Bezout's Lemma & Linear Diophantine Equations

Bezout's lemma reveals a profound connection between the greatest common divisor and integer linear combinations. It is one of the most fundamental and important results in number theory. Based on it, this article further discusses methods for solving linear Diophantine equations.

Bezout's Lemma

Bezout's lemma, also translated as Bezout's theorem or called Bezout's identity, gives the necessary and sufficient condition for an integer to be represented as an integer-coefficient linear combination of two integers.

Bezout's Lemma

Let a,ba,b be integers that are not both zero. Then, for any integers x,yx,y, gcd⁡(a,b)∣ax+by\gcd(a,b)\mid ax+by holds; moreover, there exist integers x,yx,y such that ax+by=gcd⁡(a,b)ax+by=\gcd(a,b).

Proof

Let d=gcd⁡(a,b)d=\gcd(a,b). Since d∣a,bd\mid a,b, there exist integers u,vu,v such that a=du, b=dva=du,~b=dv. Therefore,

ax+by=d(ux+vy).ax + by = d(ux+vy).

This shows that d∣ax+byd\mid ax+by.

Conversely, we need to show that there exist x,yx,y for which the equality holds. If one of a,ba,b is 00, assume without loss of generality that b=0b=0. Their greatest common divisor is then d=ad=a, and clearly (x,y)=(1,0)(x,y)=(1,0) makes the equality hold. Now consider the case in which a,ba,b are both nonzero. Since gcd⁡(a,b)=gcd⁡(−a,b)=gcd⁡(a,−b)\gcd(a,b)=\gcd(-a,b)=\gcd(a,-b), assume without loss of generality that both a,ba,b are positive.

Consider the process of the Euclidean algorithm:

a=q1b+r1,0≤r1<b,b=q2r1+r2,0≤r2<r1,r1=q3r2+r3,0≤r3<r2,⋯rn−3=qn−1rn−2+rn−1,0≤rn−1<rn−2,rn−2=qnrn−1+rn,0≤rn<rn−1,rn−1=qn+1rn.\begin{aligned} a &= q_1b + r_1, && 0\le r_1 < b,\\ b &= q_2r_1 + r_2, && 0\le r_2 < r_1,\\ r_1 &= q_3r_2 + r_3, && 0\le r_3 < r_2,\\ & \cdots \\ r_{n-3} &= q_{n-1}r_{n-2} + r_{n-1}, && 0\le r_{n-1} < r_{n-2},\\ r_{n-2} &= q_nr_{n-1} + r_n, && 0\le r_n < r_{n-1},\\ r_{n-1} &= q_{n+1}r_n. \end{aligned}

Since the greatest common divisor is dd, the final remainder must satisfy rn=dr_n=d. Thus, the penultimate equation can be written as

d=rn=rn−2−qnrn−1.d = r_n = r_{n-2} - q_nr_{n-1}.

Solving the antepenultimate equation for the preceding remainder gives

rn−1=rn−3−qn−1rn−2r_{n-1} = r_{n-3} - q_{n-1}r_{n-2}

Substituting this into the equation above eliminates rn−1r_{n-1}:

d=rn−2−qn(rn−3−qn−1rn−2)=(1+qnqn−1)rn−2−qnrn−3.\begin{aligned} d &= r_{n-2} - q_n(r_{n-3} - q_{n-1}r_{n-2}) \\ &= (1 + q_nq_{n-1})r_{n-2} - q_nr_{n-3}. \end{aligned}

Continuing in the same way, we can eliminate all of rn−2,rn−3,⋯ ,r2,r1r_{n-2},r_{n-3},\cdots,r_2,r_1 and eventually obtain

d=xa+yb.d = xa + yb.

This proves that there exist x,yx,y such that ax+by=dax+by=d. The preceding analysis therefore proves the original proposition.

The proof of existence here is constructive; it also gives a way to calculate the coefficients. This method is the extended Euclidean algorithm.

Considering the special case of Bezout's lemma where gcd⁡(a,b)=1\gcd(a,b)=1 gives the following corollary:

Corollary

Integers a,ba,b are coprime if and only if there exist integers x,yx,y such that ax+by=1ax+by=1.

The Case of Multiple Integers

Bezout's lemma can be generalized to multiple integers.

Theorem

Let a1,a2,⋯ ,ana_1,a_2,\cdots,a_n be integers that are not all zero. Then, for any integers x1,x2,⋯ ,xnx_1,x_2,\cdots,x_n, gcd⁡(a1,a2,⋯ ,an)∣a1x1+a2x2+⋯+anxn\gcd(a_1,a_2,\cdots,a_n)\mid a_1x_1+a_2x_2+\cdots+a_nx_n holds; moreover, there exist integers x1,x2,⋯ ,xnx_1,x_2,\cdots,x_n such that gcd⁡(a1,a2,⋯ ,an)=a1x1+a2x2+⋯+anxn\gcd(a_1,a_2,\cdots,a_n)=a_1x_1+a_2x_2+\cdots+a_nx_n.

Proof

Apply induction on nn using gcd⁡(a1,a2,⋯ ,an)=gcd⁡(gcd⁡(a1,a2,⋯ ,an−1),an)\gcd(a_1,a_2,\cdots,a_n)=\gcd(\gcd(a_1,a_2,\cdots,a_{n-1}),a_n).

Example Problem

Codeforces 510 D. Fox And Jumping

There are n≤300n\le 300 cards, with lil_i and cic_i respectively. On an infinitely long strip of paper, you may spend cic_i to buy card ii, after which you can jump lil_i units to the left or right any number of times. What is the minimum amount of money needed to reach every position on the strip? If this is impossible, output −1-1.

Solution

Analyzing the problem, to reach every cell, the absolute value obtained by adding or subtracting the selected numbers li1,⋯ ,likl_{i_1}, \cdots, l_{i_k} some number of times must be 11. In other words, there must exist integers x1,⋯ ,xkx_1, \cdots, x_k such that li1x1+⋯+likxk=1l_{i_1} x_1 + \cdots + l_{i_k} x_k = 1. By Bezout's lemma for multiple integers, this is equivalent to selecting some numbers from the array l1,⋯ ,lnl_1, \cdots, l_n whose greatest common divisor is 11, while minimizing the sum of their costs.

Solution 1: Regard the minimum cost sum as a shortest-path problem and solve it with Dijkstra's algorithm. Store the current greatest common divisor at each graph vertex. The starting vertex is 00, and the target vertex is 11. At each step, start from the current vertex xx and follow an edge of length cic_i to the vertex gcd⁡(x,li)\gcd(x,l_i). This algorithm has time complexity O(n2log⁡n)O(n^2\log n).

Solution 2: Selecting some numbers from l1,⋯ ,lnl_1, \cdots, l_n so that their greatest common divisor is 11 and their cost sum is minimized suggests a 0-1 knapsack problem.

Let fi,jf_{i, j} denote the minimum cost when considering the first ii numbers and having greatest common divisor jj. The transition is

fi,j=min⁡gcd⁡(k,li)=jfi−1,k+ci.f_{i, j} = \min_{\gcd(k, l_i) = j} f_{i - 1, k} + c_i.

After the DP, the final total cost is fn,1f_{n, 1}.

As with the ordinary 0-1 knapsack problem, a rolling array can remove the first dimension. Here, the greatest common divisors jj that can be formed by 300 numbers are sparse, so a hash table can be used to store them.

In fact, the graph constructed in Solution 1 is precisely the state-transition graph of the dynamic programming in Solution 2. Solution 2 is equivalent to finding shortest paths in a directed acyclic graph with dynamic programming. Thus, the two solutions are equivalent. However, Solution 2 does not need to store the entire graph, and its DP time complexity is O(n+m)O(n + m), lower than that of Dijkstra's algorithm, so Solution 2 is better in both time and space.

Linear Diophantine Equations

A linear Diophantine equation is an indeterminate equation of the form

a1x1+a2x2+⋯+anxn=ba_1x_1 + a_2x_2 + \cdots + a_nx_n = b

where a1,a2,⋯ ,ana_1,a_2,\cdots,a_n are all integers. The goal of this section is to find all of its integer solutions.

The Two-Variable Case

First consider the two-variable linear Diophantine equation

a1x1+a2x2=b.a_1x_1 + a_2x_2 = b.

Bezout's lemma states that this equation has a solution if and only if

d=gcd⁡(a1,a2)∣b.d = \gcd(a_1,a_2) \mid b.

Now assume that this condition holds. The extended Euclidean algorithm can find an integer solution (x1∗,x2∗)(x_1^*,x_2^*) to a1x1+a2x2=da_1x_1 + a_2x_2 = d. This gives a particular solution of the original equation:

(x1∘,x2∘)=(bdx1∗,bdx2∗).(x_1^\circ,x_2^\circ) = \left(\frac{b}{d}x_1^*,\frac{b}{d}x_2^*\right).

To obtain all solutions, subtract the identity a1x1∘+a2x2∘=ba_1x_1^\circ+a_2x_2^\circ = b from the original equation, yielding

a1(x1−x1∘)+a2(x2−x2∘)=0.a_1(x_1 - x_1^\circ) + a_2(x_2 - x_2^\circ) = 0.

This is a homogeneous linear Diophantine equation in (x1−x1∘,x2−x2∘)(x_1-x_1^\circ,x_2-x_2^\circ), with general solution

(x1−x1∘,x2−x2∘)=(ta2d,−ta1d).(t∈Z)(x_1-x_1^\circ,x_2-x_2^\circ) = \left(t\dfrac{a_2}{d},-t\dfrac{a_1}{d}\right).\quad(t\in\mathbf Z)

Therefore, the general solution of the original equation is

(x1,x2)=(x1∘+ta2d,x2∘−ta1d).(t∈Z)(x_1,x_2) = \left(x_1^\circ + t\dfrac{a_2}{d},x_2^\circ - t\dfrac{a_1}{d}\right).\quad(t\in\mathbf Z)

These are a series of equally spaced integer points on the line a1x1+a2x2=ba_1x_1+a_2x_2 = b.

The Multiple-Variable Case

Once the two-variable case is solved, the multivariable case is easy as well. For an nn-variable linear Diophantine equation

a1x1+a2x2+⋯+anxn=b,(n>3)a_1x_1 + a_2x_2 + \cdots + a_nx_n = b,\quad (n>3)

Bezout's lemma shows that the equation has a solution if and only if

gcd⁡(a1,a2,⋯ ,an)∣b.\gcd(a_1,a_2,\cdots,a_n) \mid b.

As in the two-variable case, the general solution of a multivariable linear Diophantine equation can also be written in the form

(x1∘,x2∘,⋯ ,xn∘)+∑k=1n−1tk(x1(k),x2(k),⋯ ,xn(k))(x_1^\circ,x_2^\circ,\cdots,x_n^\circ) + \sum_{k=1}^{n-1} t_k(x_1^{(k)},x_2^{(k)},\cdots,x_n^{(k)})

where x∘x^\circ is a particular solution and x(k)x^{(k)} are the (n−1)(n-1) solutions of the corresponding homogeneous equation.

The explicit form of the general solution can be obtained by converting the nn-variable equation into an (n−1)(n-1)-variable equation. Let d1=gcd⁡(a1,a2)d_1 = \gcd(a_1,a_2). By Bezout's lemma, all values of a1x1+a2x2a_1x_1+a_2x_2 are exactly the multiples of d1d_1. Thus, first solve the (n−1)(n-1)-variable linear Diophantine equation

d1y1+a3x3+a4x4+⋯+anxn=b.d_1y_1 + a_3x_3 + a_4x_4 + \cdots + a_nx_n = b.

Suppose its general solution is

y1=y1∘+∑k=2n−1tky1(k),xi=xi∘+∑k=2n−1tkxi(k),i=3,⋯ ,n.\begin{aligned} y_1 &= y_1^\circ + \sum_{k=2}^{n-1}t_ky_1^{(k)}, \\ x_i &= x_i^\circ + \sum_{k=2}^{n-1}t_kx_i^{(k)},\quad i=3,\cdots,n. \end{aligned}

Let (x1∗,x2∗)(x_1^*,x_2^*) be a particular solution of a1x1+a2x2=d1a_1x_1+a_2x_2=d_1. Then, by the discussion in the previous section, the general solution in x1,x2x_1,x_2 of a1x1+a2x2=d1y1a_1x_1+a_2x_2=d_1y_1 is

x1=x1∗y1+t1a2d1, x2=x2∗y1−t1a1d1.x_1 = x_1^*y_1 + t_1\dfrac{a_2}{d_1},~x_2 = x_2^*y_1 - t_1\dfrac{a_1}{d_1}.

Substituting the expression for y1y_1 gives the general solution of the original equation:

x1=x1∗y1∘+t1a2d1+∑k=2n−1tkx1∗y1(k),x2=x2∗y1∘−t1a1d1+∑k=2n−1tkx2∗y1(k),xi=xi∘+∑k=2n−1tkxi(k),i=3,⋯ ,n.\begin{aligned} x_1 &= x_1^*y_1^\circ + t_1\dfrac{a_2}{d_1} + \sum_{k=2}^{n-1}t_kx_1^*y_1^{(k)}, \\ x_2 &= x_2^*y_1^\circ - t_1\dfrac{a_1}{d_1} + \sum_{k=2}^{n-1}t_kx_2^*y_1^{(k)}, \\ x_i &= x_i^\circ + \sum_{k=2}^{n-1}t_kx_i^{(k)},\quad i=3,\cdots,n. \end{aligned}

Frobenius Coin Problem

Bezout's lemma gives the necessary and sufficient condition for an integer to be represented as an integer linear combination of several integers. Closely related to it is the Frobenius coin problem:

  • If there are coins with integer denominations a1,a2,⋯ ,ana_1,a_2,\cdots,a_n and gcd⁡(a1,a2,⋯ ,an)=1\gcd(a_1,a_2,\cdots,a_n)=1, what is the largest integer that cannot be formed from these coins?

This also asks when an integer kk can be represented in the form a1x1+a2x2+⋯+anxna_1x_1+a_2x_2+\cdots+a_nx_n. In Bezout's lemma, xix_i may be arbitrary integers, whereas in the Frobenius coin problem, xix_i may only be natural numbers.

The case of only one coin is trivial, since necessarily a1=1a_1=1 and every natural number can be represented by it. The case n>2n>2 is too complicated, so this section discusses only n=2n=2.

Sylvester's Theorem

In 1882, Sylvester completely solved the Frobenius coin problem for n=2n = 2:

Theorem (Sylvester)

For coprime positive integers a1,a2a_1,a_2, the largest integer that cannot be written as a1x1+a2x2 (x1,x2∈N)a_1x_1+a_2x_2~(x_1,x_2\in\mathbf N) is C=a1a2−a1−a2C = a_1a_2 - a_1 - a_2. Moreover, for every k∈Zk\in\mathbf Z, exactly one of the integers kk and C−kC-k can be written in this form.

For convenience, call an integer that can be written in the form a1x1+a2x2 (x1,x2∈N)a_1x_1+a_2x_2~(x_1,x_2\in\mathbf N) representable.

Proof 1

Since a1,a2a_1,a_2 are coprime, for every integer kk, the equation a1x1+a2x2=ka_1x_1+a_2x_2=k has a solution, whose general form is

(x1,x2)=(x1∘+ta2,x2∘−ta1).(t∈Z)(x_1,x_2) = (x_1^\circ + ta_2, x_2^\circ - ta_1).\quad(t\in\mathbf Z)

Let tt be the quotient obtained when dividing x2∘x_2^\circ by a1a_1 with remainder. Then the remainder x2=x2∘−ta1x_2 = x_2^\circ-ta_1 lies between 00 and a1−1a_1-1. Consider the solution (x1,x2)(x_1,x_2) obtained this way. Since x2x_2 is the smallest nonnegative value it can take, nn is representable if and only if x1≥0x_1\ge 0.

Step 1: Prove that every integer greater than CC is representable.

When k>Ck > C,

a1x1=k−a2x2>C−a2(a1−1)=−a1.a_1x_1 = k - a_2x_2 > C - a_2(a_1-1) = -a_1.

Thus, x1>−1x_1 > -1, that is, x1≥0x_1\ge 0. Therefore, (x1,x2)(x_1,x_2) is a solution in natural numbers, and kk can be written in the required form.

Step 2: Prove that CC is not representable. Consequently, CC is the largest non-representable integer, and kk and C−kC-k cannot both be representable.

We use contradiction. Suppose that CC is representable, so there exist x1,x2∈Nx_1,x_2\in\mathbf N such that a1x1+a2x2=Ca_1x_1+a_2x_2=C. Substituting the expression for CC gives

a1a2=a1(x1+1)+a2(x2+1).a_1a_2 = a_1(x_1+1) + a_2(x_2+1).

Therefore, a2∣(x1+1)a_2\mid (x_1+1) and a1∣(x2+1)a_1\mid (x_2+1). Since x1+1,x2+1x_1+1,x_2+1 are both positive,

a1a2≥a1a2+a2a1=2a1a2.a_1a_2 \ge a_1a_2 + a_2a_1 = 2a_1a_2.

This is a contradiction, so CC is not representable. Together with Step 1, it is the largest non-representable integer.

If both kk and C−kC-k were representable, adding the coefficients in the representations of kk and C−kC-k would produce a representation of CC, contradicting the fact that CC is not representable. Hence at most one of kk and C−kC-k can be representable.

Step 3: Prove that if kk is not representable, then C−kC-k is representable.

Let (x1,x2)(x_1,x_2) be the integer solution of a1x1+a2x2=ka_1x_1+a_2x_2=k introduced above. The preceding discussion shows that kk is not representable if and only if x1<0x_1<0. Therefore,

C−k=a1a2−a1−a2−a1x1−a2x2=a1(−1−x1)+a2(a1−1−x2).C - k = a_1a_2 - a_1 - a_2 - a_1x_1 - a_2x_2 = a_1(-1-x_1) + a_2(a_1-1-x_2).

Both −1−x1-1-x_1 and a1−1−x2a_1-1-x_2 are nonnegative integers, so C−kC-k is representable.

Proof 2

Here we prove only that C=a1a2−a1−a2C=a_1a_2-a_1-a_2 is the largest non-representable natural number; the rest is proved similarly to Proof 1.

Consider, modulo a2a_2, the smallest representable natural number in each residue class. Since different natural numbers in the same residue class can be transformed into one another by adding or subtracting some multiple of a2a_2, when considering the smallest representable number it is enough to consider adding or subtracting a1a_1. Since a1a_1 and a2a_2 are coprime, the smallest representable natural numbers in the residue classes are exactly the multiples of a1a_1:

0, a1, 2a1, ⋯ , (a2−1)a1.0,~a_1,~2a_1,~\cdots,~(a_2-1)a_1.

Therefore, the largest non-representable number is

max⁡0≤i<a2ia1−a2=(a2−1)a1−a2=C.\max_{0\le i < a_2} ia_1 - a_2 = (a_2-1)a_1 - a_2 = C.

Geometric Interpretation

View the equation a1x1+a2x2=ka_1x_1 + a_2x_2 = k as a line. Then kk is representable if and only if this line passes through an integer point in the first quadrant, including the coordinate axes. When k<abk < ab, this line can pass through at most one integer point in the first quadrant. Therefore, for 0≤k<ab0\le k < ab, an integer kk is representable if and only if the line for kk passes through exactly one integer point in the first quadrant.

Consequently, the number of representable natural numbers satisfying k<abk < ab is exactly the number of integer points below the line a1x1+a2x2=ka_1x_1 + a_2x_2 = k in the first quadrant, including boundary points. This number equals

∑i=0⌊k/a1⌋⌊k−ia1a2⌋.\sum_{i=0}^{\lfloor k / a_1 \rfloor} \left\lfloor\dfrac{k-ia_1}{a_2}\right\rfloor.

This is the classic problem of counting integer points under a line, which can be solved in O(log⁡min⁡{a1,a2,k})O(\log\min\{a_1,a_2,k\}) time using the floor-sum Euclidean algorithm.

Exercises

This content comes from OI Wiki: Bezout's Lemma & Linear Diophantine Equations. See the original for authors and revision history. AIOJ has adapted the formatting, in-site links, and resource paths.

Content is shared under CC BY-SA 4.0 and SATA license; additional terms are governed by the original notice. Thanks to the OI Wiki authors and contributors; per the SATA terms, please visit the OI Wiki repository and star it to show your support.