Sum of squares mod n uniformly distributed

Let s be an integer equal to at least 5 and let n be a positive integer.

Look at all tuples of s integers, each integer being between 0 and n-1 inclusive, and look at the sum of their squares mod n. About 1/n will fall into each possible value.

So, for example, if you look at a lists of 6 digits, sum the squares of the digits in each list, then about 1/10 of the results will end in 0, about 1/10 will end in 1, about 1/10 will end in 2, etc.

This is the gist of a theorem discussed on Math Overflow here.

And here is Python code to demonstrate it.

    from itertools import product

    n = 10
    s = 6

    counts = [0]*n
    for p in product(range(n), repeat=s):
        counts[ sum(x**2 for x in p) % n ] += 1


The result is

    [103200, 99200, 99200, 99200, 99200, 
     103200, 99200, 99200, 99200, 99200]

and so between 99,200 and 103,200 sums end in each digit.

Let’s run it again with n = 11 and s = 5. Now we get

    [14641, 14762, 14520, 14762, 14762, 14762, 
     14520, 14520, 14520, 14762, 14520]

which shows the counts are between 14,520 and 14,762. If they were perfectly uniformly distributed we’d expect 114 = 14,641 in each bin. The maximum deviation from a uniform distribution is 0.83%.

The code becomes impractical as s or n get larger, but we can try s = 7 and keep n = 11. Then we get a maximum deviation from uniformity of 0.075%, i.e. about 10 times closer to being uniform.

Conway’s factoring trick

The numbers 152 through 156 have a lot of small prime factors. I’ll be more explicit about that shortly, but take my word for it for now. John Conway [1] took this simple observation and turned it into a technique for mentally factoring integers.

Conway’s factoring method

To look for factors of a number n, write n as a multiple of 150 and a remainder:

n = 150k + r.

We started from the assumption that the numbers 152 through 156 are interesting, so let j = 2 through 6 and observe

n = (150 + j)k + (rjk).

So n is divisible by one of the factors of 150 + j if and only if rjk is divisible by the same factor. So we can test n for divisibility by any of the factors of the numbers 152 through 156 by testing rjk for divisibility by the same factors. Here r is less than 150, so you’re working with moderately small numbers.

Details and examples

Here are the factorizations of the numbers 152 through 156:

152 = 2³ × 19
153 = 3² × 17
154 = 2 × 7 × 11
155 = 5 × 31
156 = 2² × 3 × 13

So the method above will test for divisibility by 2, 3, 5, 7, 11, 13, 17, 19, and 31, which is all of the primes below 41 except for 23, 29, and 37. Conway created a variation of his method to cover these primes, and another variation to cover primes up to 67. See [1] for details.

First example

So let’s do an example. Let n = 817. Then

817 = 750 + 67 = 150×5 + 67

and so k = 5 and r = 67.

It’s easy to see that n is not divisible by 2, 3, or 5. (You could test n directly for divisibility by 2, 3, and 5 or test r.)

Now let’s look at 67 – 5j for j = 2 through 6. First, 57 = 19 × 3, so 817 is divisible by 19 (the largest prime factor of 152). Next, 52 is not divisible by 17 (the largest prime factor of 153). 47 is not divisible by 7 or 11, so neither is 817 divisible by 7 or 11. 42 is not divisible by 31, so 817 is not divisible by 31. And finally, 37 is not divisible by 13 and so neither is 817.

Second example

In the discussion above, we rounded down to the nearest multiple of 150. We could round up as well, writing n as

n = 150kr

and looking at

n = (150 + j)k – (r + jk).

So instead of subtracting multiples of k, from r, we add multiples of k.

Take, for example, n = 887.

887 = 150 × 6 – 13.

So k = 6 and r = 13.

We can verify that 887 is not a multiple of 2, 3, or 5. Then we see that 13 + 2×6 = 25 is not divisible by 19, 13 + 3×6 = 31 is not divisible by 17, 13 + 5×6 = 37 is not divisible by 7 or 11, 13 + 5×6 = 43 is not divisible by 31, and finally 13 + 6×6 = 49 is not divisible by 13. So 887 is not divisible by any of the primes our method is capable of testing divisibility by. In fact 887 is prime.

Finger math

Conway associated the largest prime factors of 152 through 156 with the consecutive fingers: thumb for 19,. index finger for 17, etc. So as he subtracted factors of k, he’d keep track of what prime he’s testing divisibility for by putting down consecutive fingers.

Why 150?

The premise of Conway’s factoring method is that the interval [152, 156] is unusually rich in small prime factors. Is this interval unique in some sense?

The set of prime factors of the numbers in [152, 156] include all the primes up to 19. The following Python script searches for intervals [n, n + 4] whose factors also include all primes up to 19.

    from sympy import factorint

    for n in range(1, 1000):
        prod = n*(n+1)*(n+2)*(n+3)*(n+4)
        f = factorint(prod)
        if set([2,3,5,7,11,13,17,19]).issubset(f):
            print(n, factorint(prod))

This shows that 152 is the smallest value of n. The next value of n is 285, but it has a couple of disadvantages. The range also contains 9 prime factors, but the largest is 41 rather than 31.

The interval [986, 990] is possibly interesting. Its prime factors include all primes up to 29, as well as 43 and 47. It’s certainly easy to subtract off multiples of 1000, and so you could create a rule analogous to Conway’s rule with 1000 playing the role of 150. The downside is that now j runs from -10 to -14 rather than 2 to 6, so you’re working with larger numbers when subtracting off multiples of k.

Related posts

[1] Arthur T. Benjamin (2018) Factoring Numbers with Conway’s 150 Method, The College Mathematics Journal, 49:2, 122-12. Available here.

Phi Phi

I was reading something this afternoon and ran across φ(φ(m)) and thought that was unusual. I often run across φ(m), the number of positive integers less than m and relative prime to m, but don’t often see Euler’s phi function iterated.

Application of φ∘φ

This section will give an example of a theorem where φ(φ(m)) comes up.

First of all, Euler’s theorem says that given an integer m > 1 and an integer g relatively prime to m, then

gφ(m) = 1 (mod m).

Now Euler’s theorem gives a value of t such that gt = 1 (mod m). It doesn’t say this is the smallest t, only that it’s a possible value of t. If φ(m) is the smallest such value of t, then g is called a primitive root mod m.

For example, let m = 10. Then φ(10) = 4, and so a primitive root mod 10 is a number g such that g4 = 1 mod 10, but gt is not congruent to 1 mod 10 for t = 1, 2, or 3. Now 3 is a primitive root mod 10 because 34 ends in 1, but 3, 3², and 3³ do not end in 1.

There are no primitive roots mod 12. A primitive root mod m has to be relatively prime to m [1], and so there are only four candidates: 1, 5, 7, and 11. Each of these is congruent to 1 mod 12 when squared, so for none of them is 4 = φ(12) the smallest exponent that gives a number congruent to 1.

Now we’re ready to state our theorem, Theorem 2.34 from The Joy of Factoring by Samuel Wagstaff, Jr.

An integer m > 1 has a primitive root if and only if m = 2, m = 4, m = pe , or m = 2pe, where p is an odd prime and e is a positive integer. If m has a primitive root, then it has exactly φ(φ(m)) of them in 1 ≤ gm.

This theorem could have told us that 10 has primitive roots and 12 doesn’t, and it could tell us that 10 has exactly φ(φ(m)) = 2 primitive roots. We found one of them, 3, and the other is 7.

Higher iterates

Let φ1(n) = φ(n) and φ2(n) = φ(φ(n)). In general, let φk be the function defined by iterating the phi function k times. If we apply φ to any integer enough times, we’ll get 1. For each n, let k(n) be the smallest value of k such that φk(n) = 1. Then Erdős et al proved that k(n) is between log(n)/log(3) and log(n)/log(2).

To illustrate this, let n = 20220630. The theorem above predicts we’ll have to apply φ between 16 and 25 times before we get to 1. The following code shows k(n) = 21.

    from sympy import totient

    n = 20220630
    k = 0

    while n > 1:
        n = totient(n)
        k += 1

Note that “totient” is another name for Euler’s φ function.

Related posts

[1] If g shares a factor bigger than 1 with m, then so does every positive power of g, and so no power of g is congruent to 1 mod m. In particular, gφ(m) cannot be 1.

Infinite periodic table

All the chemical elements discovered or created so far follow a regular pattern in how their electrons are arranged: the nth shell contains up to 2n – 1 suborbitals that each contain up to two electrons. For a given atomic number, you can determine how its electrons are distributed into shells and suborbitals using the Aufbau principle.

The Aufbau principle is a good approximation, but not exact. For this post we’ll assume it is exact, and that everything in the preceding paragraph generalizes to an arbitrary number of shells and electrons.

Under those assumptions, what would the periodic table look like if more elements are discovered or created?

D. Weiss worked out the recurrence relations that the periods of the table satisfy and found their solutions.

The number of elements in nth period works out to

   P_n = \frac{(-1)^n(2n+3) + 2n^2 + 6n + 5}{4}

and the atomic numbers of the elements at the end of the nth period (the noble gases) are

Z_n = \frac{(-1)^n(3n+6) + 2n^3 + 12n^2 + 25n - 6}{12}

We can verify that these formulas give the right values for the actual periodic table as follows.

    >>> def p(n): return ((-1)**n*(2*n+3) + 2*n*n + 6*n +5)/4
    >>> def z(n): return ((-1)**n*(3*n+6) + 2*n**3 + 12*n**2 + 25*n - 6)/12
    >>> [p(n) for n in range(1, 8)]
    [2.0, 8.0, 8.0, 18.0, 18.0, 32.0, 32.0]
    >>> [z(n) for n in range(1, 8)]
    [2.0, 10.0, 18.0, 36.0, 54.0, 86.0, 118.0]

So, hypothetically, if there were an 8th row to the periodic table, it would contain 50 elements, and the last element of this row would have atomic number 168.


Looking for the next prime

Suppose you start with some large number x and want to find a prime number at least as big as x. First you test whether x is prime. Then you test whether x + 1 is prime. Then you test whether x + 2 is prime, and so on until you find a prime. Of course you would just test odd numbers, but how far might you have to look? How much larger than x might your result be?

Bertrand conjectured, and Chebyshev proved, that you’ll find a prime before you get to 2x. Said another way, the width of the interval you need to explore is no larger than x.

Note that if we just want to find a prime of a certain order of magnitude, the most efficient approach is to try numbers at random until you find one. But if you want to find the next prime you have to search more methodically. Maybe there’s a better way to do this than sequentially testing odd numbers. In any case, this post looks at an upper on the result you get, regardless of how you go about finding it.

New results

In [1] the authors prove that the length of the interval to search can be orders of magnitude smaller than x. For example, if

x > e60

then the interval can be of length x/1016.

The authors state their results in the form of an interval up to x rather than an interval starting at x, so their theorems immediately apply to starting at x and searching backward for the largest prime no greater than x. But by changing what you call x you could apply the results to looking forward for the smallest prime no smaller than x.

Illustration related to cryptography

Let’s see what the results in [1] might say about primes of the size used in cryptography. For example, RSA and Diffie-Hellman work with primes on the order of 22048 or 23072. More on that here.

If x is a 2048-bit integer x, then log x is around 1420. The authors in [1] show that if

log x > 1200

then the length of the interval to explore has width less than x/Δ where Δ = 3.637×10263.

Now if x is a 2048-bit number then we need to explore an interval of length less than

22048 / 3.637 × 10263 ≈ 22048/ 2857.5 = 21172.5.

So for a 2048-bit number, the length of the interval to search is a 1173 bit number. Said another way, we can turn x into a prime number by only changing the last 1173 bits, leaving the top 875 bits alone.

The number of bits in the length of the interval to search is a little more than half the number of bits in x; we can turn x into a prime by modifying a little more than half its bits.This is a general result for sufficiently large x.

The key contribution of [1] is that they’re explicit about what “sufficiently large” means for their theorems. There are other theorems that are not explicit. For example, in [2] the authors prove that for large enough x, the interval to search has width x0.525, but they don’t say how large x has to be.

If 22048 is large enough for the theorem in [2] to hold, then the length of our interval could be a 1076-bit integer.

Related posts

[1] Michaela Cully-Hugill and Ethan S. Lee. Explicit interval estimates for prime numbers. Mathematics of Computation. Article electronically published on January 25, 2022

[2] R. C. Baker, G. Harman, and J. Pintz, The difference between consecutive primes. II, Proc. London Math. Soc. (3) 83 (2001), no. 3, 532–562.

Beatty’s theorem

Here’s a surprising theorem [1].

(Beatty’s theorem) Let a and b be any pair of irrational numbers greater than 1 with 1/a + 1/b = 1. Then the sequences { ⌊na⌋ } and { ⌊nb⌋ } contain every positive integer without repetition.


Here’s a little Python code to play with this theorem.We set a = e and make b what it has to be to make the reciprocals add to 1.

We can’t tell from a finite sample whether the sequence covers all the integers, but we can at least verify that there are no repeats.

    from math import exp, floor

    a = exp(1)
    b = 1/(1 - 1/a)
    N = 100

    nums = set()
    for n in range(1, N+1):

We put 200 numbers into our set, and since they’re all unique, the set will have 200 elements when we’re done.

Except it doesn’t! We get 199 elements. Is there some subtle issue with floating point accuracy, where two numbers that should have different floors happen to have the same floor?

No, it’s nothing that complicated. When n = 0, ⌊0 a⌋ and ⌊0 b⌋ are both 0.

The theorem implicitly assumes that n ranges over positive integers, not non-negative integers [2]. If we modify our loop to

    for n in range(1, N+1):

then we do indeed get 200 distinct integers.


Beatty’s theorem says that every integer k will eventually be part of one of the two sequences. That is, there will be some n such that k either equal ⌊na⌋ or ⌊nb⌋. How big might n be relative to k?

To get an idea, let’s modify the script above to report the smallest number that hasn’t occurred and the largest number that has occurred. We do this by taking the following line on at the end.

    print(min(set(range(1, 2*N)) - nums), max(nums))

This prints 159 and 271. That is, all the numbers from 1 through 158 have appeared, as well as numbers up to 271.

Now let’s do a longer run, changing N to 1000. Our code prints 1583 and 2718. So once again the numbers are filling in somewhat in order. Over three quarters of the numbers from 1 to 2000 have occurred.

Let’s crank N up to 1,000,000. Now we get 1581978 and 2718281. Each time, the smallest number not visited seems to be going up proportionally, as well as the largest number that has been visited.

That maximum number 2718281 looks familiar. In fact, it’s approximately 1,000,000 times e. In terms of our program parameters, it’s approximately Na.

And what about the lower number? It doesn’t look familiar, but we might guess Nb, and indeed b = 1.5819767….


Based on the experiments above, we guess the following theorem. Define

S(N) = { ⌊na⌋ | 1 ≤ nN } ∪ { ⌊Nb⌋ | 1 ≤ nN }.

Then the smallest positive integer not in S(N) is

⌊(N+1) min(a, b)⌋

and the largest element in S(N) is

N max(a, b)⌋.

Without loss of generality, assume a < b.

The largest element of S(N) will occur is as large as possible, i.e. n = N, and so the largest value in S(N) will be ⌊Nb⌋.

The number ⌊(N+1) a⌋ is not in S(N) since none of the elements of the Beatty sequences repeat, and it is the smallest number not in S(N).

One more run

Let’s illustrate our new theorem with a = √2.

Or program prints 1414214 and 3414213. The smallest number not encountered is 1414214, which equals ⌊1000001 √2⌋ .

Now b = 1/(1 – 1/√2) = 3.4142135…. and the maximum is indeed ⌊1000000 b⌋.


[1] Ezra Brown and Richard K. Guy. The Unity of Combinatorics. MAA Press, 2020.

[2] This is another example of a theme I return to regularly: it helps to test a theorem with a program, even if you’re certain the theorem is correct, because you’re not only testing the theorem, you’re testing your understanding of the theorem. Beatty’s theorem has been around over a century, and if it were wrong then we’d know by now. But my initial Python script revealed a requirement that was not explicit in the given statement of the theorem.

Three paths converge

When does the equation

x2 + 7 = 2n

have integer solutions?

This is an interesting question, but why would anyone ask it? This post looks at three paths that have led to this problem.


Ramanujan [1] considered this problem in 1913. He found five solutions and conjectured that there were no more. Then in 1959 three authors [2] wrote a paper settling the conjecture, showing that Ramanujan was right. We don’t know what motivated Ramanujan, but the subsequent paper was a response to Ramanujan.


T. Nagell [3] published a solution in 1960 after becoming aware of [2]. This paper republished in English a solution the author had first published in 1948 in a Norwegian journal. Nagell says he gave the problem as an exercise in a number theory textbook he wrote in 1951. By mentioning his textbook but not Ramanujan, Nagell implies that he came to the problem independently.


I ran into the problem a week ago in the course of looking at a problem that came out of Golay’s work in coding theory. A necessary condition for the existence of a perfect binary code of length n including p redundant bits that can detect up to 2 errors is

{n \choose 0} + {n \choose 1} + {n \choose 2} = 2^p

This leads, via the quadratic equation, to the equation at the top of the post.

All solutions

Each of the paths above states the problem in different notation; it’s simpler to state the solutions without variables.

  • 12 + 7 = 23
  • 32 + 7 = 24
  • 52 + 7 = 25
  • 112 + 7 = 27
  • 1812 + 7 = 215

Verifying that these are solutions is trivial. Proving that there are no more solutions is not trivial.


[1] K. J. Sanjana and T. P. Trivedi, J. Indian Math. Soc. vol. 5 (1913) pp. 227-228.

[2] Th. Skolem, S. Chowla and D. J. Lewis. The Diophantine Equation 2n+2 – 7 = x2. Proceedings of the American Mathematical Society , Oct., 1959, Vol. 10, No. 5. pp. 663-669

[3] T. Nagell, The Diophantine Equation x2 + 7 = 2n. Arkiv för Matematik, Band 4 nr 13. Jan 1960.

Thanks to Brian Hopkins for his help on this problem via his answer to my question on Math Overflow.

Turning the Golay problem sideways

I’ve written a couple posts about the Golay problem recently, first here then here. The problem is to find all values of N and n such that

S(N, n) = \sum_{k=0}^n \binom{N}{k}

is a power of 2, say 2p. Most solutions apparently fall into three categories:

  • n = 0 or n = N,
  • N is odd and n = (N-1)/2, or
  • n = 1 and N is one less than a power of two.

The only two other solutions as far as I know are the two that Golay found, namely N = 23 with n = 3 and N = 90 with n = 2. Those are the only solutions for N < 30,000.

Solutions for fixed p

Phil Connor wrote me with a good suggestion: for fixed n, S(N, n) is an nth degree polynomial in N, and we can search for when that polynomial equals 2p.

Instead of looping over N and seeing whether any S(N, n) is a power of 2 comes out, we could fix p and see whether there’s a corresponding value of N.


S(N, n) = (1/n!)Nn + … + 1

and so we are looking for positive integer solutions to

Nn + … + n! = n! 2p.

Using the rational root theorem

By the rational root theorem, a necessary condition for

Nn + … – n!(2p -1)= 0

to have a rational root is that N must divide the constant term

-n!(2p -1).

That means that for fixed n and fixed p there are only a finite number of Ns that could possibly be solutions, namely the divisors of

n!(2p -1).

Say we wanted to find all solutions with p = 32 and n = 3. Then we only need to check 96 values of N because 3!(232 -1) has 96 divisors as the following Python code shows.

    >>> from sympy import divisors
    >>> len(divisors(6*(2**32-1)))

We could evaluate S(N, 3) for each of the divisors of 6(232 -1) and see if any of them equal 232. And since S(N, n) is an increasing function of N, we could speed things up by being a little clever in our search. For example, if S(d, 3) > 232 for a particular divisor d, there’s no need to keep trying larger divisors. More generally, we could do a binary search.

Not only could this approach be more efficient, I suspect it casts the problem in a form that would make it easier to prove theorems about.

Using the quadratic equation

The rational root theorem isn’t the only theorem we could apply to the polynomial formulation of the Golay problem. For example, if n = 2 we can use the quadratic equation and look at the discriminant to show that a necessary condition for there to be an integer solution is that

2p+3 – 7

must be a positive integer. When p = 12 we get

215 – 7 = 1812,

and this corresponds to Golay’s solution N = 90. There cannot be any solutions for larger values of p if p is odd because then 2p+3 is a perfect square and there cannot be another perfect square so close. I don’t know whether there can be larger even values of p with

2p+3 – 7

being a perfect square. If someone could show there are no such solutions, this would prove Golay found the only solution with n = 2. Maybe something similar would work for larger values of n.

Rumors of a proof

The conjecture I’ve been writing about is listed as Theorem 9.3 in Martin Erickson’s book Introduction to Combinatorics, Erickson does not give a proof but refers to Vera Pless’ book Introduction to the Theory of Error-correcting Codes, Wiley, 1989. However, people on MathOverflow who have seen Pless’ book say there’s no proof there.

Terry Tao says he doubts there is a proof:

To be honest, I doubt that this “theorem” is within the reach of existing technology. … My guess is that Erickson misread the discussion in Pless’s book.

Part of the confusion is that exceptional solutions to the problem discussed here are necessary (but not sufficient) for the existence of perfect Golay codes. It is widely reported that there is only one perfect binary Golay code, one based on S(23, 3) = 211. Some have taken that to mean that there are no more exceptional solutions, but this doesn’t follow. Maybe there are more exceptional solutions, but they don’t lead to the existence of more perfect binary Golay codes.

I haven’t seen a proof that Golay’s 23-bit code is the only perfect binary Golay code, though I’ve seen this theorem quoted repeatedly. It would be good to track down the proof of this theorem (if there is one!) and see whether it proves what I’m calling the Golay conjecture as an intermediate step. (Update: it does not. Seems Terry Tao was right to suspect there is no proof.)

Binomial sums and powers of 2

Marcel Golay noticed that

\binom{23}{0} + \binom{23}{1} + \binom{23}{2} + \binom{23}{3} = 2^{11}

and realized that this suggested it might be possible to create a perfect code of length 23. I wrote a Twitter thread on this that explains how this relates to coding theory (and to sporadic simple groups).

This made me wonder how common it is for cumulative sums of binomial coefficients to equal a power of 2.


S(N, n) = \sum_{k=0}^n \binom{N}{k}

Golay’s observation could be expressed as saying

S(23, 3) = 211.

How often is S(N, n) a power of 2?

There are two easy cases. First,

S(N, 0) = 20

for all N because there’s only one way to not choose anything from a set of N items. Second,

S(N, N) = 2N

for all N. (Proof: apply the binomial theorem to (1 + 1)N.)

If N is odd, then we have

S(N, (N-1)/2) = 2N-1

by symmetry of the binomial coefficients.


S(2p – 1, 1) = 2p

In summary, S(N, k) is a power of 2 if

  • k = 0 or k = N,
  • N is odd and k = (N-1)/2, or
  • k = 1 and N is one less than a power of two.

Are there any more possibilities? Apparently not many.

The only exceptions I’ve found are (23, 3) and (90, 2). Those are the only possibilities for N < 10,000. (Update: Searched up to 30,000.)

Golay found both of these solutions and mentioned them in [1]. In Golay’s words, “A limited search has revealed two such cases.” He didn’t say how far he looked, and apparently he didn’t have a proof that these were the only exceptional solutions.

(This post has been edited several times since I first posted it, to reflect corrections and a better understanding of the problem.)

Related posts

[1] Golay, M. (1949). Notes on Digital Coding. Proc. IRE. 37: 657.

The congruent number problem

A positive integer n is said to be congruent if there exists a right triangle with area n such that the length of all three sides is rational.

You could always choose one leg to have length n and the other to have length 2. Such a triangle would have area n and two rational sides, but in general the hypotenuse would not be rational.

The smallest congruent number is 5. You can verify that 5 is congruent because the triangle with legs 20/3 and 3/2 has hypotenuse 41/6 and area 5. You can find a list of congruent numbers in OEIS A003273.

You can show that a number is congruent by demonstrating a rational right triangle with the specified area, as with 5 above. Showing that a number is not congruent is harder. How do you know you haven’t looked long enough?

There’s no simple classification of congruent numbers, but there are partial results. Jerrold Tunnell proved [1] a way to show that a number is not congruent.

It suffices to look at square-free numbers, numbers not divisible by the square of an integer. This is because if n = mk² then n is congruent if and only if m is.

Tunnell gives two necessary conditions for whether a square-free number n is congruent: one for the case of n odd and one for the case of n even.

Because Tunnell’s theorem gives necessary conditions, it can only prove that a number is not congruent.

It would be tidy if Tunnell’s conditions were also sufficient, i.e. that they could prove that a number is congruent. And they may be sufficient. Tunnell proved that if the Birch and Swinnerton-Dyer conjecture is true, then the converse of his theorem is true. If you could prove that the Birch and Swinnerton-Dyer conjecture, you could prove the converse of Tunnell’s theorem as a corollary. You could also win a million dollar prize.

Now for Tunnell’s conditions. If an odd square-free positive integer n is congruent, then there are twice as many integer solutions to

2x² + y² + 8z² = n


2x² + y² + 32z² = n.

And if n is even and square free, there are twice as many solutions to

4x² + y² + 8z² = n


4x² + y² + 32z² = n.

In general it’s hard to know how many integer solutions an equation has, but for the equations above we can find the solutions by brute force because all the terms are positive. We know each variable is between -√n and √n. We could even be more efficient and check smaller ranges of x and z because of the coefficients. And we can mostly look for solutions in the first quadrants and multiply by 8, but we need to be careful not to count solutions with zero components more than once.

Let’s prove that 11 is not a congruent number.

How many solutions to

2x² + y² + 8z² = 11

are there?

Clearly z can only possibly be ±1 or 0. If z = ±1 then x = ±1 and y = ±1. If z = 0 then the only solutions are x = ±1 and y = ±3. So we have 14 solutions: eight of the form (±1, ±1, ±1) and two of the form (±1, ±3, 0).

For the equation

2x² + y² + 32z² = 11

z must be 0, and so we have the eight solutions we found before: all combinations of (±1, ±3, 0).

Our first equation has 14 solutions and the second has 4, and so 11 must not be congruent.


[1] Tunnell, Jerrold B. (1983), “A classical Diophantine problem and modular forms of weight 3/2”, Inventiones Mathematicae, 72 (2): 323–334, doi:10.1007/BF01389327