just A_{1}. In fact, for i = 0, default says union of no sets is ∅ and intersection of no sets is universal set.

Instead of using explicit index, can just consider a set of sets: If S is a set of sets, then

⋃ S

denotes the union of all the sets in S, in any order. (Can prove that the order doesn’t matter, will do below.) Likewise,

⋂ S

denotes the intersection of all the sets in S.

Complement is different from all the other operations, because it assumes some universe U from which we extract the things not in A. All sets in question are supposed to be subsets of U. A^{c} = U − A. The universe U is often implicit, where there seems to be little chance of confusion.

Correspondence between set operations and logical operations: set union vs. predicate or set intersection vs. predicate and set difference vs. predicate ??? p ∧ ¬q. set complement vs. predicate not set symmetric difference vs. predicate exclusive or. Predicates and sets often form alternative ways of looking at the same notions: Given predicates p and q, define P = {x | p(x)}, Q = {x | q(x)}. Then P ∪ Q = {x | p(x) ∨ q(x)}. Etc.

Power set (set of all subsets):

Another very important operation on sets is that of the power set of a given set A. It is denoted by P(A) and consists of the set of all subsets of A. In other words, P(A) = {x | x ⊆ A}.

In particular, for any set A, ∅ ∈ P(A) and A ∈ P(A). Ex: If A = {1, 2} then P(A) = {∅, {1}, {2}, {1, 2}}.

Theorem 8.4 If A has n elements, then P (A) has 2^{n} elements.

Proof. Ordinary Induction on n. BASE: n = 0. Then P (A) has one element, ∅. INDUCTIVE: Assume for n, prove for n + 1. Pick one element, a. The subsets can be divided into two groups – those containing a and those not containing a. These are in 1-1 correspondence – differing only in presence or absence of a. The number without a is, by induction, 2^{n−1}, so the total is 2^{n−1} + 2^{n−1} = 2^{n}.

Q: I did a base case of 0 here. Does the inductive step from 0 to 1 work correctly?

A: Yes, it corresponds ∅ with {a}.

Because of this cardinality relationship, P(A) is sometimes denoted by 2^{A}.

8.4 Set identities

There are a large number of set identities involving relationships among sets built using various operations. See p. 50 of book.

Here we just list some sample properties, and show how they can be proved.

Theorem 8.5 (Distributivity: Union distributes over intersection) A ∪ (B ∩ C) = (A ∪ B) ∩ (A ∪ C)

Proof. We show the two sets are equal by proving that each is contained in the other.

1. A ∪ (B ∩ C) ⊆ (A ∪ B) ∩ (A ∪ C).

Suppose x ∈ A ∪ (B ∩ C).

Then by definition, x ∈ A or x ∈ (B ∩ C).

We argue by cases.

If x ∈ A, then by definition x ∈ A ∪ B and similarly x ∈ A ∪ C.

It follows by definition of intersection that x is in the intersection of these two sets, which is the RHS.

On the other hand, if x ∈ (B ∩ C), then x ∈ B and x ∈ C. Then by definition of union, x ∈ A ∪ B and x ∈ A ∪ C. It again follows that x is in the intersection.

2. A ∪ (B ∩ C) ⊇ (A ∪ B) ∩ (A ∪ C).

Suppose x ∈ (A ∪ B) ∩ (A ∪ C). It follows that x ∈ A ∪ B and x ∈ A ∪ C. We argue by cases.

If x ∈ A, then certainly x ∈ A ∪ (B ∩ C).

If x ∉ A, then since x ∈ A ∪ B, we know x ∈ B. Similarly, x ∈ C. Therefore, x ∈ B ∩ C. It follows that x ∈ A ∪ (B ∩ C).

Theorem 8.6 De Morgan’s rule: (A ∪ B)^{c} = A^{c} ∩ B^{c}.

Proof. We have to show that (A ∪ B)^{c} ⊆ A^{c} ∩ B^{c} and that A^{c} ∩ B^{c} ⊆ (A ∪ B)^{c}.

1. (A ∪ B)^{c} ⊆ A^{c} ∩ B^{c}.

Let x ∈ (A ∪ B)^{c}. Then by definition of complement, x ∉ A ∪ B. It follows (proof by contradiction) that x ∉ A and x ∉ B. Therefore, again by definition of complement, x ∈ A^{c} and x ∈ B^{c}. Then by definition of intersection, x ∈ A^{c} ∩ B^{c}.

2. A^{c} ∩ B^{c} ⊆ (A ∪ B)^{c}.

Let x ∈ A^{c} ∩ B^{c}. Then x is in A^{c} and in B^{c}. Therefore, x is in neither A nor B and therefore not in A ∪ B. We conclude that x ∈ (A ∪ B)^{c}.

The above two theorems have dual theorems produced by swapping ∩ and ∪. This is a general phenomenon – look at p. 50, arranged in pairs. Also swap ∅ and U.

Theorem 8.7 A ∩ (B ∪ C) = (A ∩ B) ∪ (A ∩ C)

Theorem 8.8 (A ∩ B)^{c} = A^{c} ∪ B^{c}.

8.5 Cartesian products

Another important set operation is the Cartesian product. For sets A and B define A × B = {(a, b) | a ∈ A and b ∈ B}. Here, (a, b) is considered an ordered pair so that (a, b) ≠ (b, a).

Example 3 If A = {0, 1} and B = {a, b} then A × B = {(0, a), (0, b), (1, a), (1, b)}.

Order is important! In the above example, (a, 0) ∉ A × B, though (a, 0) ∈ B × A.

We can generalize Cartesian products to apply to more than 2 sets and define A_{1}×⋯×A_{n} = ×_{i=1}^{n}A_{i} = {(a_{1}, ⋯, a_{n}) | a_{i} ∈ A_{i} for 1 ≤ i ≤ n}. (Note Cartesian product is associative up to isomorphism.) Also, we write A^{n} for ×_{i=1}^{n}A.

Examples:

• {0, 1}^{n} is the set of all n-tuples of 0’s and 1’s. Or, length n strings of 0’s and 1’s.

• ℜ^{2} is the real plane.

9 Relations

A “relation” is a fundamental mathematical notion expressing a relationship between elements of sets. It’s an abstract notion useful in practice for modelling many different sorts of relationships. It’s the basis of the relational data base model, the standard data model for practical data processing systems.

9.1 Definitions

A binary relation from a set A to a set B is a subset R ⊆ A × B. A binary relation on a set A is a subset R ⊆ A^{2}. We can write a ∼_{R} b or aRb if (a, b) ∈ R.

We can also define a ternary relation on A as a subset R ⊆ A^{3} or, in general, an n-ary relation as a subset R ⊆ A^{n}.

Relations are used to model many different things:

1. The relation “is taking class” as a subset of {students at MIT} × {classes at MIT}. A relation from students to classes.

2. The relation “is living in the same room” as a subset of {students at MIT}×{students at MIT}. A relation on students.

3. The relation “can drive from first to second city”. (Not necessarily directly – just some way, on some roads.)

4. Relation on computers, “are connected (directly) by a wire”

5. “meet one another on a given day”

6. “likes”

7. Let A = ℕ and define a ∼_{R} b iff a ≤ b.

8. Let A = P(ℕ) and define a ∼_{R} b iff |a ∩ b| is finite.

9. Let A = ℜ^{2} and define a ∼_{R} b iff d(a, b) = 1.

10. Let A = P({1, ⋯, n}) and let a ∼_{R} b if a ⊆ b.

9.2 Properties of Relations

There are several standard properties that are satisfied by (some) relations. These occur commonly enough that they are worth identifying. Sometimes interesting things can be deduced just from the abstract properties.

A binary relation R on A is:

1. reflexive if for every a ∈ A, a ∼_{R} a.

2. symmetric if for every a, b ∈ A, a ∼_{R} b implies b ∼_{R} a.

3. antisymmetric if for every a, b ∈ A, a ∼_{R} b and b ∼_{R} a implies a = b.

4. transitive if for every a, b, c ∈ A, a ∼_{R} b and b ∼_{R} c implies a ∼_{R} c.

Among our examples:

• Relation ?? is reflexive, symmetric, transitive.

• Relation ?? is reflexive, transitive.

Not necessarily symmetric, since roads could be one-way, but in actuality... But definitely not antisymmetric.

• Relation ?? is symmetric but not transitive. Whether it is reflexive is open to interpretation.

• Relation ?? likewise.

• Relation ?? is (unfortunately) not symmetric. Not antisymmetric. Not transitive. Not even reflexive!

• Relation ?? is reflexive, antisymmetric, transitive.

• Relation ?? is not reflexive. It is symmetric. Not transitive.

• Relation ?? is only symmetric.

• Relation ?? is reflexive, antisymmetric and transitive.

9.3 Representation

There are different ways of representing relations, e.g., for handling in a computer program.

Can describe by properties, as we did above. That’s about all we can do, for infinite sets. But for finite sets, usually we use some method that explicitly enumerates all the elements of the relation.

Some alternatives: Lists, Matrices, Graphs.

Lists: To represent a finite relation from set A to set B, just list all the pairs.

Ex: Reln from A = {0, 1, 2, 3} to {a, b, c}. {(0, a), (0, c), (1, c), (2, b), (1, a)}.

Ex: Divisibility on natural numbers {1, ⋯, 12}: {(1, 1), (1, 2), …, (1, 12), (2, 2), (2, 4), …, (2, 12), (3, 3), (3, 6), (3, 9), (3, 12), (4, 4), (4, 8), (4, 12), (5, 5), (6, 6), (6, 12), (7, 7), (8, 8), (9, 9), (10, 10), (11, 11), (12, 12)}.

Reflexivity in this representation: Contains all pairs (a, a). Symmetry: If contains (a, b) then contains (b, a). Transitivity: If contains (a, b) and (b, c) then contains (a, c).

Boolean matrices: Used for finite sets A, B Rows for elements of A, columns for B. 1 in position if the pair is in the relation, 0 otherwise.

Ex:

  a  b  c
0 1  0  1
1 1  0  1
2 0  1  0
3 0  0  0

Ex:

   1   2   3   4   5   6   7   8   9  10  11  12
1  1   1   1   1   1   1   1   1   1   1   1   1
2  0   1   0   1   0   1   0   1   0   1   0   1
3  0   0   1   0   0   1   0   0   1   0   0   1
4  0   0   0   1   0   0   0   1   0   0   0   1
5  0   0   0   0   1   0   0   0   0   1   0   0
6  0   0   0   0   0   1   0   0   0   0   0   1
7  0                   0   1   0   0   0   0   0
8  0                       0   1   0   0   0   0
9  0                           0   1   0   0   0
10 0                               0   1   0   0
11 0                                   0   1   0
12 0                                       0   1

Reflexivity in this representation: major diagonal Symmetry: around major diagonal Transitivity: ...

Digraphs: Used where A = B, i.e., for relations on a finite set A. Draw a dot (vertex) for each element of A, arrow from first element to second element of each pair. Some self-loops.

Reflexivity: All nodes have self-loops. Symmetry: Bidirected edges. Transitivity: Short-circuits.

9.4 Composition

Important operation for combining relations.

The composition of relations R_{1} ⊆ A × B and R_{2} ⊆ B × C is the relation R_{1} ∘ R_{2} = {(a, c) | (∃b)((a, b) ∈ R_{1}) ∧ ((b, c) ∈ R_{2})}.

Examples: Composition of parent-of relation with itself gives grandparent-of. Composition of child-of relation with parent-of relation gives sibling-of relation.

Composition of relations is equivalent to matrix multiplication, with + replaced by ∨ (Boolean or) and ∗ replaced by ∧.

Ex: Let R_{1} be relation from first example above:

  a  b  c
0 1  0  1
1 1  0  1
2 0  1  0
3 0  0  0

Let R_{2} be relation from {a, b, c} to {d, e, f} given by:

  d  e  f
a 1  1  1
b 0  1  0
c 0  0  1

Then R_{1} ∘ R_{2} = {(0, d), ...}, that is,

  d  e  f
0 1  1  1
1 1  1  1
2 0  1  0
3 0  0  0

Same as matrix multiply, using Boolean ops and and or.

Relational composition is associative. Just like matrix multiplication.

Lemma 9.1 R_{1} ∘ (R_{2} ∘ R_{3}) = (R_{1} ∘ R_{2}) ∘ R_{3}

The composition R ∘ R of R with itself is written R^{2}. Similarly R^{n} denotes R composed with itself n times. Recursive definition: R_{1} = R, R^{n} = R ∘ R^{n−1}. Actually, can define R_{0} = {(a, a) | a ∈ R} as base case. We’ll just use 1 as base case, as book does.

Could just as well have defined as R^{n−1} ∘ R:

Theorem 9.2 For n ≥ 2, R^{n} = R^{n−1} ∘ R

Proof. Prove by induction on n. Base case n = 2 trivial. Inductive step assumes n ≥ 3. R^{n} = R ∘ R^{n−1} by definition. By inductive hypothesis, this is equal to R ∘ (R^{n−2} ∘ R). By associativity, Lemma ??, this is equal to (R ∘ R^{n−2}) ∘ R. By definition of R^{n−1}, this is equal to R^{n−1} ∘ R. As needed.

The following gives simple conditions for transitivity.

Theorem 9.3 R is transitive if and only if R^{2} ⊆ R if and only if R^{n} ⊆ R for all positive integers n.

Proof. Obviously, the third implies the second.

Show second implies the first: To show transitivity, assume (a, b) ∈ R and (b, c) ∈ R. Then (a, c) ∈ R^{2}. Second says (a, c) ∈ R, which implies transitivity.

Show first implies third. Use induction on n. BASE: n = 1, R ⊆ R, obvious. INDUCTIVE STEP: Suppose R^{n} ⊆ R, show R^{n+1} ⊆ R. Say (a, b) ∈ R^{n+1}. Then for some c, (a, c) ∈ R^{n} and (c, b) ∈ R for some c.

(Uses theorem above.) Then (a, c) ∈ R by induction. Then by transitivity, (a, b) ∈ R.

10 Equivalence relations and partitions

Now we consider an important special type of relation, called an equivalence relation. We give an important special case – modular arithmetic. And an application of this to RSA.

10.1 Definitions

An equivalence relation is a relation that is reflexive, symmetric and transitive. For example, the “roommates” relation is an equivalence relation. Trivial example: “=” relation on natural numbers. Hallmark of equivalence relations is the word “same”.

Equivalence relations partition the universe into subsets in a natural way:

A partition of a set A is a collection of subsets {A_{1}, ⋯, A_{k}} such that any two of them are disjoint (for any i ≠ j, A_{i} ∩ A_{j} = ∅) and such that their union is A. That is, every element of A is in exactly one subset.

Fix an equivalence relation R on A. For an element a ∈ A, let [a] denote the set {b ∈ A | a ∼_{R} b}. We call this set the equivalence class of a under R. We claim that the sets [a] for a ∈ A constitute a partition of A.

Lemma 10.1 For every a, b ∈ A, either [a] = [b] or [a] ∩ [b] = ∅.

Proof. Fix a, b ∈ A. If [a] = [b] then we are done, so suppose not. Let c be any element that is in one of the sets but not the other. WLOG, suppose that c ∈ [b] − [a].

Similarly, if [a] ∩ [b] = ∅ then we are done, so suppose not. Let d be any element in d ∈ [a] ∩ [b].

We will get a contradiction by showing that a ∼_{R} c and therefore that c ∈ [a].

First, a ∼_{R} d because d ∈ [a] (note that d = a is a possibility but this is ok because R is reflexive). Second, d ∼_{R} b and b ∼_{R} c because both c, d ∈ [b] and R is symmetric. This implies, by transitivity, that d ∼_{R} c. Finally, by transitivity, a ∼_{R} c because a ∼_{R} d and d ∼_{R} c.

Conversely, any partition {A_{1}, ⋯, A_{k}} of A defines an equivalence relation by letting a ∼_{R} b iff a and b are in the same A_{i}. (Note “same”.) Therefore, we can look at partitions and at equivalence relations as the same thing.

10.2 Integers modulo m

In Lecture 4, we considered the modulo operation, for a particular positive integer m, as a function. Another way to think of it is as a definition of an equivalence relation on integers (positive, negative and 0):

Definition 10.2 If a and b are integers, then we say a = b (mod m) if m | (a − b).

An equivalent formulation says that a = b + km for some integer k.

Theorem 10.3 Equality modulo m is an equivalence relation.

Proof. We need to show the relation is reflexive, symmetric, and transitive.

reflexive Clearly m | a − a = 0, so a = a (mod m).

symmetric If a = b + km then b = a + (−k)m.

transitive If a = b (mod m) and b = c (mod m), this means that m | (a−b) and m | (b−c). It follows from a theorem in the previous lecture that m | (a − b) + (b − c) = a − c.

The equivalence class of a is simply the set [a] = {b ∈ ℤ | a = b (mod m)}, or {km + a | k ∈ ℤ.

It turns out that we can extend a lot of standard arithmetic to work modulo m. In fact, we can define notions of sum and product for the equivalence classes mod m.

For example, we define [a] + [b], given two equivalence classes mod m, to be the equivalence class [a + b]. This is not as obvious as it seems: notice that the result is given in terms of a and b, two selected representative from the equivalence classes, but that it is supposed to apply to the equivalence classes themselves. To prove that this works, we have to show that it doesn’t matter which representatives of the equivalence classes we choose:

Lemma 10.4 If a = x (mod m) and b = y (mod m) then (a + b) = (x + y) (mod m).

Proof. m | (a − x) and m | (b − y) so m | ((a − x) + (b − y)) = (a + b) − (x + y),

It follows that if we are interested only the result of the addition modulo m, which is the case, for example, in the RSA cryptosystem, that we can at any time replace a given number with a different number equivalent to it, without changing the value (equivalence class) of the final answer.

The same fact can be proven for multiplication. This is the basis of the fast exponentiation algorithm presented in the next subsection.

10.3 Fast Exponentiation

Let’s say that we want to compute a^{n} (mod b). Here’s the crude, obvious way to do it:

1. Compute a^{n}.

2. Divide by b and take the remainder.

There are actually two big problems with this. First of all, a^{n} could be a gigantic number. And secondly, we’re using n multiplications, which could take a long time if n is large. Let’s correct the first problem first.

1. Initialize p = 1.

2. Repeat n times:

(i) Set p ← ap.

(ii) Set p ← p (mod b).

3. Return p.

That is, we are reducing mod b after every multiplication. To see why this works, we have to use the fact that (xy) (mod b) = ((x (mod b)) × y) (mod b). This can be shown by the kinds of arguments used in the preceding section of the notes.

Now for the second problem: To reduce the number of multiplications, we try to use squaring whenever possible.

Algorithm fast-exp(a,n,b)

1. If n = 1 then return a (mod b).

2. Else if n is odd return a∗ fast-exp(a,n-1,b) (mod b).

3. Else (n is even), set p ← fast-exp(a,n/2,b) and return p^{2} (mod b).

In recitation, we’ll prove a few things about this algorithm: First, that it terminates with the correct answer for n ≥ 1. Second, that it uses at most 2 log n multiplications (a huge savings over n multiplications even for moderate values of n).