;~ A?r.Hathematical
Surveys
and
Monographs
Volume 104
Recurrence Sequences
Graham Everest
Alf van der Poorten
Igor Shparlinski
Thomas Ward
American Mathematical Society

EDITORIAL COMMITTEE
Jerry L. Bona Michael P. Loss
Peter S. Landweber, Chair Tudor Stefan Ratiu
J. T. Stafford
2000 Mathematics Subject Classification. Primary 11B37, 11B39, 11G05, 11T23, 33B10,
11J71, 11K45, 11B85, 37B15, 94A60.
For additional information and updates on this book, visit
www.ams.org/bookpages/surv-104
Library of Congress Cataloging-in-Publication Data
Recurrence sequences / Graham Everest... [et al.].
p. cm. — (Mathematical surveys and monographs, ISSN 0076-5376 ; v. 104)
Includes bibliographical references and -index.
ISBN 0-8218-3387-1 (alk. paper)
1. Recurrent sequences (Mathematics) I. Everest, Graham, 1957- II. Series.
QA246.5.R43 2003
512'.72—dc21 2003050346
Copying and reprinting. Individual readers of this publication, and nonprofit libraries
acting for them, are permitted to make fair use of the material, such as to copy a chapter for use
in teaching or research. Permission is granted to quote brief passages from this publication in
reviews, provided the customary acknowledgment of the source is given.
- ¦ Republication, systematic copying, or multiple reproduction of any material in this publication
is permitted only under license from the American Mathematical Society. Requests for such
permission should be addressed to the Acquisitions Department, American Mathematical Society,
201 Charles Street, Providence. Rhode Island 02904-2294, USA. Requests can also be made by
e-mail to reprint-permission9auns.org.
© 2003 by the American Mathematical Society. All rights reserved.
The American Mathematical Society retains all rights
except those granted to the United States Government.
Printed in the United States of America.
@ The paper used in this book is acid-free and falls within the guidelines
established to ensure permanence and durability.
Visit the AMS home page at http://www.ams.org/
10 9 8 7 6 5 4 3 2 1 08 07 06 05 04 03

Contents
Notation vii
Introduction ix
Chapter 1. Definitions and Techniques 1
1.1. Main Definitions and Principal Properties 1
1.2. p-adic Analysis 12
1.3. Linear Forms in Logarithms 15
1.4. Diophantine Approximation and Roth's Theorem 17
1.5. Sums of S-Units 19
Chapter 2. Zeros, Multiplicity and Growth 25
2.1. The Skolem-Mahler-Lech Theorem 25
2.2. Multiplicity of a Linear Recurrence Sequence 26
2.3. Finding the Zeros of Linear Recurrence Sequences 31
2.4. Growth of Linear Recurrence Sequences 31
2.5. Further Equations in Linear Recurrence Sequences 37
Chapter 3. Periodicity " 45
3.1. Periodic Structure 45
3.2. Restricted Periods and Artin's Conjecture 49
3.3. Problems Related to Artin's Conjecture 52
3.4. The Collatz Sequence 61
Chapter 4. Operations on Power Series and Linear Recurrence Sequences 65
4.1.. Hadamard Operations and their Inverses 65
4.2. Shrinking Recurrence Sequences 71
4.3. Transcendence Theory and Recurrence Sequences 72
Chapter 5. Character Sums and Solutions of Congruences 75
5.1- Bounds for Character Sums ' 75
5.2. Bounds for other Character Sums 83
5.3. Character Sums in Characteristic Zero 85
5.4. Bounds for the Number of Solutions of Congruences 86
Chapter 6. Arithmetic Structure of Recurrence Sequences 93
6.1. Prime Values of Linear Recurrence Sequences 93
6.2. Prime Divisors of Recurrence Sequences 95
6.3. Primitive Divisors and the Index of Entry 103
6.4. Arithmetic Functions on Linear Recurrence Sequences 109
6.5. Powers in Recurrence Sequences 113

vi CONTENTS
Chapter 7. Distribution in Finite Fields and Residue Rings 117
7.1. Distribution in Finite Fields 117
7.2. Distribution in Residue Rings 119
Chapter 8. Distribution Modulo 1 and Matrix Exponential Functions 127
8.1. Main Definitions and Metric Results 127
8.2. Explicit Constructions 130
8.3. Other Problems 134
Chapter 9. Applications to Other Sequences 139
9.1. Algebraic and Exponential Polynomials 139
9.2. Linear Recurrence Sequences and Continued Fractions 145
9.3. Combinatorial Sequences 150
9.4. Solutions of Diophantine Equations 157
Chapter 10. Elliptic Divisibility Sequences 163
10.1. Elliptic Divisibility Sequences 163
10.2. Periodicity 164
10.3. Elliptic Curves 165
10.4. Growth Rates 167
10.5. Primes in Elliptic Divisibility Sequences 169
10.6. Open Problems 174
Chapter 11. Sequences Arising in Graph Theory and Dynamics 177
11.1. Perfect Matchings and Recurrence Sequences 177
11.2. Sequences arising in Dynamical Systems 179
Chapter 12. Finite Fields and Algebraic Number Fields 191
12.1. Bases and other Special Elements of Fields 191
12.2. Euclidean Algebraic Number Fields 196
12.3. Cyclotomic Fields and Gaussian Periods 202
12.4. Questions of Kodama and Robinson 205
Chapter 13. Pseudo-Random Number Generators 211
13.1. Uniformly Distributed Pseudo-Random Numbers 211
13.2. Pseudo-Random Number Generators in Cryptography 220
Chapter 14. Computer Science and Coding Theory 231
14.1. Finite Automata and Power Series 231
14.2. Algorithms and Cryptography 241
14.3. Coding Theory 247
Sequences from the on-line Encyclopedia 255
Bibliography . 257
Index 309

Notation
Particular notation used is collected at the start of the index; some general
notation is described here.
o N, Z, Z+, Q, E, C denote the natural numbers, integers, non-negative
integers, rational numbers, real numbers, and complex numbers, respec-
respectively,
o Qp, Zp, Cp denote the p-adic rationals, the p-adic integers, and the com-
completion of the algebraic closure of Qp, respectively;
o ordp z is the p-adic order of z € Cp;
o P is the set of prime numbers;
o 72. is a commutative ring with 1;
o Wq is a field with q = pr elements, p € P, r € N, and F* is its multiplicative
group;
o Fp, p € P is identified with the set {0,1,... ,p - 1};
o given a field F, F denotes the algebraic closure of F; thus Q is the field of
all algebraic numbers;
o for any ring U, H[X], K(X), 11[{X}}, H((X)) denote the ring of polyno-
polynomials, the field of rational functions, the ring of formal power series, and
the field of formal Laurent series over 72., respectively;
o Zk denotes the ring of integers of the algebraic number field K;
o H(f) denotes the naive height of / € Z[xi,... , xm}, that is, the greatest
absolute value of its coefficients;
o gcd(ai,... , ctfc) and lcm(ax,... , afc) respectively denote the greatest com-
common divisor and the least common multiple of ai,... , afc (which may be
integers, ideals, polynomials, and so forth);
o e denotes any fixed positive number (for example, the implied constants
in the symbol O may depend on s);
o 5ij denotes Kronecker's 5-function: 5\j = 1 if i = j, and 5ij — 0 otherwise;
o n(k), <p{h), r(fc), a(k) respectively denote the Mobius function, the Euler
function, the number of integer positive divisors of k, and the sum of the
integer positive divisors of k, where k is some non-zero integer;
o u(k), P(k), Q(k) respectively are the number of distinct prime divisors of
A;, the greatest prime divisor of k, and the product of the prime divisors
of k; thus, for example: i/A2) = 2, PA2) = 3, and QA2) = 6;
o for a rational r = k/? with gcd(M) = 1, P{r) = max{P{k),P(?)} and
o tt(x) is the number of prime numbers not exceeding x;
o \X\ denotes the cardinality of the set X;
o log x = log2 x, In x = loge x;
o Logx = logx if x > 2, and Logx = 1 otherwise;
vu

NOTATION
o a constant is effective if it can be computed in a finite number of steps
from starting data;
o C{\\, A2,. -.) or c(Ai, A2, ¦..) denotes a constant depending on the param-
parameters Ai, A2,.... Such constants may be supposed to be effective, unless
it is pointed out explicitly that they are not;
o a statement S(x) is true for almost all x € N if the statement holds for
N + o(N) values of x < N, N —> 00. Similarly, a statement S(p) is true for
almost all p G P if it holds for n(N) + o{ir{N)) values of p < N, N -> oc:
o the symbol ? denotes the end of a proof.

Introduction
The importance of recurrence sequences hardly needs to be explained. Their
study is plainly of intrinsic interest and has been a central part of number theory
for many years. Moreover, these sequences appear almost everywhere in mathe-
mathematics and computer science. For example, the theory of power series representing
rational functions [1026], pseudo-random number generators ([935], [936], [938],
[1277]), A;-regular [76] and automatic sequences [736], and cellular automata [780].
Sequences of solutions of classes of interesting Diophantine equations form linear
recurrence sequences — see [1175], [1181], [1285], [1286]. A great variety of power
series, for example zeta-functions of algebraic varieties over finite fields [725], dy-
dynamical zeta functions of many dynamical systems [135], [537], [776], generating
functions coming from group theory [1110], [1111], Hilbert series in commutative
algebra [788], Poincare series [131], [287], [1110] and the like — are all known
to be rational in many interesting cases. The coefficients of the series representing
such functions are linear recurrence sequences, so many powerful results from the
present study may be applied. Linear recurrence sequences even participated in
the proof of Hilbert's Tenth Problem over Z ([786], [1319], [1320]). In the pro-
proceedings [289], the problem is resolved for many other rings. The article [998] by
Pheidas suggests using the arithmetic of bilinear recurrence sequences to settle the
still open rational case.
Recurrence sequences also appear in many parts of the mathematical sciences in
the wide sense (which includes applied mathematics and applied computer science).
For example, many systems of orthogonal polynomials, including the Tchebychev
polynomials and their finite field analogues, the Dickson polynomials, satisfy recur-
recurrence relations. Linear recurrence sequences are also of importance in approxima-
approximation theory and cryptography and they have arisen in computer graphics [799] and
time series analysis [136].
We survey a selection of number-theoretic properties of linear recurrence se-
sequences together with their direct generalizations. These include non-linear re-
recurrence sequences and exponential polynomials. Applications are described to
motivate the material and to show how some of the problems arise. In many sec-
sections we concentrate on particular properties of linear recurrence sequences which
are important for a variety of applications. Where we are able, we try to consider
properties that are particularly instructive in suggesting directions for future study.
Several surveys of properties of linear recurrence sequences have been given
recently; see, for example, [215], [725, Chap. 8], [822], [827], [899], [914], [1026],
[1181], [1202], [1248], [1285], [1286]. However, they do not cover as wide a range
of important features and applications as we attempt here. We have relied on these
surveys a great deal, and with them in mind, try to use the "covering radius 1'
principle: For every result not proved here, either a direct reference or a pointer to

* INTRODUCTION
an easily available survey in which it can be found is given. For all results, we try
to recall the original version, some essential intermediate improvements, and — up
to the authors' limited knowledge — the best current form of the result.
Details of the scope of this book are clear from the table of contents. In Chap-
Chapters 1 to 8, general results concerning linear recurrence sequences are presented.
The topics include various estimates for the number of solutions of equations, in-
inequalities and congruences involving linear recurrence sequences. Also, there are
estimates for exponential sums involving linear recurrence sequences as well as
results on the behaviour of arithmetic functions on values of linear recurrence se-
sequences. In Chapters 9 to 14, a selection of applications are given, together with
a study of some special sequences. In some cases, applications require only the
straightforward use of results from the earlier chapters. In other cases the tech-
technique, or even just the spirit, of the results are used. It seems almost magical that,
in many applications, linear recurrence sequences show up from several quite unre-
unrelated directions. A chapter on elliptic divisibility sequences is included to point out
the beginning of an area of development analogous to linear recurrence sequences,
but with interesting geometric and Diophantine methods coming to the fore. A
chapter is also included to highlight an emerging overlap between combinatorial
dynamics and the theory of linear recurrence sequences.
Although objects are considered over different rings, the emphasis is on the
conventional case of the integers. A linear recurrence sequence over the integers
can often be considered as the trace of an exponential function over an algebraic
number field. The coordinates of matrix exponential functions satisfy linear recur-
recurrence relations. Such examples suggest that a single exponential only seems to be
less general than a linear recurrence sequence. Of course that is not quite true, but
in many'important cases links between linear recurrence sequences and exponen-
exponential functions in algebraic extensions really do play a crucial role. Michalev and
Nechaev [827] give a survey of possible extensions of the theory of linear recurrence
sequences to a wide class of rings and modules.
For previously known results, complete proofs are generally not given unless
they are very short or illuminating. The underlying ideas and connections with
other results are discussed briefly. Filling the gaps in these arguments may be
considered a useful (substantial) exercise. Several of the results are new; for these
complete proofs are given.
Some number-theoretic and algebraic background is assumed. In the text, we
try to motivate the use of deeper results. A brief survey of the background material
follows. First, some basic results from the theory of finite fields and from algebraic
number theory will be used. These can be found in [725] and [909], respectively.
Also standard results on the distribution of prime numbers, in particular the Prime
Number Theorem n(x) ~ x/\nx, will be used. All such results can easily be found
in [1049], and in many other textbooks. Much stronger results are known, though
these subtleties will not matter here. The following well-known consequences of the
Prime Number Theorem,
k > tp(k) > k/ Log log k, v(k) < Log k/ Log log k
and
P(k) > v{k) Log !/(/c), Q(fc) > exp (A +
will also be needed.

INTRODUCTION xi
A second tool is p-adic analysis [29], [131], [620]; in particular Strassmann's
Theorem [1261], sometimes called the p-adic Weierstrass Preparation Theorem.
Section 1.2 provides a basic introduction to this beautiful theory. At several points
in the text, results about recurrence sequences will be given where the most natural
proofs seem to come from p-adic analysis. We can offer no explanation for this
phenomenon. For example, in Section 1.2, we give a simple proof of a special
case of the Hadamard quotient problem using p-adic analysis. The general case
has now been resolved and the methods are still basically p-adic. Similarly, when
it is applicable, p-adic analysis produces very good estimates for the number of
solutions of equations; compare the estimate of [1123] based on new results on
S-unit equations with that of [1038] obtained by the p-adic method. On the other
hand, a disadvantage of this approach is its apparent non-effectiveness in estimating
the size of solutions.
The simple observation that any field of zero characteristic over which a linear
recurrence sequence is defined may be assumed to be finitely generated over Q will
be used repeatedly. Indeed, it is enough to consider the field obtained from Q by
adjoining the initial values and the coefficients of the characteristic polynomial.
Then, using specialization arguments [1026] and [1037], we may restrict ourselves
to studying sequences over an algebraic extension of Qp or even just over Qp,
using a nice idea of Cassels [213]. Cassels shows that given any field F, finitely
generated over Q, and any finite subset M € F, there exist infinitely many rational
primes p such that there is an embedding <p : F —> Qp with ordp <^(/z) = 0 for all
/j, € M. A critical feature is that the embedding is into Qp, rather than a 'brute
force' embedding into an algebraic extension of Qp. The upshot is that for many
natural problems over general fields of zero characteristic, one can expect to get
results that are not worse than the corresponding one in the algebraic number field
case, or even for the case of rational numbers. Moreover, there are a number of
examples in the case of function fields where even stronger results can be obtained,
see [128], [160], [167], [171], [548], [781], [871] [920], [1002], [1041], [1162],
[1308], [1309], [1324], [1373].
Thirdly, many results depend on bounds for linear forms in the logarithms of
algebraic numbers. Section 1.3 gives an indication of the connection between the
theory of linear recurrence sequences and linear forms in logarithms by consider-
considering the apparently simple question: How quickly does a linear recurrence sequence
grow? After the first results of Baker [50], [51], [52], [53], [54], [55], and their p-
adic generalizations, for example those of van der Poorten [1017], a vast number of
further results, generalizations and improvements have been obtained; appropriate
references can be found in [1324]. For our purposes, the modern sharper bounds
do not imply any essentially stronger results than those relying on [55] and [1017].
In certain cases more recent results do allow the removal of some logarithmic terms;
[1369] is an example. We mostly content ourselves with consequences of the rela-
relatively old results.
Fourthly and finally, several results on growth rate estimates or zero multi-
multiplicity are based upon properties of sums of 5-units. Specifically, linear recurrence
sequences provide a special case of 5-unit sums. Section 1.5 gives a basic account of
the way results about sums of 5-units can be applied to linear recurrence sequences.
This does not do justice to the full range of applicability of results about sums of
5-units — applications will reverberate throughout the text.

xii INTRODUCTION
In surveys such as this, it is conventional to attach a list of open questions.
Rather than doing this, the best current results known to the authors are pre-
presented; if a generalization is straightforward and can be done in the framework of
the same arguments that is noted. Other generalizations or improvements should
be considered implicit research problems. We do however mention attempts at
improvements which seem hopeless in the light of today's knowledge.
Finally, we add several words about what we do not deal with. First, it is strik-
striking to note that the binary recurrence u(n+2) = u(n + l) +u(n), one of the simplest
linear recurrences whose solutions are not geometric progressions, has been a sub-
subject of mathematical scrutiny certainly since the publication of Leonardo of Pisa's
Liber abaci in 1202 [1212]. Indeed, this recurrence has an entire journal devoted to
it [113]. This volume is more egalitarian; with a few exceptions, no special prop-
properties of individual recurrences will be discussed. Several specific sequences arise
as examples; the most important of these are listed with their identifying numbers
in Sloane's Online Encyclopedia of Integer Sequences [1222] in an Appendix on
page 254.
Second, one could write an enormous book devoted to one particular case of
linear recurrence sequences — polynomials. We do not deal with polynomials per
se; extensive treatments are in [1116] and [1120]. Nonetheless, this case alone
justifies the great interest in general linear recurrence sequences. Therefore, we
give several applications to polynomials but such applications are obtained using
partially hidden — although not too deep — links between polynomials and linear
recurrence sequences.
Third, a huge book could be written dealing with exponential polynomials as
examples of entire functions and therefore, ultimately, with analytic properties of
those functions. We barely consider any analytical features of exponential poly-
polynomials, though we mention some relevant results about the distribution of their
zeros. We do not deal with analytical properties of iteration of polynomial map-
mappings. Thus the general field of complex dynamics, and the celebrated Mandelbrot
set, is outside our scope. (Recall that the Mandelbrot set is the set of points c € C
for which the sequence of polynomial iterations z(k) = z(k — IJ + c, z@) = 0, is
bounded; for details we refer to [154].) However, in Chapter 3 we do consider some
simple periodic properties of this and more general mappings.
Fourth, as we mentioned, general statements about the behaviour — both
Archimedean arid non-Archimedean — of sums of 5-units lie in the background
of important results on linear recurrence sequences. Nonetheless, we do not deal
with sums of 5-units or their applications systematically. On the topic generally,
we first recommend the pioneering papers [376] and [1037] which appeared inde-
independently and contemporaneously (the latter as a preprint [1019] of Macquarie
University in 1982). We point particularly to the book [1181] and the excellent
survey papers [378], [380], [381], [382], [503], [1128], [1175], [1285], [1286].
On the other hand, we do present some less well-known results about finitely
generated groups, such as estimates of the size of their reduction modulo an integer
ideal in an algebraic number field, and on the testing of multiplicative independence
of their generators. When results on S-unit sums are applied to linear recurrence
sequences, an induction argument usually allows the conditions on non-vanishing
proper sub-sums to be eliminated (such conditions are unavoidable in the general
study of S-unit sums).

INTRODUCTION xiii
Despite the large number of references, no systematic attempt has been made
to trace the history of major results that have influenced the subject. No single
book on the history of this huge topic could hope to be definitive. However —
Leonardo of Pisa notwithstanding — it is reasonable to view the modern study of
the arithmetic of recurrence sequences as having been given essential impetus by
the remarkable work of Frangois Edouard Anatole Lucas A842-1891); many of the
themes developed in this book originate in his papers (see [283] and [1354] for
some background on his life and work, and [517] for a full list of his publications
and some of his unpublished work).
The bibliography reflects the interests and biases of the authors, and some of
the entries are to preliminary works. The authors extend their thanks to the many
workers whose contributions have given them so much pleasure and extend their
apologies to those whose contributions have not been cited. The authors also thank
many people for help with corrections and references, particularly Christian Ballot,
Daniel Berend, Keith Briggs, Sheena Brook, Susan Everest, Robert Laxton, Pieter
Moree, Patrick Moss, Wladyslaw Narkiewicz, James Propp, Michael Somos, Shaun
Stevens, Zhi-Wei Sun and Alan Ward.
Alf van der Poorten k Igor Shparlinski Graham Everest & Thomas Ward
Centre for Number Theory Research School of Mathematics
Macquarie University • University of East Anglia
Sydney Norwich
alf@math.mq.edu.au " -- g.everest@uea.ac.uk
igor@comp.mq.edu.au t.ward@uea.ac.uk

CHAPTER 1
Definitions and Techniques
Our study begins with the basic properties of recurrence sequences, and the
particular properties of linear recurrence sequences. The collection of all linear
recurrences associated to a given polynomial is introduced, and a group structure on
this collection described. The far-reaching description of linear recurrence sequences
as generalized power sums is given, and some deeper topics like non-degeneracy and
the problem of characterizing those subsequences of a linear recurrence sequence
that are also linear recurrence sequences are mentioned.
The elementary observation that the formal power series associated to a se-
sequence is rational if and only if the sequence is a linear recurrence sequence is
made, and related to other problems like characterizing the Taylor expansions of
solutions of linear ordinary differential equations. The problem of recognizing ratio-
rationality in a power series is discussed, and basic tools from p-adic analysis introduced
to give a proof of a simple case of the Hadamard Quotient Theorem.
Finally, deep results from Diophantine analysis are introduced that will be used
later to understand the growth and other properties of linear recurrence sequences.
1.1. Main Definitions and Principal Properties
1.1.1. Recurrence Sequences. We restrict ourselves initially to linear re-
recurrence sequences, defined over a commutative ring 71 with a unit 1. Nonetheless,
many of the results and all the terminology below hold for much more general
algebraic domains. Linearity of the defining recurrence relation is essential, as is
the fact that the coefficients of that relation are constant elements of the ring of
definition. The qualifier 'linear' will therefore be omitted unless it is needed for
emphasis.
A linear recurrence sequence is a sequence a = (o-(x)) of elements of 71 satisfying
a homogeneous linear recurrence relation
A.1) a(x + n) = sia(x + n - 1) H + sn_ia(x + 1) + sna(x), zeN
with constant coefficients Sj G 71, the coefficient ring. We will suppose throughout
that sn is not a zero divisor in 71.
1.1.2. Characteristic Polynomial. The polynomial
f(X) =Xn- S^" Sn^X - Sn
associated to the relation A.1) is called its characteristic polynomial, and the rela-
relation is said to be of order n.
If 71 is a ring without zero divisors then any linear recurrence sequence a
satisfies a recurrence relation of minimal length. The characteristic polynomial
of the minimal length relation is the minimal polynomial of the sequence a. The
degree of that minimal polynomial is said to be the order of the linear recurrence

2 1. DEFINITIONS AND TECHNIQUES
sequence a. The minimal polynomial of the sequence a divides the characteristic
polynomial of a.
Linear recurrence sequences of order 2 and 3 are called binary and ternary
linear recurrence sequences respectively, and sequences over Z, Q, Q, R, C and
Qp respectively are known as integer, rational, algebraic, real, complex and p-adic
linear recurrence sequences.
Inhomogeneous linear recurrence relations take the form
a(x + n) = s\a{x + n — 1) + ¦ ¦ ¦ + sn-ia(x + 1) + sna(x) + s^+i, x G Z+.
Such a sequence a then satisfies the homogeneous recurrence relation
71-1
a(x + n + 1) = ($i + l)a(x + n) + ^(s;+i - fi)a(x + n- i) - sna(x)
i=i
of order n + 1, with characteristic polynomial
= (Xn - SlXn~l sn^X - sn)(X - 1).
1.1.3. Initial Values. For a linear recurrence sequence defined by a recur-
recurrence relation A.1) of order n the elements o(l),... ,a(n) are called the initial
values; they determine all other elements of the sequence. Further, if sn is an in-
vertible element of 71 then the sequence may be continued in the opposite direction,
yielding o@). a(-l), a(-2),....
1.1.4. Set of Solutions of a Recurrence Relation over a Field. Given
a polynomial / defined over a field, consider the set ?(/) of all possible linear
recurrence sequences satisfying the equation A.1), and the set ?*(/) of all sequences
for which / is their characteristic polynomial. If g is a divisor of/ then C(g) C ?(/).
If/ is irreducible, then ?*(/) contains all sequences from ?(/) except the identically
zero sequence.
Theorem 1.1. Let f and g be two polynomial defined over a field. Then
• {(c(x)) : c(x) = a(x) + b(x)ae?(f), b G ?(g)} = ?(\cm(f,g));
• ?{f) C ?{g) if and only if f \ g.
For finite fields these results can be found in [671] or in [1378]; it is readily
checked that the proofs do not depend on the characteristic.
If c(x) = a(x)b(x), a G ?(f), b G ?(g), then c is again a linear recurrence
sequence, but describing its characteristic polynomial is not immediate. This will
b*e dealt with in Chapter 4 below.
The set ?(f) is a linear space of dimension n in the following sense. Consider
the n basic sequences a<i — the impulse sequences — with initial values
aiU) = % hj = !,••• ,n.
Any sequence satisfying the given recurrence relation can be uniquely represented
as a linear combination
n
a(x) = ^ a(i)ai(x), x G N
of the relevant set of impulse sequences. To see this, notice that the right-hand
side satisfies the relation A-1), as does any linear combination of solutions of the

1.1. MAIN DEFINITIONS AND PRINCIPAL PROPERTIES 3
relation, and it has the same initial values as does a. A minor modification of this
remark yields the identity
a(x+ h) = y^2/a{h + i)ai{x), h,xeZ+.
i=i
1.1.5. Linear recurrence sequences of finite length. For a field F and
constants m,n, 0 < 2m < n + 1, Elkies [340] studies the subset Hm of Fn+1 of
sequences (x@),... , x(n)) satisfying some linear recurrence of degree m. Results on
the geometry of the set Hm are found, particularly for F of positive characteristic.
1.1.6. Generalized power sums. A generalized power sum is a finite expo-
exponential sum
m
A.2) a(z) = ]Ti4i(z)af, zeZ+
i=i
with polynomial coefficients A;. Write deg A; = m — 1 and set YlT=i ni = n- The
cti (presumed distinct) are the characteristic roots of the sum a(x), the positive
integers n$ are their multiplicities, and the Aj are the coefficients.
To understand the connection between generalized power sums and linear re-
recurrence sequences, define an operator E on sequences by (E(a)) (x) = a(x + 1),
so that (writing informally) (E. — a)(xn~lax) = A(xn~1)ax, where the difference
operator A is defined by (A(a)) (x) = a(x + 1) - a(x). Since An(xn~1) = 0 and E
is linear, the sum A.2) is annihilated by the operator
aOni = En - SlEn~l Sn^E - sn .
That is, the sequence a satisfies the recurrence relation A.1). Notice that the
characteristic roots cti and that the coefficients A* are elements of some extension
ring of the coefficient ring 71. In particular, the sequence of traces of powers of
algebraic numbers a, with d G K, where [K : Q] = d,
is a linear recurrence sequence satisfying a recurrence relation over Q of order at
most d, and with characteristic polynomial the minimal polynomial of a over Q.
This simple observation is used below in a variety of contexts.
Conversely, assume first that the characteristic polynomial of the recurrence
relation A.1) has no repeated roots. Then every linear recurrence sequence satis-
satisfying A.1) is a generalized power.sum with constant coefficients. If / has repeated
roots the matter is a bit more complicated in characteristic p/ 0: A recurrence
relation with characteristic roots of multiplicity exceeding p cannot have its general
solution given by a generalized power sum. However, apart from this subtlety —
and in any case for linear recurrence sequences defined over fields of characteristic
zero — we shall see below that linear recurrence sequences are given by generalized
power sums.
Assume that the coefficient ring K is a field F, and let L denote the splitting
field of the minimal polynomial / over F. Over L the polynomial factorizes as
f(X) =

4 1. DEFINITIONS AND TECHNIQUES
and a has characteristic roots ct1,... ,ctm with multiplicities ni,... ,nm respec-
respectively. There are constants A^ G L, j = 0,... ,m - 1 and i = 1,... ,m, such
that
m rij — 1 / i •
If F has characteristic zero then A.3) can be rewritten in the form
A.4) a(x) = 2_^ Ai(x)af, x G N,
with polynomials Ai(X) G L[X] of degrees deg Ai < ni — 1, i = 1,... , m. Moreover,
if the characteristic p of the field is at least max{m,... , nm} then A.4) holds in any
event; in particular we obtain an exponential polynomial if the minimal polynomial
/ is square-free, so that the Ai all are constant, or if the characteristic p is at least
as great as the order n.
If / is the characteristic polynomial of a, then each polynomial Ai has degree
precisely tii — 1, i = 1,... , m.
1.1.7. Groups of recurrence sequences. Again we restrict attention to
the case of no repeated roots; thus / is a monic square-free polynomial over a
field F of characteristic zero. Here it is convenient to consider two-sided sequences.
Several authors have considered the following group structure defined on ?(/), more
precisely on equivalence classes of sequences. Two sequences a and b from ?(/) are
equivalent if for some A G F* and ? G Z, \a(x + ?) = b(x) for all x G Z. That is, two
sequences are equivalent if they differ by a shift and multiplication by a non-zero
constant. Let G(f) denote the set of equivalence classes.
A group structure on Q{f) may be defined as follows. In place of the repre-
representation A.4), consider the (n x n) Vandermonde matrix W = (ct)~1). ._,• Write
A for its determinant, and Aj for the determinant of the matrix obtained from W
by replacing its j-th column with @,... ,0,1)*. Then for every sequence a G ?(/)
there is a unique representation
1 n
A.5) a(x) = -
Write a <-* [ai,... ,an] in this case, and define the product of two sequences a *-+
[oi,... ,an] and b *-* [bi,... ,bn] to be the sequence c <-»¦ [ai^i,... ,anbn]. Define
the product of two classes to be the product of their representatives; this product
is well-defined by [61, Lemma 5.3.2] and makes Q(f) an abelian group. Ballot [61]
provides a detailed analysis and gives applications of the group structure to the
study of divisors of linear recurrence sequences. For more background on these
groups in the binary case, see [689], [690]. For / having exactly one double root,
Ballot [62] gives a meaningful generalization of the group. Q{f).
1.1.8. Dominating roots. For sequences over normed fields — and in par-
particular over C — it is convenient to order the characteristic roots as
The r roots of maximum norm

1.1. MAIN DEFINITIONS AND PRINCIPAL PROPERTIES 5
are called dominating roots.
A sequence with a unique dominating root is often relatively easy to deal with.
Thus, many results below are stated for such sequences only. Boyd [143] demon-
demonstrates that a unique dominating root is present for a wide class of irreducible
characteristic polynomials.
1.1.9. Nondegeneracy. The linear recurrence sequence A.1) is degenerate if
it has a pair of distinct roots whose ratio is a root of unity. Conversely, if ctf ^ aj,
1 < i < j < m, x = 1,2... , it is non-degenerate. Over infinite fields this definition
determines an important class of sequences. Furthermore, the study of arbitrary
linear recurrence sequences can effectively be reduced to that of non-degenerate
linear recurrence sequences in the following sense.
THEOREM 1.2. Let a denote a linear recurrence sequence of order n over an
algebraic number field K of degree d over Q. Then there is a constant
Mid n) < /eXP BnC1°SnI/2) {fd = l> and
y ' ) - |2nd+i ifd>2,
such that for some M < M(d, n) each subsequence (a(Mx +. ?)) is either identically
zero, or is non-degenerate.
This theorem is essentially a combination of results of [87] (for d = 1) and
of [1083] (for d>2). The proof is based on a bound for the least common multiple
of periods of roots of unity in K (the period of a root of unity p is the least igN
with p* = 1). See [1365] for some improvements and algorithmic applications of
those results. Schmidt [1149] provides an upper bound on the number of such
arithmetic progressions which depends only on n.
1.1.10. Arithmetic sub-progressions. The following useful observation is
related to the previous result. The Skolem-Mahler-Lech Theorem, of which more
below, is a particularly important application.
Theorem 1.3. Any subsequence (a(kx + ?)), k G N, ? G Z+ .of a linear re-
recurrence sequence a of order n is a linear recurrence sequence of order at most
n.
This statement is clear for a generalized power sum of the form A.2); a linear
recurrence sequence of order n is a generalized power sum of order n over any
commutative ring [1012], [1295]. The converse of Theorem 1.3 does not hold in
such generality but is true in characteristic zero. In that case it is a non-trivial
result that an arithmetic progression (more precisely, a finite number of interwoven
arithmetic progressions) is essentially the only subsequence of indices upon which
a non-degenerate linear recurrence sequence is again a linear recurrence sequence.
THEOREM 1.4. Let a denote a non-degenerate linear recurrence sequence over
a field of characteristic zero, and let (xh) denote an arbitrary sequence of distinct
natural numbers. If (a(xh)) is a linear recurrence sequence then there is an integer
d > 1 and certain remainders r* G {0,1,... , d— 1} so that with at most finitely many
exceptions the sequence (xh) is the monotonically increasing sequence of integers of
the shape dx + rj.
This deep theorem follows from the work on sums of 5-units; see Sections 1.5
and 2.1.

6 1. DEFINITIONS AND TECHNIQUES
1.1.11. Rational functions. Linear recurrence sequences arise naturally as
sequences of Taylor coefficients of rational functions; see [1025]. Given a polynomial
/ of degree n define the reciprocal polynomial f~ by f~(X) = Xnf(X~l).
THEOREM 1.5. A sequence a satisfies the recurrence relation A.1) with charac-
characteristic polynomial f € 7l[X] if and only if it is the sequence of Taylor coefficients
of a (formal) power series representing a rational function r(X)/f~(X), where r
is a polynomial of degree less than n determined by the initial values of a.
To see this, note that on comparing coefficients of Xn+X, for x = 0,1,... ,
x=l
holds if and only if A.1) holds.
To test an arbitrary sequence a of elements of a field F for the property of being
a linear recurrence sequence, consider the Kronecker-Hankel determinants
&N,n{a) = det (a(n + i + J))o<
Theorem 1.6. The sum f(z) = Yl^L=oanZn represents a rational function if
and only if for some n, A^.n(a) = 0 for all sufficiently large N.
An excellent account of this is given in [620].
Proof. We prove one implication in the case where n = 0. If / is rational, then
k ?
i=0 j=0
with so 7^ 0. Multiplying through by s(z) = Y2j-o sjz^ shows that all the linear
combinations
sqo-l + sifltf-i H 1- siaK-e
vanish if L exceeds k and ?. This shows that A^tTh(a) = 0 because, from some point
on, all the columns can be expressed as linear combinations of the early columns.
For the converse, work backwards from the vanishing of the determinant to obtain
the linear recurrence relation, see [620]. ?
1.1.12. Powers of matrices. Consider an arbitrary square matrix M defined
over 71, with the i,j-th entry of Mx written mjj(z). The Cayley-Hamilton theorem
asserts that for each i,j the sequence m^j is a linear recurrence sequence satisfying
a recurrence whose characteristic polynomial is the characteristic polynomial of M.
Accordingly, let a denote the linear recurrence sequence satisfying A.1) and
write A(x) for the row-vector (a(x),... ,a(x + n— 1)). Let
/ 0 0 0 ... 0 fn \
1 0 0 ... 0 /n_i
0 1 0 ... 0 /n_2
T =
\ 0 0 0 ... 1
be the companion matrix of A.1). Then
A(x) = A(x -

1.1. MAIN DEFINITIONS AND PRINCIPAL PROPERTIES 7
1.1.13. Generalized exponential polynomials. Given the representation
of recurrence sequences as generalized power sums from Section 1.1.6, it is natural
to study sequences given by more general functions
m
A.6) E(z)
where, say, polynomials ipi appear in the exponents. Such functions are known as
generalized exponential polynomials or just exponential polynomials.
There is intrinsic interest in the study of the distribution of zeros (and other
values) of such functions, and one might hope that these results would provide some
insight into questions more closely related to the central topic of this book. It is
also natural to consider analogous functions in several variables.
1.1.14. Taylor coefficients of solutions of linear differential equations.
The sequence of coefficients of a power series representing a solution of a linear dif-
differential equation with polynomial coefficients satisfies a linear recurrence relation
A.7) a(x + n) = Si(x)a(x + n — 1) -\ h sn-i(x)a(x + 1) + sn(x)a(x)
with rational function coefficients. For further work on the combinatorial and
arithmetic properties of the sequence of coefficients of such functions and their
generalizations, see [78], [84], [200], [734], [735], [1236].
1.1.15. ^-Generalizations. The g-version of sequences satisfying A.1) has
been studied. Consider sequences satisfying relations
A.8) a(x + n) = si(gx)o(x + n- 1) + ¦ • • + sn-i(<f)a(x + 1) + sn(qx)a(x)
with rational functions Sj. Elements of such sequences are the coefficients of power
series expansions of solutions r of functional equations of the form
These and similar functions satisfying
are also studied in [76], [105], [740], [741], [743], [745]. If logx = t then r(t) =
R(X), but this should not be taken to mean that the properties of power series
coefficients for these two types of functions are the same.
One can go further and consider coefficients of power series expansions of other
interesting functions, such as those satisfying algebraic differential or functional
equations, and multi-variate functions. There are many exciting open problems
and ingenious results in this direction. This topic will not be pursued here; there
are expository papers [736], [1030] and several recent research papers studying
zeros of such functions [737], their arithmetic properties [321], [1147] and their
general structure [76], [734], [735], [738], [740], [741], [743], [745], [812], [1024].

1. DEFINITIONS AND TECHNIQUES
1.1.16. Non-linear recurrence relations; in particular continued frac-
fractions. A non-linear recurrence sequence satisfies a relation of the form
A.9) a(x + n) = F(x,a(x + n-l),... ,a(x)), x G Z+.
Here F is often a polynomial or a rational function, or some arithmetic function.
Even choosing the simplest functions F yields a great variety of interesting se-
sequences, from coefficients of algebraic functions and of solutions to differential
equations, to the sequences appearing in the still unsolved '3x + 1' or 'Collatz'
problem (see Chapter 3). Even when n = 1 and F is independent of x, this encom-
encompasses iterations of functions as dynamical systems — see [581] for an attractive
overview.
Non-linear recurrences can be used to define novel entire functions. A striking
recent example is the recurrence
x-\
a{x+l) =z2a(z) + ^a(j)a(z + l-j), k > 2, oB) = o(l) - a(lJ,
3=2
which arises in the tritronquee solution of a Painleve equation [564]. In [541] it is
shown that the limit lima:_+oo a(z)/[(z — I)!]2 exists and defines an entire function
ofoB).
A particularly important example of a non-linear recurrence sequence for num-
number theory is given by the Gauss map
where {z} denotes the fractional part of z G M. Define the notation [cq , c\ , c2, ... ],
by
[c0 , ci, c2 , ... , cn] = c0 + l/[ci, c2 , .. • , cn\.
"If a = [co, ci , C2 , ... ] is the continued fraction expansion of an irrational real
number then the sequence ao = |_aj, ax+\ = F(ax), x = 0,1, 2,... , is the sequence
of complete quotients ax = [cx , cx+\, ... ].
The continued fraction expansion of a quadratic irrational is eventually peri-
periodic, which implies that the numerators px and denominators qx of its convergents
satisfy linear recurrence relations. In Section 9.2 we shall see that the converse
holds as well.
It is pointed out in [129] that for any algebraic number a the convergents
Px/ix satisfy a non-linear recurrence relation. Specifically, the partial quotients cx
are given in terms of the previous convergents and the defining polynomial of the
algebraic number. For example, in the case a = s/2 one has
Cx =
UB) 9x-i
The continued fraction map is ergodic with respect to an absolutely continuous
measure on @,1), which gives many results on the behaviour of typical orbits under
F, and hence of the continued fraction expansion for almost every real number
(see [260] or [280] for these results, and [1152] for an extensive discussion of
generalizations of the continued fraction map; a 'normal number' for the continued
fraction map, analogous to Champernowne's classical result in [219], is exhibited
in [2]). Further work on normality, ergodicity and Diophantine properties for the

1.1. MAIN DEFINITIONS AND PRINCIPAL PROPERTIES 9
continued fraction map and its close relatives may be found in [132], [133], [278],
[279], [552], [638], [639], [901], [1077], [1086], [1151].
More straightforward iterations of the floor function F(X) = [aX\.
a(x + 1) = [aa(x)J , x e N,
are also of interest [402]. The literature contains many further examples: For
instance, recurrence sequences on algebraic varieties [291], [967] and on elliptic
curves [992].
The Lyness sequences arising from the iteration
u(n + 1) + a
u(n)
and the generalization
u(n + 1) + a
u(n + 2) =
u(n + 2) =
u(n) + b
have been extensively studied as dynamical systems and have intimate connections
with elliptic curves (see [766], [648] and [1376] and references for modern treat-
treatments.)
1.1.17. Elliptic divisibility sequences and Somos sequences. In the pa-
papers [1329] and [1330], Morgan Ward considered two-sided sequences satisfying the
equation
A.10) a(x + y)a(x - y) = a(y + l)a(y - l)a(xJ - a(x + l)a(x - l)a(yJ.
Such sequences are called elliptic because they can be parametrized by elliptic
(theta) functions, and there are non-trivial connections between their growth rates
and the canonical height on an associated elliptic curve. There is a surprising
variety of such sequences. The sequences denned by a(x) = x, a(x) = (f) (the
Legendre symbol modulo 3), and
a(x) = (aia2)-(*-W&Zll
for any a.\ ^ Q2, satisfy A.10). These matters will be expanded on in Chapter 10.
An emerging theory of bilinear recurrence sequences (see Section 1.1.20) may sub-
subsume many of the known results about both linear recurrence sequences and elliptic
divisibility sequences.
A Somos-k sequence is one which satisfies the recurrence relation
[fc/2j
A.11) a(n)a(n — k) = Vj a(n — i)a(n — k + i), n>k.
For example, when k = 4, the sequence
A.12) 1,1,1,1,2,3,7,23,...
occurs frequently as a test sequence for conjectures. See Section 11.1.3 below for
a recent combinatorial interpretation of this sequence. The recurrence A.11) with
initial values a@) = • • • = a(k — 1) = 1, is an integer sequence for k = 4,5,6, 7 but
not for k = 8 [1084], see also [499, Sect. E15]. The thesis of Christine Swart [1268]
proves some of Raphael Robinson's conjectures from [1084]. For example, it is
known that not all primes can divide a term of A.12) — for example 5 and 29
divide no term. In [1084] it is conjectured that if p is an odd prime dividing a term

10 1. DEFINITIONS AND TECHNIQUES
then for all r > 1, pr will divide some term. She has extended this to other bilinear
recurrence sequences (see Section 1.1.20) with k = 4, and has proved several other
conjectures from [1084]. These sequences were originally studied by Michael Somos
in the late 1980"s, in an attempt to take a purely combinatorial approach to the
theory of elliptic curves (Zagier has also pondered this possibility.) Jim Propp and
Noam Elkies have been taking strides to try to understand the deep arithmetic and
combinatorial properties of these sequences. The theory is still in its infancy, so we
refer to [421], [422], [775], [1084], [1232] and the web site maintained by Propp
[1052] for more details.
1.1.18. Several variable generalizations. Sequences indexed by N can be
generalized to the multi-variate case. For example, one can consider subsequences
of the coefficients of power series expansions of rational functions in several vari-
variables [736].
Another way to generalize linear recurrence sequences to the many variable
case is as follows. First note that linear recurrence sequences can be considered as
the 'additive' generalization of single exponential functions. One can consider the
'multiplicative' generalization as well. That is, given multiplicatively independent
elements Ai,... . Ar € K consider the finitely-generated multiplicative group
A.13) V = {A?1 ... A*'; : n,...,ir6Z}.
For example, the trace Tk/q(^A^1 ...A*'") provides an exponential polynomial in
several variables.
1.1.19. Other linear recurrence relations. For all the sequences men-
mentioned thus far. the a>th term a(x) is expressed in terms of one or several previous
terms, typically a(x — 1),... , a(x — n). A large class of very interesting sequences
is defined by recurrence relations where the x-th term is expressed in terms of more
distant terms, say in terms of
a([x/2\),... ,a([x/n\) or a (x - [x/2\),... ,a (x - \_x/n\).
In fact, as has become clear relatively recently, their genesis is in automata the-
theory where these relations arise quite naturally. Generally speaking, such sequences
are beyond our scope. Several interesting examples reveal links to classical linear
recurrence sequences; see Sections 9.3 and 14.1. These sequences arise from nat-
natural questions about binary (or g-ary) expansions of integers; they also arise in
an algorithm for fast computation of elliptic divisibility sequences due to Shipsey
[1166].
Going further, the subscripts may depend on the sequence itself. Some exam-
examples in the number-theory literature are
a(x) = a (x - d(x - 1)) + a (x - a(x - 2))
and
a(x) = a (x — a(x — lj) + a (a(x — 1))
with a(l) = aB) = 1 in both cases. The sequence satisfying
a(x) — a(x — a(a(x — 1))) + 1,
sometimes called Golomb's sequence, grows like (M^ ) • ^e ie^er ^° [402] and
to [499, Sect. E31] for precise references and some generalizations. A particularly

1.1. MAIN DEFINITIONS AND PRINCIPAL PROPERTIES 11
interesting doubly-indexed sequence from computer science is Ackerman's function
A : N2 -> N, denned by
A@,n) = n +1
A(m+1,0) = A(m,l)
A(m+l,n + l) = A(m,A(m+l,n))\
see [197] for a historical perspective on this function.
1.1.20. Bilinear recurrence sequences. The set of linear recurrence se-
sequences forms a ring because this structure is inherent in the set of exponential
polynomials. A sequence u is a bilinear recurrence sequence if it satisfies, for some
k, the finite relation
u(x)u(x — k) = Vj clju(x — j)u(x — k + i)
where a\, a?,..., ayk/2\ are constants.
If A; = 4 or 5, the sequence is said to be binary (because in both cases there is
the same number of terms). Similarly, when k = 6 or 7, the sequence is said to be
ternary and so on. Notice that every linear recurrence sequence of order k is also a
bilinear recurrence sequence of order k.
Remarkably, the set of bilinear recurrence sequences seems to exhibit closure
properties under multiplication much as the set of linear recurrence sequences does.
For example, the sequence 5 defined on page 164 and starting
0,1,1,-1,1, 2, -1,-3, -5,7, -4, -23,29,59,129, -314, -65,1529, -3689, -8209,
squares to a ternary bilinear recurrence sequence with relation
u(x)u(x - 6) = -u(x - l)u(x - 5) + 2u(x - 2)u(x - 4) + 2u(x - 3J.
More generally, the product of two elliptic divisibility sequences (see Chap-
Chapter 10) is (generically) a quaternary bilinear recurrence sequence. To see how these
kind of relations appear, notice that an elliptic recurrence relation can be written,
for each k, in the form
u(x + k)u(x - k) = Aku(x + l)u(x - 1) + Bku(xJ.
Squaring the equations for k = 2 and k = 3 enables the term in u(x+l)u(x — l)u(xJ
to be eliminated, leaving a relation
u(x + 3Ju(x - 3J = axu{x + 2Ju(x - 2J + a2u(x + lJu(x - IJ + a3u(xL.
Now replace x by x — 3. This kind of proof, starting instead with three equations,
can be used to show that a generic product of two elliptic divisibility sequences
satisfies a quaternary bilinear recurrence relation. Note that, just as in the linear
case, the relation can degenerate to one of lower order.
This closure property suggests many bilinear analogues of the results we will
present for the linear case.
The thesis [1268] also contains a proof of the following result due to Nelson
Stephens. Every bilinear recurrence with k = 4 arises (up to a natural notion of
equivalence) either from an elliptic divisibility sequence or as
7,V, (_yr r2 3 n-1 n
u\n) — \i) xn-l^n-2xn-3•• ' xl x0
where (xn, yn) = Q + nP for points Q and P = [0,0] on a suitable elliptic curve.

!2 1- DEFINITIONS AND TECHNIQUES
1.1.21. Integer sequences in general. Many more examples of sequences
of the type described here, as well as a vast number of quite esoteric examples, can
be found in [1222], [1223] as well as in [499]. In particular, the x-ih term may
depend on all previous terms. Sloane's On-Line Encyclopedia of Integer Sequences
[1222] will usually contain any known combinatorial information about a particular
sequence. However, number-theoretic properties of such sequences are very hard to
study except in an ad hoc fashion.
1.2. p-adic Analysis
Methods of p-adic analysis yield many simple proofs of results about recurrence
sequences. Throughout this section, let p denote a fixed prime. Any non-negative
integer m has a p-adic expansion
m = mo+ mip + m^p2 H h mkpk,
with 0 < rrii < p - 1 for i = 0,... ,k. Formally, negative integers and rationals also
have such a representation: For example, the formal identity
A.14) l+p+p2+p3+p4 + --- = -i—.
suggests the formal identity
A.15) -1 = (p - 1) + (p - l)p + (p - l)p2 + (p - l)p3 + • • • •
As discussed in Hardy's beautiful monograph [515],-the fact that a series diverges
does not make it meaningless. Any series of the form A.14) is divergent with
respect to the usual absolute value, but turns out to be convergent with respect to
a different measure of size.
Let m denote a positive integer, and write m = pordp(m^m' where m' is an
integer co-prime to p and ordp(m) € N is the order of p in m. The p-adic valuation
of m is \m\p = p-°rdp(m). More generally, given any non-zero element x of Q, write
x = pordp(x)x/ where ordp(z) € Z and x' is a rational number with no power of p
in the numerator or denominator, and then define \x\p = p~ordp(x). Further, define
|0|p = 0. A sequence an in Q converges p-adically if it is Cauchy: \am — an\p —> 0
as m, n —> oo.
The function | • |p is a metric on Q, satisfying the properties
A.16) \x + y\p < \x\p + \y\p and \xy\p = \x\p\y\p.
Counting powers of each prime in the numerator and denominator of a rational
shows the product formula
A.17)
The completion Qp of Q under | • |p is a complete metric space, the field of
p-adic numbers. Any element of Qp may be written as a series of the form
x_Np~N H h xq + Xip + x2p2 + ... ,
where each z; satisfies 0 < z; < p — 1. The closure of Z is called the ring of p-adic
integers, written Zp. It comprises all expressions of the form
A.18) xQ 2

1.2. p-ADIC ANALYSIS 13
With respect to the p-adic metric, Zp is a compact space (that is, any infinite set
has a limit point). To see this, notice that in any infinite set of expressions of the
form A.18), some infinite subset must share the same first coefficient. Similarly,
an infinite subset of those must share the same second coefficient, and so on. This
constructs a limit point of the infinite set.
The next result is Strassmann's Theorem. This is the p-adic analogue of the
Weierstrass Preparation Theorem. A function / : Qp —> Qp is analytic on the disc
of radius r > 0 about z — a if it is given by a series
fi(z-a) + f2(z -aJ + ... where f{ G
Up,
which converges for all values of z with \z — a\p < r. This convergence property
means that \fn\prn -> 0 and therefore the sequence {\fn\Prn) attains its maximum.
Write this maximum as D(f). Similarly, a function is meromorphic on a disc of
radius r if it is the quotient of two analytic function on that disc.
Theorem 1.7. Suppose f(z) = /0 + f\(z - a) + 72B — aJ + ... is analytic on
a p-adic disc of radius r about z — a. Then there is a polynomial g and a function
h analytic on the same disc, with
f(z) = g(z)h(z),
and such that h is never zero on the disc. With D(f) as above, write
k = max{n:\fn\prn = D(f)}.
Then g has degree k and therefore f has at most k zeros on the disc.
Proof. For simplicity, we will give the proof in the case where a = 0 and r = X.
This proof was given originally by van der Poorten [1015]. Each /, in the series
expansion f(z) = /o + f\z + f2z2 + ... is a p-adic integer so expand now in powers
of p. Then
f(z) = fo(z) + fl(z)p + f2(z)p2 + ....
The convergence guarantees that each of the coefficients are polynomials in z with
coefficients of fn{z) being p-adic units. Notice that the degree of fo(z) is k. By the
Euclidean algorithm, we can write /o — go, and
/1 = hxgQ + gu with deg gx < k.
Now repeat this by writing
/2 - hxgi = h2go + 92, with deg g2 < k.
By induction, write
fn - hn-igi Mn-i = hng0 + gn, with deg gn < k.
Let
00 00
h(z) = 1 + YJK{z)pn, and g(z) = Y,9n(z)pn.
n=\ n=0
Formally, this gives the required factorization because |/*(z)|p = 1 for all z € Zp,
and g is a polynomial of degree k. The series are in fact well-defined because the
coefficients of /o = go are p-adic units so the coefficients of the hn(z) and gn(z) are
p-adic integers. Thus the series converge on the disc. ?
It follows from Strassmann's Theorem that if / is meromorphic on a disc then
there is a polynomial g such that fg is analytic on the same disc.

14 1. DEFINITIONS AND TECHNIQUES
1.2.1. Recognizing rational functions. As seen in Section 1.1.11, linear
recurrence sequences are intimately connected to rational functions. A natural
question is to ask if the property of being a rational function can be recognized.
Eisenstein's Theorem (see page 103) shows that if a formal power series
f(z) = ^ anzn
n=0
is rational (or even algebraic), then the coefficients an lie in a finitely-generated
ring over Z. Thus no great generality is lost in restricting attention to the follow-
following question: When does a formal power series with integer coefficients represent
a rational function? A simple observation in this direction comes from complex
analysis.
Theorem 1.8. Suppose that f(z) = X^Lo anZn, &n ? Z, is complex-analytic
in a closed disc of radius R > 1. Then f is a polynomial.
Proof. By hypothesis, the series converges at z — 1, so \an\ —> 0. Since the an
axe all integers, they are forced to be zero from some point on. A sharper estimate
of the decrease in size comes by applying Cauchy's Theorem; this gives the bound
\an\ < M/2nRn+1, where M denotes any upper bound for |/| on the disc of radius
R about 0. ?
This result can be strengthened: It is enough to know that / is meromorphic
in a disc of radius R > 1.
An extremely "useful idea in many branches of mathematics is that the product
formula A.17) "means that exponential growth or hyperbolicity must appear with
respect to some p-adic valuation.
Theorem 1.9. Suppose that f(z) = X^o0"-2™ ^s complex-analytic in a closed
disc of radius R > 0, and p-adic analytic in a disc of radius r > 0. where rR > 1.
Then f is a polynomial.
Proof. The p-adic convergence of / on the (closed) disc of radius r means that
an\Prn+1 —> 0 as n —> oo. Therefore, jan|p < Mp/rn+1 for some constant Mp > 0.
Putting this bound together with the earlier one for the complex valuation gives
,u , . MM*.
Letting n —> oo shows that the right hand side tends to 0 because rR > 1. This
forces an = 0 to be zero for all sufficiently large n because for any integer m, either
m = 0 or 1 < |m||m|p. ?
Relaxing the condition on analyticity gives a criterion for rationality which
Dwork attributes to Borel [320].
Theorem 1.10. Suppose f(z) = X^^Lo0"-2" ^s comPlex-analytic in a closed
disc of radius R > 0, and is p-adic meromorphic on a disc of radius r > 0, where
rR > 1. Then f is a rational function.
Proof. Choose a polynomial g(z) = Yln=o9nZn sucn ^na^ 9f *s analytic in a disc
of radius r > 0; assume without loss of generality that go = 1. Write
n=0

1.3. LINEAR FORMS IN LOGARITHMS 15
Then
On | < M/Rn, and |6n|p < M/rn.
For n > e, fg = h implies that the coefficients bn are linear combinations of the
coefficients of / and g,
A.19) bn = an + an_i0i H h an-.ege.
Thus, for N > e, the Kronecker-Hankel matrix (see page 6) with first line
an,... , an+e, bn+e,... , bn+N,
has determinant Ajv,n(a) by replacing each column by a suitable linear combination
of earlier columns. A simple estimate for the determinant gives
|Ajv,n(a)| < (N + i)!A/JV+1/i2(n+2JV)(JV+1) and |Ajv,n(a)|p < A/^+i-e/
Choose N so large that (r/?)^ > 1. Then, for all sufficiently large n,
It follows that Ajv,n(a) = 0 for all sufficiently large TV, so / is rational by theorem
1.6. ' ?
A simple application of Borel's Theorem is to a special case of the Hadamard
Quotient Problem (due to Cantor [205]; see page 69 for more details).
Theorem 1.11. Suppose f(z) = YL^=q anzn is a power series over Z which is
the Hadamard quotient of the rational power series g(z) = Yl^=o bv.zn and h(z) =
X^n=o cnZn with bn, cn ? Z. That is, an = bn/cn for all n. Assume there is a p-adic
valuation such that one of the zeros of h strictly dominates the others. Then f is a
rational function.
Proof. By assumption, / has a radius of convergence R > 0. Without loss of
generality, assume the dominant zero is 1. Then
n=0 i n=0
where \6{\p < r < 1 for all i = 2,... ,r. This gives a meromorphic continuation
of / to a larger disc \z\p < 1/r. Now replace z by 62Z to obtain a meromorphic
continuation, of / to a disc of radius 1/r2. Keep doing this to give a meromorphic
continuation to a disc of radius l/rk for any k > 1. Eventually rkR > 1, in which
case Borel's Theorem 1.10 shows that / is rational. ?
1.3. Linear Forms in Logarithms
In the remaining sections in this chapter, we are going to see how powerful
methods from the theory of Diophantine approximation can give insights into the
arithmetic and growth of recurrence sequences. Suppose 0 denotes a quotient of
logarithms of algebraic numbers. The basic idea of the theory we now describe is
to obtain lower bounds for the quantity \6q — p\ of the form A/qB where B might
be much greater than 1. Theorem 1.12 below gives a general statement.
To give an example of how this is applied, consider the growth rate of the linear
recurrence sequence denned by
a(n + 2) = 2a(n-l)-5a(n), a(l) = 2, aB) =-6

16 1. DEFINITIONS AND TECHNIQUES
(cf. Section 2.4 for a full discussion.) The characteristic polynomial is x2 — 2x + 5,
whose zeros show that
a{x) = A + 2i)x + A - 2i)x.
Clearly \a(x)\ is bounded above by 2 x 5X//2. The difficulty in understanding the
lower bound is that the two roots are equal in absolute value, so no single dominant
root determines the growth rate. Potentially, \a(x)\ could be small at values of x
with ax ~ —1, where a = A + 2i)/(l — 2i). To put this in a usable form, choose
the principal branch for the logarithm of —1, ln(—1) = ni. Then for odd y
—ax = exp(x In a + yni).
Clearly ax ~ — 1 when x and y are chosen so that xlna + yiri is small. It is a
Diophantine problem to decide how large x and y must be to make x In a + yni
small. First, \z - 1| > | lnz| for \z - 1| < 1. Then
Now Baker's Theorem 1.12 guarantees a lower bound of the form A/XB, where A
and B are constants depending on a, and X = max{z, |y|}. Since x and \y\ are
essentially proportional in the region of interest, this gives a lower bound in terms
of x only. Hence there is a lower growth rate for a(x) as well:
5x/2/xB <\a{x)\<2.5x/2.
For clarity, a version of Baker's fundamental theorem is stated here.
Theorem 1.12. Suppose a.\.-.a.n are algebraic numbers with fixed branches
for their logarithms. Write x = (x\,... ,xn) for an integer vector, and let
Then there are constants A and B depending only upon lnai,..., lnan such that
A.20) A/||x||B < \x\ In a.\ + • • • + xnlnan|,
provided the right hand side is not zero.
Theorem 1.12 is a basic form of Baker's Theorem: The influence it has had in
the subject can hardly be exaggerated. One reason for this is its effective nature;
the constants A and B can be estimated effectively. Another is the huge range of ap-
applications that have been found for it. Initially, the effective estimates were beyond
practical use. An enormous amount of research has achieved practical estimates
for the constants A and B in both the Archimedean and the non-Archimedean set-
settings. The main use for these has been in the explicit determination of solutions of
particular Diophantine equations. Shorey and Tijdeman's book [1181] and Wald-
schmidt's book [1325] are both excellent references for.a good understanding of the
various forms of Baker's Theorem and their improvements and applications.
The bounds used can be formulated in the following 'multiplicative' forms. Let
7i,... , 7m be non-zero elements of an algebraic number field K of degree d over Q
with heights G\,... , Gm (see B.5) on page 30 for the definition of height). Set
ro-1
U) =

1.4. DIOPHANTINE APPROXIMATION AND ROTH'S THEOREM 17
and let p denote a prime ideal of Zk lying above the prime p. Then there are
effective absolute constants c\, C2 > 0 such that neither
0 < iTi1 ...7mra - II < exp(-M)C2?Tmogu;Log?0
nor
() d(cd)c*mnLog2
oo > ordp K1 .. .7^ - 1) > pd(Cld)C2mnLog2 B/logp
has a solution in integers 61,... , bm with absolute value at most B.
Moreover, it is known by [744], that if 71,... ,7m are multiplicatively depen-
dependent, then there are integers \b{\ = O(logm~l G), where G = max{Gi,... ,Gm},
not all zero, such that
rJ>l bm _ 1
h • • ¦ Im ~ 1-
A more explicit bound is given which can be simplified as above if 71,... , jm are
from a fixed algebraic number field. Such a result is an important ingredient in the
specialization arguments that follow. It is also useful for studying 'small' bases of
5-unit groups (see Section 1.5) and for finding 'small' representations of elements
of such groups [161], [175], [505]; see also [1126].
Ge [431] has described an algorithm, which given the data 71 , 7m € Zk
and 61,... ,bm e Z determines whether or not the product 7^ .. .7^" is a unit
'of Zk- The algorithm runs in time polynomial in m, the heights and degrees of
71,... ,7m, and in log 1611,... ,log|6m| (the most essential condition). This is much
faster than computing the products and then testing them.
1.4. Diophantine Approximation and Roth's Theorem
Diophantine approximation addresses the following question: How closely can
a positive real number 0 be approximated by rationals p/q in reduced form? In the
last section we considered deep results that show the approximations cannot be too
good when 0 is a quotient of logarithms of algebraic numbers. A long time before
lower bounds were considered, Dirichlet had asked the much easier question about
upper bounds. If 9 is rational then approximating it by other rationals is trivial,
so assume from now on that 0 is irrational. He showed that the inequality
q qd
has infinitely many solutions in co-prime integers p and q > 0.
For many years, lower bounds were sought in the case where 0 is an algebraic
number, culminating in Roth's celebrated theorem. This shows that, for algebraic
irrational 0, increasing the power 2 in Dirichlet's inequality means there will only
be finitely many solutions.
Theorem 1.13. Let 0 denote an irrational algebraic number. Given any e > 0,
and any constant C > 0, the inequality
e-p-
C
r>2+<-
A.21)
has only finitely many solutions in co-prime integers p and q. In other words, for
any e > 0, there is a constant C' = C'@, e) > 0 such that for all co-prime integers
p and q > 0,

18 1. DEFINITIONS AND TECHNIQUES
Roth's Theorem is highly non-trivial and it, together with its generalizations,
has been very influential. However it has resisted essential improvement on two
fronts. First, it is not effective in the following sense: The sizes of the finitely-
many pairs p and q which satisfy the inequality A.21) cannot be estimated. In
other words, the constant C cannot be estimated in terms of 0 and e. Thus, any
application of it, or its profound generalizations, will turn out to yield ineffective
results. Some of the weaker results proved en route to Roth's Theorem exist in an
effective form, and occasionally it is worth trading off strength against effectiveness.
We have not pursued this line at all although there are many examples in the
literature. On the other hand, it was known for some time that Roth's Theorem
could be improved in the 'quantitative' sense of counting the number of pairs p
and q which satisfy the inequality A.21). These improvements have led to some
extremely deep results which will be discussed at the end of this and the next
section.
The second question to resist attack asks whether q2+e in A.21) can be replaced
by a smaller function. It has been conjectured by Lang that q2(\nq)A (possibly
even A = 1 + e), would be admissible but no progress has been made at all. If 9
is replaced by e, the base for the natural logarithm, then much improvement on
Roth's Theorem is possible: Bundschuh [186] shows for example that
i
\eq-p\
A8qln4q)/ln\n4q'
In order to obtain generalizations, it is often useful to work with linear forms.
For example, both Dirichlet's Theorem and Roth's Theorem may be stated in terms
of the size oi\9q — p\.
For n > 2. let L(x) = a\X\ + • • ¦ + anxn denote a linear from in the vector
x = (xi,... , xn). For n = 2, Roth's Theorem can be stated in the following way.
Suppose ai,ao are algebraic numbers, and e > 0 is given. Then the inequality
has only finitely many integral solutions x € 1? provided 01/02 is irrational.
This re-formulation suggests how Roth's Theorem might be extended to a state-
statement about a linear form in algebraic numbers. The following was proved by Wolf-
Wolfgang Schmidt (see [1143], [1144], [1145], [1146]).
Theorem 1.14. Given a linear form L with ai,... ,an algebraic and generating
a Z-module of rank n, the inequality
has only finitely many integral solutions x € Zn.
This is a deep theorem in itself, but even it is subsumed by the Subspace
Theorem that now follows.
Theorem 1.15. Given n linearly independent linear forms Li with algebraic
coefficients, the solutions x6Zn of
lie in finitely m,any proper subspaces of Qn.

1.5. SUMS OF S-UNITS 19
To obtain Roth's Theorem, the subspace theorem is applied to the two linear
forms q and Oq — p. To obtain the generalization to Theorem 1.14, simply augment
the linear form L by n — 1 of the coefficients, which are again linear forms. In
the next section, we will see how these results can be generalized in a way that
makes them applicable to problems such as finding the growth rate of general linear
recurrence sequences.
Theorem 1.15 and its p-adic generalization, have quantitative versions, where
the number of exceptional solutions can be estimated. Pointers to applications will
come at the end of the next section.
1.5. Sums of 5-Units
The final Diophantine stream in this story appears to take us adrift of our
main theme. We will discuss 5-unit equations and estimates for the size of a sum
of 5-units. The aim is to present the main ideas as they apply to the theory of
linear recurrence sequences. It would be easy to fill a large volume just on the topic
of 5-units. It took some real insight to see how this topic could be applicable to
questions about the vanishing and the growth rate of linear recurrence sequences.
It is a good example of the way a difficult problem can become more accessible once
it is expressed in a more general way.
To motivate this, consider the possible size of the expression
G(x) = 2Zl -312, form,^ G N.
For this simple example, it is clear that the equation G(x) = 0 has only finitely
many solutions, because of the multiplicative independence of 2 and 3. The growth
rate question is not so easy to deal with. It is possible to find x = (x\,X2) such
that x,\ log 2 ~ x'2 log 3, so it is reasonable to ask if there can be found x ? N2 with
G(x) ~ 0. This turns out not to be possible in the following sense.
Theorem 1.16. Given any e > 0, the inequality
A.22) |G(x)|<max{2Il,3l2}1-e
has only finitely many solutions with x G N2.
To prove this, write the inequality in terms of 5-units. Let S denote the set
5f = {2,3} and write, for any integer k,
\k\s = \k\\k\3\k\3
for the S-norm of k. Notice that the 5-norm of an integer is 1 if and only if the
integer comprises powers of 2 and 3 only in its prime factorization: Such an integer
is called an S-unit. Notice that
and
|2Xl -3l2|2 = \2Xl -3X2|3 =
Given a solution of A.22), write for simplicity
X = 2X\ Y = 2»x\ and Z
Then
A.23) \X-Y\ = \XY(X - 7)| • \XY(X - Y)\2 ¦ \XY(X -Y)\3< Zl".

20 I- DEFINITIONS AND TECHNIQUES
Assume without loss of generality that X = Z. On cancelling X and noting that
|X|3 = \Y\2 = 1, A-23) simplifies to give
A.24) \Y(X - Y)\ ¦ |X(X - Y)\2 ¦ \Y{X - Y)\3 < X~\
Schlickewei generalized Schmidt's subspace theorem 1.15 by adjoining p-adic linear
forms for a finite set of primes p. The result is known as the p-adic subspace
theorem (see [380], [381], [1121], [1122], [1128]).
Theorem 1.17. Suppose n > 1 and let S denote a finite set of prime numbers.
Suppose that L\,... . Ln are linearly independent linear forms with rational coeffi-
coefficients and, for each p ? S, Lip,... , Lnp are linearly independent linear forms with
p-adic coefficients. Then the solutions xsZn of the inequality
lie inside finitely many proper subspaces ofQn.
The inequalities given before all hold with algebraic linear forms provided a
symmetry condition is fulfilled, which says that each of the forms must occur as
often as any algebraic conjugate.
Theorem 1.16 follows easily from the p-adic subspace Theorem 1.17. Here n = 2
and A.24) shows that the linear, forms to consider are
L\ = Y.L2 = X — Y; L\i = X, L22 = X — Y; L13 = Y, L23 = X — Y.
If the inequality A.22) had infinitely many solutions in N, they would lie inside a
finite number of 1-dimensional subspaces. However, since X and Y are co-prime,
each subspace can only contain finitely many solutions of A.22).
Theorem 1.16 could also be proved using Baker's Theorem 1.12, since G consists
of only 2 terms. Indeed, Baker's Theorem 1.12 yields the better result that the
inequality
\G\<Z/(log Z)B
has only finitely many solutions, for some constant B > 0. However, the argument
using the Subspace Theorem can be used as the base step for an induction to yield
the deep Theorem 1.18. Given any finite set of prime numbers S, x € Z is called
an S-unit if it is composed only of powers of primes in S.
Theorem 1.18. Given integer variables Xi,... ,Xn, write
Given e > 0, and any C > 0, the inequality
\x\ + ---+xn\<cz
has only finitely many solutions in S-units Xi,... , Xn, under the assumption that
no proper sub-sum vanishes.
To make a result like this applicable to the growth rate of linear recurrence
sequences two things need attention. First, a result similar to Theorem 1.18 is
needed for algebraic S-units, both over Q and Qp for primes p in S: This can
be done in a fairly routine way. Second, a linear recurrence sequence can contain
polynomial terms. These can be handled by working not with S-units above, but
with a slight generalization. The polynomial extension allows integers whose S-
norm grows less that some small power of \x\ - the power depending upon e. For

1.5. SUMS OF S-UNITS 21
example, if S = {2} and x = nk2n for k > 0 then for any 5 > 0, |:r|s < \x\5 for
all but finitely many x. Finally, a good lower growth rate is obtained for a general
linear recurrence sequence. The precise result is given in Theorem 2.3.
It seems almost incredible that these profound methods are required to obtain
the growth rate for general linear recurrence sequences. Even so, the lower bound
is inferior to that obtainable for binary and ternary recurrences. The discussion of
this problem is taken up again in Section 2.4.
Theorem 1.18 and the generalization alluded to, have quantitative generaliza-
generalizations. These profound results lie behind many of the spectacular explicit results
such as B.3) on page 27, B.4) on page 29, and several results in Section 2.5.
Faltings and Wiistholz [386] give a different approach to the subspace theorem,
using Falting's 'product theorem' [385]. This new approach has lent itself to major
improvements on quantitative results.
1.5.1. The S-unit equation. The following theorem is a direct consequence
of Theorem 1.18.
Theorem 1.19. Given integer variables X\,... ,Xn, the equation
has only finitely many solutions in S-units X\,... , Xn, under the assumption that
no proper sub-sum vanishes.
It is possible to express this result as a homogeneous equation providing one
takes care to establish that it is only classes of solutions which are co'unted; where by
classes, we mean that two solutions are identified if one is a term-by-term multiple
of the other. Clearly, if one solution is found then any multiple by an S-unit would
yield another.
As in Theorem 1.18, the statement can be generalized to include algebraic S-
units. Also, we can allow the S-norm of the terms X\,... ,Xn to grow slowly in
terms.of Z = m&x{\Xi\, • • • > |-^n|}- An immediate .consequence of this follows. .
Corollary 1.20. A non-degenerate algebraic linear recurrence sequence has
only finitely many zero terms.
PROOF. If this were not so, apply Theorem 1.19 to deduce that some sub-sum of
the terms must vanish infinitely often. Successively apply Theorem 1.19 to deduce
that a sub-sum of two terms vanishes infinitely often. This means the two terms
are multiplicatively dependent; in other words, the sequence is degenerate. ?
In the next chapter, this question is studied in more detail. It was solved
initially a long time before much of the powerful Diophantine machinery came into
being, and the earlier remarks about ineffectiveness apply here. This method gives
no effective method for determining the zero set of a linear recurrence sequence.
Quantitative versions of the S-unit equation now enable very strong statements
to be made about the number of zeros of linear recurrence sequences. To describe
these, let S denote a finite set of valuation of an algebraic number field K, containing
all the Archimedean valuations. An element u € K is called an S-unit if \\u\\v = 1 for
all valuations v ? S. Let ai,T.. , an be non-zero elements of IK and let d = [K : <Q>].
Consider the linear equation
H + anun = 1,

22 1- DEFINITIONS AND TECHNIQUES
in S-units u\,... . un such that no proper sub-sums a^u^ H + aimUim, m < n,
vanish. Evertse [375] proves that, for n = 2, the number of solutions does not
exceed
Notice that d < 2\S\ because S includes all Archimedean valuations, so the bound
can be simplified to 3 x 74I5L
This result has been improved by Beukers and Schlickewei [96] (some analogues
of these results have recently been obtained in [1309]). They provide a similar
bound for equations in elements of finitely generated multiplicative groups of C*.
More precisely, they show that for a group G with r generators, the equation
u\ + U2 = 1, u\, U2 € G has at most 28r+8 solutions. Although elements of G are
5-units for an appropriate set S, the size of S cannot be estimated in terms of r.
The result is very precise because Erdos, Stewart and Tijdeman [357] show that
for K = Q the number of solutions can be more than
for some S with |5| = s. Evertse, Moree, Stewart, and Tijdeman [379] extended
this result, showing that for an arbitrary n > 2 and sufficiently large s there are
S-unit equations with |5| = s and
exp (i + o(l))-^— ^-^log7"* solutions, 5^00.
L n~ 1 J
Bombieri, Mueller and Poe [128] propose an alternative method which leads to
a weaker estimate, which can nonetheless be useful for similar questions. For equa-
equations over an algebraic number field K, the dependence of the number of solutions
on the degree d = [K : Q] has been studied by Grant [473].
The special case when G is the group of roots of unity is studied in a number
of papers; see [319], [377], [1124], [1374].
More recently, these results were transferred to the equation
H h anun = 1,
in elements v,i,... ,un € G, where G is a finitely generated multiplicative group
of C* with r generators. Evertse, Schlickewei and Schmidt [382] prove that the
number of solutions of such an equation does not exceed
exp[(r + 2)FnLn].
These and many other results can be found in the exhaustive survey [380], see
also [381]. For 77 = 2 explicit upper bounds for the size of solutions [378] are known,
but this is still an open problem for S-unit equations in n > 3 variables, [376]
and [1037]. The question is related to the famous a6c-conjecture. In the special
case K = Q, that conjecture can be formulated as follows. Let a, b, c denote
relatively prime positive integers satisfying a + b = c, and let
c= n p-
p€P;p I abc
The a&c-conjecture of Oesterle and Masser claims that the bound c = O(G1+?) must
then hold. The conjecture is motivated by function field results — in particular
the Mason-Stothers theorem from polynomial algebra — which are invariably more
straightforward than their number field analogues (for n = 2 as well as for n > 3),

1.5. SUMS OF S-UNITS 23
see [56], [160], [171], [548], [781], [920], [1002], [1006], [1041], [1162], [1285],
[1286], [1308], [1309], [1324], [1326], [1373] and their references. The strongest
current unconditional estimate
logC <
is obtained by Stewart and Yu [1250] (which improves their previous bound [1249]
with 2/3 instead of 1/3) using Yu's refinement [1366], [1367], [1368] of van
der Poorten's p-adic estimates for linear forms in logarithms of algebraic num-
numbers [1017]. Surprising results are obtained in [168] using a hew ingenious method;
see also [389].
Applications of the abc conjecture to prime divisors of Lucas and Lehmer num-
numbers have been given in [894], see also [1071] and [1075].
It is also known, see [378], [503], that there are at most
exp(n236nd!s6lnDsd!))
non-equivalent 5-unit equations with more than 2(n+1)! — 1 solutions,.and, for n = 2,
at most
non-equivalent 5-unit equations with more then 2 solutions, where s = \S\.

CHAPTER 2
Zeros, Multiplicity and Growth
In this chapter some deeper properties of linear recurrence sequences are stud-
studied. Many of these are motivated by the Skolem-Mahler-Lech Theorem, and many
take the form of describing the set of solutions in the index variable to equations
involving linear recurrence sequences. As explained in Sections 1.3 and 1.5, ques-
questions such as these are often accessible using Diophantine analysis. In this chapter,
more tools from that subject are introduced.
2.1. The Skolem-Mahler-Lech Theorem
The following statement is the celebrated Skolem-Mahler-Lech Theorem. The
finite sets alluded to below may be empty, and the sets referred to are the sets of
indices x for which a(x) = 0.
THEOREM 2.1. The set of zeros of a linear recurrence sequence over a field of
characteristic zero comprises a finite set together with a finite number of arithmetic
progressions.
PROOF. The most important case of sequences defined over the rationals is sketched
here. For a brief but detailed proof in the general case see [1026].
Let L denote the splitting field of the characteristic polynomial of the given
linear recurrence sequence a, and choose a prime p with the property that all char-
characteristic roots are units in Qp and the prime ideal generated by p splits completely
in L. Then, for each i, af-1 = 1 (mod p) so the p-adic logarithms
=ioSp{i-(i-ar1
f *
are defined, and ordp(logpaf *) > 1. This allows one to p-adically interpolate the
(p — 1) sequences (a(r + (p — l)x)), 0 < r < p — 2, yielding p-adic analytic functions
m
ar(t) = ? Mr + (p- l^Kexp^logpaf1), r = 0,1,... ,p - 2,
converging for ordpt > -1 + l/(p - 1), and in particular on Zp. Since Z is a
dense subset of the compact set Zp, if any of these functions has infinitely many
integer zeros it must vanish identically. It follows by the pigeonhole principle that,
if the original linear recurrence sequence a has infinitely many zeros, then at least
one of those p — 1 functions vanishes. In particular, it follows that for some r,
a(r+(p-l)x) =0,x = l,2.... ?
It follows that if the linear recurrence sequence has infinitely many zeros then
it has a pair a\ ^ ctj of distinct characteristic roots for which (ai/aJ)p~1 = 1. Thus
Theorem 2.1 is the assertion that if the linear recurrence sequence is non-degenerate
then, since there is no arithmetic progression of zeros, the number of zeros is finite.
25

26 2. ZEROS. MULTIPLICITY AND GROWTH
Theorem 2.1 was first noticed by Skolem [1221] for the case when the exponen-
exponential polynomial representing a is denned over Q, and generalized by Mahler [770]
to exponential polynomials over algebraic number fields. The completely general
case appears in [694] and [771]; the history and some additional references can be
found in [1026] and [1284]. A completely elementary proof is given in [513].
2.1.1. Questions suggested by Skolem-Mahler-Lech. Several questions
are suggested by Theorem 2.1, including the following.
• Can the size of the common difference of the arithmetic progressions in
the degenerate case be estimated?
• Can the theorem be used to decide whether a given linear recurrence
sequence has infinitely many zeros?
• Can the number of zeros of a non-degenerate linear recurrence sequence
be estimated?
• Can the set of zeros be found effectively?
• Can the general bounds for special interesting families of'linear recurrence
sequences be improved?
• For what other interesting classes of sequences does a similar result hold?
• Does Theorem 2.1 have an analogue in fields of positive characteristic?
The literature on these questions is substantial, and most of them have a com-
complete or a quite satisfactory partial solution. The exception is the fourth question:
No effective method is known to find the set of all zeros for an arbitrary non-
degenerate linear recurrence sequence.
The simplest question — at least in principle — is the first. For a linear
recurrence sequence of order n over an algebraic number field K with degree d
over Q, the least common multiple of the differences of the corresponding zero-
progressions does not exceed M(d,n), where M(d,n) is given in Theorem 1.2.
Since the bound in Theorem 1.2 does not depend on further particulars of the
sequence itself, this gives a positive answer to the second question also; see [87],
[126], [1083], [1300] and [1301] for details.
2.2. Multiplicity of a Linear Recurrence Sequence
For a linear recurrence sequence a over a ring 1Z and a fixed element c E 1Z
denote by m(a, c) the multiplicity of the element c among the terms of the sequence
a, that is the number of solution of the equation a(x) = c. Set m(a, c) = oo if there
are infinitely many solutions, and for brevity write ra(a, 0) = m(a) for the zero
multiplicity. The total multiplicity M(a) is the number of solutions of the equation
a(x) = a(y). x =? y; equivalently
M(a) = ]T m(a, c) {m,{a, c) - 1).
The Skolem-Mahler-Lech Theorem shows that m(a, c) is finite; the same result for
M{a) is more recent, see [376] and [1037]. No effectively computable upper bound
for M(a) is known, but for several special classes of sequences effective upper bounds
on M(a) are known in the context of equations with linear recurrence sequences
like B.11), B.12), B.13) presented below.
Introduce functions
B.1) fio(n,TZ) = sup m(a), and /j,(n, TV) = sup m(a,c),
a- m(a,c)<oo

2.2. MULTIPLICITY OF A LINEAR RECURRENCE SEQUENCE 27
where the first supremum is taken over all non-degenerate linear recurrence se-
sequences of order n over 71, and the second is taken over all pairs of non-degenerate
linear recurrence sequences of order n over 1Z and c E 7Z for which m(a, c) is finite.
The second definition in B.1) is not affected if the supremum is only taken over
sequences for which at least one of the characteristic roots is not a root of unity.
A useful exercise is to prove that fj,oB,TZ) = 1 for any ring 1Z without zero
divisors.
For other cases it is not a priori clear that either of the functions in B.1) is
finite. However, a number of authors have suggested that both these functions are
finite for a wide class of rings. For fj,o(n/IZ) there are fairly explicit conjectures
in [742]; see also the discussion in [1023] and in [1026],
The representations A.3) or A.4) show that (a(x) — c) is a linear recurrence
sequence of order at most n + 1, which is non-degenerate if a is non-degenerate and
none of its characteristic roots is a root of unity. Thus,
It follows that for finiteness questions it is enough to study the multiplicity of zero
for linear recurrence sequences.
If L is an extension of degree d of ?, then
fio(n,L) < fio(nd,?).
This is evident since the sequence of norms of a linear recurrence sequence of order
n over L is a product of d linear recurrence sequences of order n, and therefore is
a linear recurrence sequence of order at most nd over ? (see Theorem 4.1).
Moreover, using specialization arguments, estimating fio(n,?) for an arbitrary
field ? of zero characteristic can be reduced to estimating (io(;n,Qp). Before pre-
presenting concrete results, notice the central conjecture that fj,(n, Qp) < oo is still
open.
Seminal work was done by Schlickewei [1125], using bounds on the number
of solutions to 5-unit equations (see Section 1.5.1). He obtained the first general
uniform upper bound on /j,o(n,K) in terms only of n and d = [K : Q]. The bound
contained four levels of exponentiation. Later, Schlickewei and Schmidt [1133]
considerably lowered that bound to
B.2) . fio(n,K) < BnK5riVn!
For other estimates (which are stronger in some cases) see [380], [381], [382],
[1128], [1134], [1148].
2.2.1. Multiplicity of low order sequences. It is clear that ^oB,K) = 1
for any field K; the corresponding question for (j,B,K) is far from trivial. The
bound
B.3)
has only recently been obtained by Beukers and Schlickewei [96]. This is not too far
from the actual value — generally conjectured to be 6. This result is the strongest
in a series of other upper bounds which have been obtained recently [128], [388],
[1127], using quantitative bounds for the number of solutions of S-unit equations.
On the other hand, for linear recurrence sequences of rational integers, better
results are known. Kubota [644], [645], [646], refining the p-adic arguments (and

28 2. ZEROS, MULTIPLICITY AND GROWTH
results) of Laxton [688] and others, proves that
This is stronger than Morgan Ward's conjecture that 5 is the upper bound. Beuk-
ers [93] improved this result by showing that
m(a, c) + m(a, —c) < 3
for all binary integer non-degenerate linear recurrence sequences with at least one
characteristic root not a root of unity, with essentially only 5 different exceptions
(up to some trivial transformations).
One reason that 6 is expected in the right-hand side of B.3) is the following
precise result of Beukers [94]:
AtoC,Z) = 6.
That 6.is a lower bound had been known for some time. It is achieved by the
following non-trivial example due to Berstel. The sequence
a(x + 3) = 2a(x + 2) - 4a(x + 1) + 4a(ar), a(l) = aB) = 0, aC) = 1,
has a(l) = aB) = aE) = aG) = aA4) = aE3) = 0; the largest of the intermediate
values is aE2) = —884763262976. The conjecture that this example was extremal
had been made for some years, with only partial progress being made (the proof
announced in [646] has never appeared) until it was finally settled in [94]. It is
believed that Berstel's sequence is extremal even among sequences over C; thus in
place of B.3) one should expect (j,B,C) = 6.
Brindza, Pinter and Schmidt [164] describe a rather general sufficient condition
on a linear recurrence sequence a which guarantees that m(a,c) = 1.
2.2.2. Lower bounds for the multiplicity. The only known non-trivial
general lower bounds for either fio(n, 71) or /j,(n, 71) is
obtained by Bavencoffe and Bezivin [74]. They show that the sequence with initial
values a(l) = 1, aB) = • • • = a(n) = 0 and with characteristic polynomial
X + 2
has at least that many zeros, and they detail the structure of the zero set. For n = 3
one obtains Berstel's sequence, which happens to have an extra zero at x = 53.
Earlier, Williams [1356] noted that a linear recurrence sequence satisfying
a(x + n) = f\a{x + 1) + foa(x),
with a(l) = 1, aB) = • • • = a(n) = 0, has at least n(n - l)/2 zeros.
Bavencoffe and Bezivin [74] also provide some computational results suggesting
that n{n + l)/2 — 1 may well be the precise value of fj,o(n, Z) for n > 4.

2.2. MULTIPLICITY OF A LINEAR RECURRENCE SEQUENCE 29
2.2.3. Non-uniform bounds. The main feature of the bounds B.2), B.3) is
that they do not depend on the particular sequence. On the other hand, they are
not the only results in this area. There are other, non-uniform, bounds which, for
particular classes of sequences, may produce stronger results.
For example, the explicit bound
m(a) < 2 max {2, ln|a(i)|} F#(/)JnV'
l<i<n
is obtained in [1300] and [1302] for any non-singular integer linear recurrence
sequence of order n, where H(/) is the height of the characteristic polynomial. The
height H(f) is a normalized version of the Mahler measure which we will discuss
in the next section, see B.5).
A half-uniform result, claiming that for a non-singular algebraic linear recur-
recurrence sequence, m{a) can be bounded in terms of its characteristic roots only (in-
(independently of the initial values) was at least known in the folklore since 1976;
see [1015]. In a precise (albeit implicit) form it appears in [742], and it is applied
in [1192].
An explicit bound is obtained in [1123] by applying an argument depending
on an estimate for the number of solutions of S-unit equations. An interesting
feature of the bound is that it depends on lj, the number of distinct prime divisors
of the characteristic roots, rather than on the characteristic roots themselves. In
particular it is uniform if all the characteristic roots are units. Shortly after, this
bound was improved in [1038] to
B.4) .m(a)<(n-l)D(d + uj)J(d+1)
where d is the degree of the splitting field K of the characteristic polynomial of the
non-degenerate linear recurrence sequence a.
Bearing in mind that the goal is a uniform bound like B.2) and B.3), the most
unwelcome parameter in B.4) is u. Motivated by this, it is pointed out in [1040]
that B.4) also has the form
m(a) < C(K)(n - l)u;Logu;
where C(K) is a constant depending on the splitting field K only. This is a fairly
poor bound which depends on Tchebotarev's Density Theorem. This method is an
application of the ideas of Cassels [213].
We should explain how u comes to appear in bounds like B.4). The proof is
based on refining the p-adic method of [1015] (cf. Theorem 2.7 below), and follows
the same lines as the p-adic proof of the Skolem-Mahler-Lech Theorem. Instead of
applying the compactness of Zp, the p-adic orders of the coefficients of the power
series expansions of the functions ar(t) are estimated, and then Strassmann's The-
Theorem is applied. This is not too difficult as the expansions are linear combinations
of polynomials and exponential functions. At this point the upper bound depends
only on n and p. However, one must choose p so that the characteristic roots are
units in Cp, so p should be co-prime to each prime ideal divisor of the characteristic
roots. There are u forbidden primes and so the smallest allowed prime can only be
guaranteed to have p = O(ujLogLj).
2.2.4. A result of Beukers and Tijdeman. For binary linear recurrence
sequences, an interesting upper bound is found by Beukers and Tijdeman [97]. Let

30 2- ZEROS, MULTIPLICITY AND GROWTH
M{"d) be the Mahler measure of an algebraic number •d of degree d over Q, that is
d
where the product is over all conjugates d\ = ti,... ,$d, and fa is the leading
coefficient of the minimal polynomial / of -d over Z. The height of #, which is the
same as H(f), the height of / from the last section, is related to M{fl) by the
formula
B.5) M(tf) = H(f)d.
Theorem 2.2. For any binary non-degenerate linear recurrence sequence a
over an algebraic number field K, and any c € K,
m(a, c) < max{29,20 + 5.3d1/2/ log1/2 M}
where M = max{M(ai),M(a2),M(ai/a2)}, andd- [K : Q].
It is clear that M (#) > 1; an old result of Kronecker says that equality holds
if and only if ¦& is a root of unity. The question of whether there is a uniform
lower bound C > 1 for M(fl) when •d is not a root of unity is a classical problem
in the theory of algebraic numbers, see [140], [373, Chap. 1], and [909, Notes to
Chap. 2]. Lehmer [695] first raised this problem in connection with the growth
rate of Lehmer-Pierce sequences (cf. page 180). In his paper [695], Lehmer gave
some examples of integral polynomials with small Mahler measure. For example,
the polynomial
B.6) x10 + x9 - x7 - x6 - x5 - x4 - x3 + x + 1
has Mahler measure approximately 1.17628.... Despite a considerable amount
of computation (see [139], [141], [868], [869]) during the intervening 70 years,
no smaller measure greater than 1 has been found. The polynomial in B.6) is
reciprocal; the smallest value of Mahler's measure for non-reciprocal polynomials
is known to come from
B.7) ... x3-x-l,
a fact proved by Smyth in his beautiful paper [1225].
The Mahler measure of a polynomial also arises in ergodic theory [731] and the
theory of periods [290], [626]. Indeed, Lehmer's problem can be formulated entirely
in terms of the entropy properties of group automorphisms [727]. The arithmetic
of Mahler measures, and their connections with special values of L-functions, has
been studied in [147], [148], [149].
A positive answer to Lehmer's problem would imply a uniform upper bound
for mB,Q). The best current result from [304],
- •• . - MG?)-l»ln3lnd/ln3d,
gives
where d = [K : Q]. For smaller d this can be improved to nB, Q) < 29 and
M2,K) = 100max{300,d}.
The paper [97] deals with complex linear recurrence sequences as well. In
particular, it is shown that if A, a € C and \a\ > 2 then the equation Aax+Aax = 1
has at most 7 integer solutions. It is an immediate consequence of this result that

2.4. GROWTH OF LINEAR RECURRENCE SEQUENCES 31
for any A, a € C the same equation has at most 2 solutions if \a\ — 1 and at most
7 + 7 In 2/ |In | a 11 solutions otherwise.
2.2.5. More remarks on multiplicity. There are other classes of linear
recurrence sequences for which sharper upper bounds can be obtained. For example,
if all the characteristic roots are real, then Rolle's Theorem produces the bound
B.8) m(a)<2n-2.
This reduces to m(a) < n -1 if all the roots are positive (see [1009, Part 5, Chap. 1,
Problem 75], and [1026]). Voorhoeve [1313] provides results on the horizontal
distribution of complex zeros of such polynomials, and many other relevant results.
Although these bounds do not even imply that mo(n,Z) < oo, they give useful
results. For many special sequences they give much better results than B.2) or B.3).
A related but much simpler question is the following. Let N(n) be the largest
iV for which there is a complex linear recurrence sequence a of order n with
It is shown in [762] that N(n) < n2 — n + 1 for all n, and N(n) = n2 - n + 1 for
every prime power n.
Similarly, define M(n) to be the largest M for which there is a complex matrix
exponential function A(x) — -QTX and a complex (n x n) matrix T such that
P(l)|| = ¦ • ¦ = ||A(A/)|| ^ \\A(M+ 1)||, where \\A\\ denotes the Euclidean norm on
A ? Cn. Then M(n) can be viewed as the largest number of consecutive terms of
a matrix exponential function on a sphere. The same paper [762] establishes the
upper bound M(n) < n2 and the lower bound M{n) = (n — IJ for every prime
power n = pr. For a fixed matrix A, the largest M is bounded by 2k? — k2, where
k is the number of distinct zeros and ? is the degree of the minimal polynomial of
T~. Of course, similar questions may be asked for other sequences and other norms.
2.3. Finding the Zeros of Linear Recurrence Sequences
An effective method for finding all the solutions of the equation a{x) = 0
remains an intractable problem. Neither the 5-unit equations nor Strassmann's
Theorem gives such a result. Both work with p-adic solutions, from which there
seems no way back to Archimedean norms. This is a common obstacle in the
theory of Diophantine equations (see [376], [378], [503], [907], [1023], [1026],
[1037], [1181], [1233]).
Mignotte and Tzanakis [824] propose a useful method for dealing with equa-
equations of the form a(x) = c, and even the more general a{x) = 5, where 5 is a variable
multiplicatively generated by the elements of some finite set 5. Their method is
applicable in the following situation arising in practice. Assume one 'knows' the
solution set; then the method helps to prove that there is indeed no other solution.
Its practicality has been demonstrated on several examples, one of them related to
Berstel's sequence.
2.4. Growth of Linear Recurrence Sequences
The Skolem-Mahler-Lech Theorem gives the non-effective statement \a(x)\ —>
oo for x —> oo for any non-degenerate sequence a whose characteristic roots are
not all roots of unity. The simplest examples of linear recurrence sequences a have

32 2. ZEROS, MULTIPLICITY AND GROWTH
a characteristic logarithmic growth rate (cf. Theorem 11.17). In other words, the
quantity
- ln|a(x)|
x
tends to a limit as x —> oo. This is easy to see for the Mersenne and Fibonacci se-
sequences because they have dominant roots. In Section 1.3 we showed how powerful
machinery from Diophantine approximation can be used to obtain the growth rate
for a binary linear recurrence sequence without a dominant root. The trivial upper
bound
\a(x)\ < A\ax\xxn
where A is the largest absolute value of the coefficients of polynomials A{ in the
representation A.4), is the first yardstick against which an understanding of the
growth rate should be measured. In [742], the conjecture was made that any integer
non-degenerate linear recurrence sequence has, essentially, the maximal possible
growth (see the next theorem for the precise statement). This conjecture was proved
independently by Evertse [376] and by van der Poorten and Schlickewei [1037].
Theorem 2.3. For any algebraic non-degenerate linear recurrence sequence a,
and any e > 0, there exists a constant xo(a,e) for which
Kz)|>|ai|A-e)a\ ifx>xo(a,e).
This result is sufficient to establish the logarithmic growth rate. Notice that
the Lehmer problem, which was discussed in Section 2.2.4, suggests the growth rate
for non-degenerate integer linear recurrence sequences is uniformly bounded below.
As indicated in Section 1.5, Theorem 2.3 was obtained as a corollary of more
general statements for 5-unit equations. Unfortunately the proof is not effective,
and does not give an estimate for xo(a, e). Finding an effective version of this result
is still an important open problem. With current methods, this depends upon an
effective Roth Theorem at the very least, something which has proved to be very
elusive. Also, there is clearly some daylight between the lower growth rate in
Theorem 2.3 and that obtained in the binary case. Once again, improvements seem
to depend upon improvements to Roth's Theorem which seem to be intractable
currently.
Although no general effective version of Theorem 2.3 is known, there is a class
of linear recurrence sequences where such an improvement is readily obtained. As
an easy example, consider sequences over C with r = 1 dominating characteristic
roots. It is an easy exercise to estimate \a(x)\ from below as
\a(x)\ > C(a)\ai\x, x>xo(a),
where C(a) and xo(a) are effectively computable constants depending on the se-
sequence a (recall that all the characteristic roots, including ct\, actually participate
in the representation A.4)).
The case of a pair of dominating characteristic roots cannot be treated by
elementary arguments. A non-effective estimate, based on the p-adic Roth theorem,
was given in 1966 by Mahler [772]. In Section 1.3 we showed, in a special case,
how the theory of linear forms in logarithms can provide a good lower growth rate.
An added bonus is the effectiveness of the method — the constants A and B can
be estimated in terms of the starting parameters. Apparently, if one is looking for
an effective estimate, the need for bounds for linear forms in logarithms arises even

2.4. GROWTH OF LINEAR RECURRENCE SEQUENCES 33
for binary integer linear recurrence sequences. The approach given in Section 1.3
generalizes easily, as follows. Consider the expression
\Axax + A2ax2\ = \Al\\a1\x\(-A2/A1)(a2/cnr - 1|.
where A\, A2, otx, a2 are non-zero elements of some algebraic number field, |ai| >
|q2|> and 0:2/01 is not a root of unity. Appropriately choosing the branch of the
logarithm, if |(—A2/Ai)(a2/cti)x ~ 1| is small then
|ln(-^2Mi) +a;ln(a2/Qi) - ikir\
is also small for some integer k = O(x) (with an effective implicit constant; for a
quadratic field it can be shown that k < 2(x + 1), see [1179]). One now applies
a lower bound for linear forms in logarithms. This. approach may be found in the
papers of Schinzel [1114] and others. These results were sharpened in [1179].
Finally, Mignotte [818] shows that even the case of r = 3 dominating characteristic
roots can be treated along these lines, yielding precisely the same lower bound.
Thus all ternary integer linear recurrence sequences are automatically included.
THEOREM 2.4. For any integer non-degenerate linear recurrence sequence a of
order n with r < 3 dominating characteristic roots,
\a(x)\ > la^aT^, x>xo(a),
where k(a) and xo(a) are effective constants depending on the sequence.
For algebraic linear recurrence sequences, a slightly weaker estimate
B.9) \a(x)\>\ai\xexp(-k(a)ln2x)) x>xo(a),
is obtained in [823]. One obtains precisely the same estimate as in Theorem 2.4 if
Qx, a2) c*3 are simple roots. These estimates are nearly best possible, because for
any linear "recurrence sequence \a(x)\ = O(\ct\\xxn). Note that the constants k{a)
and xo(a) in Theorem 2.4 and in B.9) can also be estimated as
k(a),xo(a) <c(f)InH(a)
where the constant c(/) depends on the characteristic polynomial only, and H{a)
is the largest height of the initial values a(l);... ,a(n). This is a combination of
Theorem 4 and 5 of the paper.
It is mentioned in [823] that for r = 4 a p-adic version of the method can be
used. It does not produce any lower bound (other than for the p-adic valuation)
but it does provide an effective estimate for the largest zero of a ternary algebraic
linear recurrence sequence whose characteristic polynomial has no multiple root.
Related results are obtained in [1300], [1301].
For binary sequences, complicated explicit expressions for the constant c and
xq are computed in [587] and improved in [999]. To the authors' knowledge, the
constants in Mignotte's general bound have not been computed.
The paper [460] addresses algorithmic aspects of separation and estimation of
the dominating characteristic roots.
Dress and Luca [306], [308] give a characterization of the binary linear recur-
recurrence sequences a, depending on the size of \a(xJ - a(x - l)a(x + 1)|.

34 2. ZEROS. MULTIPLICITY AND GROWTH
2.4.1. Effective methods in growth estimates. In view of the pessimism
above, it makes sense to try to obtain general effective lower bounds for some special
subsequences of the parameter x, or for almost all x. It turns out that very practical
improvements are possible by taking this more indirect approach. Indeed, before
the proof of Theorem 2.3, a completely effective result in this direction was made
in [742].
Theorem 2.5. For any integer non-degenerate linear recurrence sequence a of
order n, the bound
max \a(xi)\ > \ai\Xix~
~n
holds for n successive terms Xi ¦= k(x + i) + ? of any arithmetic progression, fceN,
? ? Z+, provided x > xo(a,k,?) where xo(a,k,?) is an effective constant which
depends on the sequence and the arithmetic progression.
The proof is based on a generalization of Turan's Theorem [1291] from [1011],
and on Theorem 1.3. A modification of this statement was also used in [702,
Lemma 3].
It would be very useful to get a similar estimate uniformly in k and ?. If
that were done, one could immediately apply Szemeredi's Theorem on sets without
arithmetic progressions [1269] to deduce that the same bound holds for a set of x
of asymptotic density 1.
The same considerations may be used to estimate the number of zeros in a
segment of a linear recurrence sequence. Theorem 1.3 implies that for any non-
degenerate linear recurrence sequence over any finite ring 7Z, the set of its zeros
does not contain n consecutive terms of an arithmetic progression. This implies
that the number of zeros a{x) — 0 on any interval M + 1 < x < M + N is o(N).
The same estimate holds for degenerate sequences as well, provided that the first
N powers of the characteristic roots ct\,... , am are pair-wise distinct. This remark
is essential for sequences over finite fields (where every sequence is degenerate). An
application to coding theory is given in Section 14.3.
No explicit version of Szemeredi's Theorem is known, so o(N) cannot be re-
replaced by any explicit function (see however [134], [463], [522], [1270] for short
progressions).
Szemeredi's Theorem has also been used in the papers of Bezivin [102], [104],
[105] and Denis [291].
A version of Theorem 2.5 for geometric progressions is proved in [742].
A modification of the method of [1192] gives the following result.
Theorem 2.6. For any non-degenerate linear recurrence sequence a of order
n over an algebraic number field K. there is an effective constant c(a) such that, for
any 1 < H < N.
|a(z)| <!(*!!" exp(-c(a)tf)
for at most n + yUo(nn!, K) values of x with N - H < x < N.
Proof. Let L denote the splitting field of the characteristic polynomial of the
sequence, and put M = N - H. Then the representation A.4) gives
a(M + *)

2.4. GROWTH OF LINEAR RECURRENCE SEQUENCES 35
Enumerate the functions on the right-hand side in some order, and let tk(x) denote
the fc-th term among the functions tk(x) = x^af.
Fix A > 0 and denote by 271 the set of a; € [0, H] with \a(M + x)\ < A. Assume
that 19711 > n + /.to(n,h); from this we will obtain a lower bound for A of the form
A> \ax\N exp(-c(a)H).
Define matrices D{(Xi,... , Xj) = (tk(Xj)I. fc=1 with dimensions i = 1,... , n
respectively.
Begin by choosing an element x\ G 971 such that t1(x\) ^ 0 and let 97?! =
97T\{a;i}. Now Ax = detDi(ari) ^ 0.
Suppose that we have selected Xj G 971,- such that Aj — det Dj(x\,... , Xj) ^ 0,
for each j = 1,... ,i. If i < n we claim that we can select Xj+1 6 97Tj such that
Aj+i = detDj(xi,... ,Xj+i) 7^ 0. Indeed, Dj(xi,... ,Xj,a;) is a linear recurrence
sequence of order at most n over L which is non-degenerate because it contains at
least one non-zero term Aj?j+1(a;). Since |97T;| = |97T| — i > /io(n,L), we can select
xi+i € 97T.j with Aj+i ^ 0. We then set 97Ti+1 = 97tj\{.Xj}.
This procedure constructs a matrix Dn(x\,... ,xn) with
An = detDn(xu... ,xn)^0.
Since A\{x) is a non-zero polynomial of degree at most n\ — 1 < n — 1, for any N
and iJ, there is a j, 0 < j < n-1, with 'A^ (A/) ^ 0, and therefore A[jl)(M) > C(a)
for some positive constant C(a). Now suppose ii(x) is the term x^a\. Then,
Therefore
Clearly An(x'i,... ,xn) ^ 0 is an algebraic integer of degree d = [L : Q] over Q,
so | NjL/Q(Ari)| > 1. On. the other hand, the absolute values of the conjugates of
An(xi,... ,xn) do not exceed n\HnanH, where a is the largest of the absolute
value of Qi,... , am and of their conjugates over Q. Hence,
It follows that
C(a)\ai\AI < Gi\JAH^-^\a^n-l)H {n\Hna
AI < Gi\JAH^-^\a^n-l)H {n\HnanH)d~
)
Noting that d < n!, and no(n,h) < /Uo(nn!,K), gives the theorem. ?
Theorem 2.6 immediately implies, under the same conditions, that
{x<N : \a(x)\<\ai\x-xl/2
This also implies that for any e > 0, and any function ip(x) —> oo, \a(x)\ > \a\ \^~?^x
and \a(x)\ > |Ql (*-*(*) i«* for all x < N with at most O(lniV) and o(N) exceptions,
respectively.
It would be interesting to get the same result for a bounded function ip. As
suggested above, a combination of Theorem 2.5 and Szemeredi's Theorem might
provide such a result, namely that \a(x)\ > |ai|xx~n for almost all x.

36 2. ZEROS, MULTIPLICITY AND GROWTH
Another implication of Theorem 2.6 is the formula
f()|
which is an asymptotic estimate for the average value of the Archimedean norm of
the terms of a linear recurrence sequence. For the sequences of Theorem 2.4 below
the error term can be replaced by O(Log N). Both Theorem 2.6 and the asymptotic
formula above can be extended to the case of exponential polynomials [370].
Lucht [761] presents a complete characterization of linear recurrence sequences
a for which the mean value lim./v_>oo j? J2x=i a(x) exists. Some results of that paper
have been generalized in [109].
In [1040] an analogous formula is obtained for the p-adic norms (but with a
non-effective error term). There it is shown that for an integer non-degenerate
linear recurrence sequence a, and any prime p not dividing the constant term of
the characteristic polynomial, there is a constant Xp(a) sucn that.
1 N
B.10) - J2 ovdpa(x) = Xp(a) + o(l).
a(:c)*0
For sequences of order 2 [1333] and 3 [660], [1332], the function ordpa(:r) is
understood in much more detail. A stronger asymptotic result is also known for
binary integer recurrences [606]. For any binary integer non-degenerate sequence
a(x) = A\a\ + A^oi^, there is a constant k(a) > 0 such that
N
1)l l l I \
1 = 1
where D is the discriminant of the characteristic polynomial. The only non-trivial
case is when a\ and a^ are complex conjugates; in this case
where ¦& and lj are the arguments of the complex numbers a.\ and A\, respectively.
Results on the distribution of the fractional parts of linear functions give the re-
required asymptotic estimate. More precisely, we should also take into account the
arithmetic structure of ¦d. For an arbitrary complex binary sequence a similar as-
asymptotic can be obtained with o(N) instead of O(N~k^). In the p-adic case, the
general asymptotic above can be improved and obtained in an effective form.
Similar results for average values (with respect to both Archimedean and p-
adic norms) of sums of 5-units are presented by Everest and Loxton in the series
of papers [359], [360], [361], [362], [363], [364], [365]. For example, refining the
classical result of Lang and its further improvements, Everest and Loxton [365]
prove that, for most algebraic number fields K of degree d over Q with unit group
Uk of rank r > 2, the asymptotic formula
U(Q) = ^±2r(LogQr + O
holds (the exceptional cases to which the proof does not apply are fields containing
Salem numbers; see [1061], [1062] for the details). Here
U(Q) =
{u ?Uk : max \cr(u)\ < Q\
1 <T€Ga/(K/Q)' ~

2.5. FURTHER EQUATIONS IN LINEAR RECURRENCE SEQUENCES 37
R and w are the regulator and number of roots of unity of K respectively, and
S(K) = 10-13cT10(l + 2logd)-1R-2r.
Analogously, define
Sa(Q) = \{ueUK : |T(K/Q)M|<Q}|
for some fixed non-zero integer algebraic a e K. The earlier paper of Everest [360]
provides the asymptotic
Sa(Q) = W{r^r (LogQY + O
This is based on an estimate for U(Q), so the error term can probably be improved
in the same way as is done for U(Q). Furthermore, denoting by /P(A;) = |fc|p~ordp k
the p-free part of the integer k, and defining
Sa,p(Q) = \{U ? ^K : fp (T(K/Q)(a«)) < Q}\
we have
Sa,p(Q) = Sa(Q) + O ((LogQI-1 LoglogQ).
This means that 'on average' ovdpT^/q)(au) is small. In a subsequent paper, [361],
Everest demonstrates that these kinds of questions are closely related to the cele-
celebrated Leopoldt conjecture.
Further generalizations and improvements are obtained in [362], [363], and
[364]. In particular, the paper [364] extends to multi-variate exponential polyno-
polynomials the asymptotic B.10) for the average value of p-orders of terms of a linear
recurrence sequence. It is also shown there that the main term is a rational number
given by some p-adic integral. Special cases are discussed in which the error term
can be estimated effectively; unfortunately, the original case of linear recurrence
sequences is not one of these. However, many other important sequences do have
effective error terms. For example, for any exponential polynomial E of the form
E(z1,... ,zr) = al1 az22 Ei(z3,... ,zr) + E2(z3,... ,zr)
over an algebraic number field K, under some mild conditions on ol\, a2 and the
exponential polynomials Ei, E?, the asymptotic formula
^ -Q<Zl,-,Zr<Q
holds. Here Xp 1S a rational number presented as some p-adic integral, m is the
number of different exponents in the representation of E, and e is the ramification
index of p in K.
Similar results are expected for general exponential polynomials, but the present
estimates for p-adic orders of 5-unit sums — where no general effective result is
known — are not enough to prove them.
Although this question and similar questions on the average value of logarithms
of linear recurrence sequences are related, the results obtained are independent and
do not imply one another.
2.5. Further Equations in Linear Recurrence Sequences
Given a linear recurrence sequence a, one may consider the number of solutions
of the equation
a(x) = a(y), 1 < x < y;

38 2. ZEROS, MULTIPLICITY AND GROWTH
thus counting total multiplicity, or the more general
B.11) \a{x) = r)a(y), x,yeN;
or even
B.12) Xa(x) = r}b(y), x,yeN;
for two linear recurrence sequences a and b, and constants A and 77. See [5], [313],
[586], [588], [589], [686], [717], [819], [820], [821], [999], [1130]. [1132], [1168],
[1171]. In some of these papers A and 77 are variables taking their values from some
fixed 5-unit group, in others one obtains a lower bound for the difference of the
left-hand and right-hand sides.
For example, Mignotte [821] finds all 20 solutions of the equation
\a(x)\ = \a(y)\, 1 < x < y,
in the case of the extremal Berstel's sequence; (cf. page 28) 4 further solutions are
found for x < 0. Lewis and Turk {717] show that for any binary non-degenerate
linear recurrence sequence over an algebraic number field K, a bound for x and y
with a(x) = ja(y) can be effectively estimated (depending on the sequence and on
7). Moreover, it is also possible effectively to estimate the number of solutions for
sequences over C.
Solutions of the equation a(x) = c taken over all members of some family of
binary linear recurrence sequences a have been considered in [562].
In [823] a generalization of B.9) is given: Under the conditions of Theorem 2.4,
\a(x) - a(y)\ > \ai\x exp(-k(a)log2 xLogy) , x>xo(a). x > y.
For binary sequences this is done in [1168], [1171] with logcc instead of Iog2:r.
Similar results are obtained in [823] for the equation B.12) when a and b share the
same characteristic polynomial. As before, in most cases the largest solution can
be estimated by a logarithmic function of the height parameters involved.
Schlickewei and Schmidt [1129] consider the non-linear equation
'B.13) ¦ Xa(x)k = r]a(y)e, x,yeN.
By A.4), this is a particular case of B.12). They call a linear recurrence sequence
exceptional if it has only one characteristic root, that is, if a(x) = Ai(x)af. They
show that for any non-degenerate and non-exceptional sequence of complex num-
numbers, the equation B.13) has only finitely many solutions. Moreover, for sequences
over algebraic number fields they provide an explicit bound for this number.
Theorem 2.7. Let a denote a non-degenerate and non-exceptional linear re-
recurrence sequence of order n over an algebraic number field K with degree d over
Q. Then the number of solutions of the equation B.13) with k < ( and non-zero X,
77 e K does not exceed
244d!D- + fc)!
where lj is the number of distinct prime ideal divisors of the characteristic roots.
These assertions on complex and algebraic linear recurrence sequences are based
on the corresponding results of [686] and [1131], respectively. Stronger results
obtained in [1133] allow Theorem 2.7 to be refined.
A variety of other results are known; many are too technical to warrant inclusion
here. These results show that, up to some trivial exceptions, all the equations above

2.5. FURTHER EQUATIONS IN LINEAR RECURRENCE SEQUENCES 39
have finitely many solutions, and in many cases the number of solutions can be
effectively estimated. The exceptions are not self-evident. Although several authors
show that the equations B.11), B.12) have only finitely many solutions other than
for 'sensitive' sequences, an example due to Schlickewei and Schmidt [1130] shows
that a trivial exception may not be easy to recognize. They cite
a(x) = 3x (G + 5y/2)x + G - 5y/2)x},
b(y) = (-2y + 1) (A + \/2)C - 2^ + A - a/2)C + 2v/2)»),
for which aBt + 1) = bCt + 2), t € N. On the other hand, they show that for the
non-degenerate situation, the solutions of the equation
Xa(x) + rja(y) + ua(z) = 0, x,y,zeN.
with finitely many exceptions, lie in a finite collection of linear or exponential one-
parameter families.
The closest relative of the class of linear recurrence sequences is the class of
exponential polynomials. A variety of results on the distribution of zeros of complex
and7>adic exponential polynomials were obtained in [1013], [1014], [1015], [1018],
[1035], [1281]. [1312], [1313], [1314], [1315]; see also the references given in
those papers to earlier work. Some of the results alluded to should be considered
in the wider context of describing the zeros of functions satisfying systems of linear
differential equations with rational coefficients, an important and growing area in
modern transcendence theory — see [920] and the more recent survey [1324].
We start with a result from [1015] which underlies the proof of the bound B.4).
Theorem 2.8. Assume that the coefficients and the exponents of the non-trivial
exponential polynomial A.6),
are elements ofCp, with
¦d = niin (ordp ipi - l/(p - 1)) > 0.
l<m<m
Then the number of zeros of E with ordp z > 0 does not exceed
Further improvements and generalizations can be found in [1014] and [1035].
Van der Poorten and Shparlinski [1040] extend the bound B.4) and Theo-
Theorem 2.7 to exponential polynomials of the form
B.14) F(*)
Theorem 2.9. Let F denote an exponential polynomial of the form B.14),
where the Ai are polynomials of degree at most t over an algebraic number field K,
and the xpi are polynomials over Z of degree at most s. If the number of integer
zeros, M{F), is finite, then
M(F)<28d+1rnts(d + ujLd,
where u> is the number of distinct prime ideal divisors of ct\,... ,am € K and
d=[K:Q}.

40 2. ZEROS, MULTIPLICITY AND GROWTH
The proof has two parts, the major part being finding an upper bound for
the number of zeros of p-adic differential equations — which include exponential
polynomials B.14) — and the selection of an appropriate prime p. To formulate
the upper bound more notation is needed. Let K denote an algebraic number field
with \K : Q] = d, and let p denote an ideal lying above the rational prime p. As
usual Kp denotes the completion of K in Cp, and Zp = {( 6 Kp : ordpt > 0}.
Consider the function represented by the power series
B-15) •
j=o
with coefficients fj e Zp, satisfying ap-adic differential equation
with qi{t) € Zp[<], i = 1,... , m. The following statement is a combination of [1040,
Lemma 1 and 2].
Theorem 2.10. If a function of the form B.15), satisfying B.16), has finitely
many zeros in Zp, then the number of zeros does not exceed
( m + max (deg & - i)) pd(p - l)/(p - 2).
y l<i<m /
For exponential polynomials over C, Tijdeman [1281] provides the upper bound
for the number of zeros of E given by A.6) in any disc \z — zq\ < R in the complex
plane, where ^ = max{|^i|,... , |^m|}. --
For exponential polynomials A.6) with complex coefficients and complex fre-
frequencies, Voorhoeve [1312.], [1313] obtains the following estimate. Let Ce de-
denote the convex hull of the complex conjugates tp1,... , tpm of the frequencies of
a complex exponential polynomial E given by A.6). If F denotes the perimeter
of Ce, and 7 the number of vertices, then in any disc of radius R. E has at most
TR/2-k + 7G1 - l)/2 zeros.
Analogues of these results are also known for generalized exponential polyno-
polynomials of the form A.6) with Ai, fa E C[z]. In [1314], as a consequence of more
general estimates, the bound 3(n — 1) + tyDR) is found for the number of zeros of
E, given by A.6), in any disc \z — zq\ < R of radius R. Here ^f(p) = C\p + ¦ ¦ - + csps
is a polynomial of degree s = max{deg^!,... , deg^m} with coefficients
c,- = max
j = \,... ,s,
l<i<m
and
m
degv4;)sm~\
In [1315] the special case of exponential polynomials with Ai e C[z] and fa e M[z]
is considered; in this case the exponential polynomial is either identically zero or
has no more than
m - 1 + (m2 - m + \)t + (m - l)(m2 - 2m + 3)(s - l)/3

2.5. FURTHER EQUATIONS IN LINEAR RECURRENCE SEQUENCES 41
real zeros, where «•
s = max{degipx,... ,deg^m}, t = max{degAu ... ,degAm}.
Equations of the form
B.17)' Vl + -.. + Vn = 0
in elements v\,... , vn of a finitely generated multiplicative group V have been
studied in the context of S-unit equations, see [376], [378], [380], [381], [382],
[503], [1037], Section 1.5.1 and references given on page 21.
In the case of positive characteristic, equations like B.17) have been recently
studied by Masser in [783]. To describe this result, let G be any multiplicative
abelian group and fix the value of n. A subset E of Gn is called broad if
A) E is infinite;
B) for each g € G and i, 1 < i < n, there are only finitely many points
(xi,... ,xn) e S with Xi = g;
C) if n > 2, then for each g € G and each i,j, 1 < i, j < n, there are at most
finitely many points (x\,... ,xn) G S with Xi/xj = g.
The following result is proved in [783].
Theorem 2.11. Let K denote a field of positive characteristic, and let G denote
a finitely-generated subgroup ofK*. Suppose that there are constants a\,... ,an in
K for which the equation
a\xx + \-anxn = 1
has a broad set of solutions (xt,... , xn) € T. Then there exist b\,... , bn € K and
gi > ¦ • • , 9n ? G with gi ^ 1 and g^g^ ^ 1 for i ^ j (ifn> 2) such that the equation
+¦¦¦ + bng^ = 1
has infinitely many solutions fc?N.
Multivariate equations of the form
f; =0
are considered in [1131], where the coefficients Ai are polynomials and the 'char-
'characteristic roots' a.iv are elements of an algebraic number field K of degree d over Q.
In this many variable case a uniform upper bound for the number of all solutions
(x\,... , xr) cannot be expected, so a suitable equivalence relation on the solutions
must be factored out and then the number of non-equivalent solutions can be esti-
estimated in terms of m, r, d, the number u of prime ideal divisors of the a^, and the
largest degree of the polynomials Ai. In [1133] these bounds are improved, and
the dependence on u> is eliminated.
Another natural generalization of linear recurrence sequences are the sequences
satisfying the recurrence equation A.7) with rational functions in x as coefficients.
Just as the class of linear recurrence sequences coincides with the class of sequences
of Taylor coefficients of rational functions, the class of these generalized sequences
coincides with the class of sequences of power series coefficients of functions satis-
satisfying linear differential equations with polynomial coefficients.
The first analogue of the Skolem-Mahler-Lech Theorem for such sequences is
given in [104] and then, for these and several further types of sequences, in [676].
Some arguments in [676] turned out to be faulty and were fixed in [110]. These

42 2. ZEROS, MULTIPLICITY AND GROWTH
papers on power series coefficients of solutions of various differential equations in
particular deal with linear combinations of the form
where the Ai are formal power series over Q (satisfying some mild conditions) and
MX) =
This class is quite wide and includes many interesting functions (see Corollaries 1-3
of the main theorem of [110]).
For g-recurrence sequences satisfying A.8), an analogue of the Skolem-Mahler-
Lech Theorem is given in [105].
All these results are qualitative; van der Poorten and Shparlinski provide the
first quantitative results in this direction in [1042]. These results were substantially
improved by Bezivin [108], but they remain much weaker than those for the case
of linear recurrence sequences.
Petho and Zimmer [992] considered the growth of recurrence sequences on
elliptic curves. Write the group operation on an elliptic curve E additively, and
define a sequence of rational points (Px) using the recurrence
Px+n = fn-lPx+n-l + ¦ ¦ ¦ + foPx, XgN
for integers /o- ¦ ¦ ¦ , fn-i- It is shown that under some mild conditions the canonical
height h(Px) grows exponentially with x.
For sequences — of many different kinds — over function fields of zero char-
characteristic much more can be said, because for such fields there is a strong effective
result on sums of S'-units, (see the references mentioned on page xii). For example.
Shapiro and Sparer [1162] prove that for any n > 3 pairwise co-prime polynomials
9i ? C[<], i = 1,... , n, not all constant, the equation
does not have any solutions with x > n{n - 2). Such results in the number field
case remain beyond the wildest dreams.
Finally, the requirement in the Skolem-Mahler-Lech Theorem that the char-
characteristic be zero is essential even in infinite fields (the case of sequences over finite
fields is evidently special, and is dealt with in Section 5.4). The simplest example
that shows the need for zero characteristic is the cubic recurrence sequence
a(x) = B2 + If -zx -{z + l)x, xeN,
over the function field ?p(z). It satisfies the non-degenerate recurrence relation
a(x + 3) = D2 + 2)a(x + 2) - Ez2 + 5z + l)a(x + 1) + B23 + 322 + z)a(x), .
and has infinitely many zeros of the form x = pk, k = 1, 2,.... This is a slight
modification of the corresponding example of [694]; see also [1026]. This zero-set
has a very special structure, so it remains possible that an analogue of the Skolem-
Mahler-Lech Theorem holds for infinite fields of positive characteristic p, with finite

2.5. FURTHER EQUATIONS IN LINEAR RECURRENCE SEQUENCES 43
sets augmented by sets of the form
U p*2*.
where DJl is a finite set. As a first step in this direction one might try to prove a
logarithmic upper bound for the number of zeros a(x) = 0, 1 < a; < jV of a non-
degenerate linear recurrence sequence a over an arbitrary field. We are not aware of
any progress in this direction. The best previously known result is the bound o(N)
obtained in [102] following from Szemeredi's Theorem. Denis [291] gives further
applications and generalizations. For a non-degenerate linear recurrence sequence,
Theorem 5.13 gives the effective bound O (iV1"*5") for the number of zeros among
the first n terms of the sequence, where Sn > 0 is defined in Section 5,4.
Similar issues arise for S'-unit equations over Fp(t), where there are infinite
families of non-trivial solutions augmented by exceptional ones; this problem is
of importance in finding the mixing structure of Zd-actions by automorphisms of
compact groups [335], [608], [609], [783], [1139], [1140, Chap. VIII], [1141],
[1334].

CHAPTER 3
Periodicity
A linear recurrence sequence over a finite ring must be ultimately periodic. The
paired problems of determining the period of a given sequence and of constructing
sequences with long periods turn out to be both difficult and important. In this
chapter the basic problems are described and many of the major results are given.
The connections between these problems and certain classical problems in number
theory are given. Finally, the periodic structure of some more exotic sequences is
discussed, including the notorious Collatz problem.
3.1. Periodic Structure
A sequence a is called periodic or eventually periodic if a(x + t) = a(x) for
some t G N and all x > xq. The minimal t > 0 for which this holds is called the
period of the sequence. If the periodicity condition holds with xq = 0, the sequence
is also called purely periodic. Every purely periodic sequence is a linear recurrence
sequence. It is a little less evident, but still true, that over any field a periodic
sequence is a linear recurrence sequence.
The period of a single exponential function gx is also known as its multiplicative
order or its exponent; the period of g is the period of the sequence (gx).
If a ring TZ is finite then any linear recurrence sequence a over TZ of order n is
periodic with period t < \TZ\n — 1. Indeed, if the sequence has n consecutive zeros
then all subsequent values are zero, and thus the period is 1. Next, there are at
most TZn — 1 non-zero n-tuples over TZ. Thus for some 1 < ? < k < \TZ\n there must
be two identical n-tuples
(a(k), ...,a(k + n-l)) = (a(?),... , a(? + n - 1)),
say, and so a(x) = a(x + k — ?), x > ?. If in addition /o is an invertible element of
TZ, we may also move in the opposite direction and obtain a(x) = a(x + ? — k) for all
x > 1. Sequences having the largest possible period \TZ\n are called M-sequences
over TZ.
Notice that, apart from the exclusion of the zero tuple and the remark on pure
periodicity, the same arguments hold for non-linear sequences. Specifically, the
period of a non-linear recurrence over a finite ring TZ is at most \TZ\n. Moreover,
if the function F of A.9) on page 8 is periodic with respect to its first coordinate
with some period T, then any solution of this recurrence equation is periodic with
period t < T\TZ\n. In particular, any integer sequence satisfying A.7) on page 7
with integer polynomial coefficients is periodic modulo any m G N, with period
t < mn+1.
The periodic structure of linear recurrence sequences over a finite field has
been understood for some time; it is conveniently summarized in the papers of
Laksov [671] and Zierler [1378]. For residue rings, the same is done in papers of
45

46 3. PERIODICITY
Hall [507] and Morgan Ward [1328]. Pinch [1001] provides a lucid outline and
several more new results. In the series of papers [572], [652], [655], [656], [662],
[663], [827], [917], [918] attempts are made to deal with these two cases from the
one general point of view of sequences over Galois rings. In particular, M-sequences
over such rings have been studied.
The length of the period is related to properties of the characteristic roots
{«!,... , an}. In the most interesting case, when 1Z = ? is a field and the charac-
characteristic polynomial is square-free, t is a period if a* = 1, ? = 1,.... n.
For any polynomial / G ?q[X] with /@) ^ 0, there is a minimal T G N for
which f(X) | XT - 1; T is called the period of /, written T = per(/). Denote as
usual the zeros of / by ai,... , am with multiplicities ni,... , nm. Then
per(/) =pllo*»N\ Icm(per(a1)>... ,per(am))
where TV = max{?zi,... , nm} is the largest multiplicity of the characteristic roots
and, for each i, per aj is the period or multiplicative order of a* in the algebraic
closure of Fq. Notice that, in characteristic p, the polynomial XT — 1 may have
multiple roots, of multiplicity ordp T. It follows that if / is a square-free monic
polynomial then all sequences in ?*(/) have the same period t = per(/) qn — 1.
The next result follows from [1001, Theorem 7, Prop. 8].
Theorem 3.1. If f is a monic polynomial over a finite field with /@) ^ 0
then:
• all sequences from ?*(/) have the same period t = per(/);
• the period of any other sequence from ?(/) divides t;
• the number of sequences from C(f) of least period T is
d\T
In particular, this shows that for sequences over a finite field ?q the upper
bound qn — 1 for the period can be achieved. Thus, for example, a linear recurrence
sequence over ?q is an A/-sequence if and only if its characteristic polynomial is
primitive over ?q.
We shall see later that M-sequences over finite fields (and, more generally,
sequences of large period) are important in many applications. Their construction
involves finding, primitive polynomials over finite fields, a problem in any case of
great independent interest, see [1202, Chap. 2]. Although several very effective
constructions and algorithms have been proposed, the general problem is still open.
The special universal role of A/-sequences over finite fields is shown by the following
result.
Theorem 3.2. Let a denote an M-sequence of period qn — 1 over?q. Then for
any linear recurrence sequence b of order n with characteristic polynomial irreducible
over ?q there are unique integers k,?, 1 < k < qn — 1, 0 < ? < qn — 2, such that
b(x) = a(kx + ?). Moreover, gcd(k, qn — 1) = (qn — l)/t, where t is the period of b.
In particular, all the other ip(qn — l)(qn — 1) M-sequences can be represented
in the form a (for + ?) with 1 < k < qn - 1, 0 < ? < qn - 2, gcd(A;, qn - 1) = 1.
Schmutz [1150] deals with the distribution of periods of polynomials in FjX].
Roughly speaking, he showed that for q fixed and n —> oo, almost all polynomials
in ?q[X] of degree n have period ^-0°g"J+oA).

3.1. PERIODIC STRUCTURE 47
A seemingly more general question about the distribution of periods of matrices
over Fq can be reduced to the previous question. For an (n x 7^)-matrix T over ?q,
define per(J") to be the minimal T G N with TT = /. Then
for almost all matrices T G SXn(Fg); see also [514]. This is quite surprising,
because Stong [1259] shows that the average value of the period, is qn"(losn) ° .
The total number of (n x n)-matrices over F2 of maximal period 2" — 1 was
shown to be
n fc=i
by Fabris [383].
The existence of M-sequences in residue rings modulo a prime power is a natural
problem. For instance, in the case of integer sequences the following important
property holds.
Theorem 3.3. Let p > 3 denote a prime, and suppose that tk is the period
modulo ph of an integer non-degenerate linear recurrence sequence a with charac-
characteristic polynomial f, and pj( /@). If ko is the minimal k with t^+i > tk = ¦ ¦ ¦ = t\
then
. _ J h, ifk< k0;
1 hpk-~ko, ifk>k0.
This is a generalization of the well-known fact that if g is a primitive root
modulo p2, then it is a primitive root modulo all powers pk. A further analogue is
given in Theorem 3.4 below.
It follows from Theorems 3.1 and 3.3 that, for p > 3. the maximal period
modulo pk of an integer linear recurrence sequence of order n is (pn — l)pfc~1, and
that moreover this bound can easily be attained. For p = 2 the situation is a
little more complicated, but a similar result holds. For some special characteristic
polynomials, there are sequences of period Bri-lJfc~1 modulo 2fc, see [157], [507],
[1328]. This is quite a surprising result in light of the fact that there is no primitive
root modulo 2k with k > 3.
An analogue of Theorem 3.3 for the sequence of powers (with respect to the
group law) of a rational point on an elliptic curve over Q is given by Ayad [41]. This
has been applied to Diophantine questions on rational points on elliptic curves.
The following result (well-known in the folklore) shows how to construct se-
sequences of maximal period.
Theorem 3.4. Let f e Z[X] denote a monic polynomial, primitive over?p for
some prime p > 3. Set fQ(X) - f(X), fx(X) = f(X) +p. Then for at least one
ofi = 0 or 1 any sequence a G ?(/*) with gcd(a(l),... ,a(n),p) = 1 has maximal
period (pn - l)^" modulo pk for all k G N.
PROOF. Since / is primitive over Fp, it is an irreducible polynomial over ?p and a
fortiori over Q. Let ot\,... ,an denote its roots in the splitting field K of / over Q,
and let p denote a prime ideal divisor of p in K. Because / is irreducible modulo p
it follows that p is of degree n, that is, N(p) = pn.

48 3. PERIODICITY
The condition on the first two values of the sequence gives the representation
where the A\ are conjugates, and are units modulo p. This implies that t^, the
period of a modulo pk, is equal to the least T with aj = 1 (mod pk). Denote this
T by Tfc. Since a\,... ,an are conjugates it is enough to require this congruence
for any one i. Note that we are given ?i = T\ = pn — 1.
Suppose that T2 = t2 = h = Tx | N(p)-1 =pn-l. Then af~l = 1 (mod p2),
so/o = /@)Pn = l (modp2).
To complete the proof, notice that the same cannot happen for f(x)+p. Indeed,
(/o +pYn~l = /o^"-1 + (pn - l)ffp = 1 + (pn - 1)/Opn-2P ^ 1 (mod p2),
because (pn - l)ff~~2 ? 0 (mod p). ?
The following result shows that the elements of a linear recurrence sequence
modulo a large power of a fixed prime can be represented as polynomials.
Theorem 3.5. Let p denote a prime, and let ts denote the period modulo
ps of an integer non-degenerate linear recurrence sequence a with a square-free
characteristic polynomial f such that pj(f(O). Set y^ = y{y — 1)... (y — v + 1).
Then
A) for integers y,
m ,
a{x + yt8) = J2 -a^\x)ps"y^ (mod pk),
i/=0 U'
where m is determined by ms < k < (m+ l)s, and the sequences a/ are
defined by
v>\.
as() (), ^() ,
B) Moreover, for each x and s, there is an effectively computable constant
C(a,p) depending on p and a so that
min ordp a(sv) (x) <C(a,p).
PROOF. A) Using no more than the periodicity of an arbitrary sequence, it is easy
to check that formally,
i/=0
and the first claim is just the truncation of this modulo pk.
B) To estimate the p-adic orders, notice that
Pick x € N. If r = minl/=ii,,. ,nordpa?(:r), then the representation above gives the
condition
II !)s0 (modpr)

3.2. RESTRICTED PERIODS AND ARTIN'S CONJECTURE 49
on the Vandermonde determinant. Let p denote a prime ideal divisor of p. Then
there is a pair of indices 1 < i < j < n such that
((a\° - af)/ps) = 0 (mod p2r/n(ri+1').
However, it is easy to prove an analogue of Theorem 3.3 showing that ti, the
minimal r e N with a\ — aj = (mod pe), must grow exponentially with ? after
some point. That is, ti ^> pl. From the congruence above,
(nn _ lUS/ > T ... n, ^> ns+2r/n(n+l)
so r < C(a,p). D
Simple adjustments to the results permit the elimination of the condition p > 3
from both Theorem 3.3 and Theorem 3.5. Elimination of the assumptions on the
divisibility of discriminant, and on the coefficients being constants would allow
consideration of characteristic polynomials with multiple roots.
3.2. Restricted Periods and Artin's Conjecture
There are further notions related to periodic properties of linear recurrence
sequences which are useful in studying sequences over finite fields. Let a denote a
linear recurrence sequence over a ring 1Z.. A number A G TZ is called a multiplier of
the sequence a if there is an h e Z such that Xa(x) = a(x + h) for all ieN, The
smallest h such that Xa(x) = a(x + h), x G N for some multiplier A is called the
restricted period.
For a finite ring TZ, counting the maximal number of non-proportional n-tuples
yields r < (¦|-72.|n— 1)/(|7?| — 1) for the restricted period r of a sequence of order n-.
Suppose a is a linear recurrence sequence with square-free characteristic poly-
polynomial / over ?q. Then the restricted period r is the smallest integer h such that
f &
The set of all multipliers of a fixed sequence forms a cyclic subgroup GM of ?*,
so the period t of the sequence satisfies t = t\G^\. In particular, r t and t r(q — l).
Theorem 3.6. // the characteristic polynomial of a linear recurrence sequence
over ?q is a product of distinct irreducible polynomials of the same period t, then
T = t/gcd(t,q-l).
For irreducible characteristic polynomials this can be found in [507] and [671],
and the general case follows readily. A complete study of possible values for the
period and the restricted period is provided by Somer [1230], [1231].
Similar results for linear recurrence sequences over a function field of positive
characteristic would be very important for applications to linear cellular automata
(see Section 14.1) because their characteristic function is known to satisfy the recur-
recurrence equation A4.4) over a finite field, say ?q. The period T of such sequences of
polynomials obviously satisfies T < qnN — 1, where N is the degree of the modulus
M(X). It natural to ask whether this bound is in fact attained.
If the modulus M(X) (cf. page 239) is irreducible over ?q then
and this isomorphism makes the above results directly applicable. However, one of
the most interesting moduli is M(X) — XN - 1 which of course is reducible. It
may be that the Chinese remainder theorem will permit an attack on this case, at
least when M(X) = XN - 1 is square-free (that is, when gcd(N,q) = 1).

50 3. PERIODICITY
We have seen that, for fixed prime p and positive integer n, finding a linear
recurrence sequence of maximal period is related to the complicated problem of find-
finding primitive polynomials. One might therefore try a different approach. Suppose
/ € Z[X] is a monic square-free polynomial of degree n. We may then ask about
the distribution of those primes modulo which / is primitive or, more generally, ask
about the distribution of the period of / modulo rational primes p.
For / monic and irreducible over Z. this question can be reformulated as follows.
Let A denote a zero of / in its splitting field K. For an integer ideal q co-prime to
A, define the period t\(q) of A modulo q to be the minimal T € N such that AT = 1
(mod q). The goal is then to study the distribution of q in the set of integer ideals,
prime ideals, prime ideals of the first degree (the original question), and so on.
Even lor integers A > 2, this question is highly non-trivial. The celebrated
conjecture of Artin is equivalent to the statement that t\(p) = p— 1 infinitely often
for any A not a square.
Hooley [542] proved the following asymptotic formula under the Generalized
Riemann Hypothesis:
A>{N)=CXX)n(N) + o(^p-N'
\ log N
for the number A\(N) of primes p < N with t\(p) =p—l. The constant C{\) > 0
depends on the arithmetic structure of A, and can be estimated from below as
C(X) S>
Log log h
where h is the largest integer with A1/h e Z (thus h < log A). The upper bound on
A\(N) can be obtained unconditionally.
Two years later Stephens [1240] proved (unconditionally) that Artin's conjec-
conjecture is true 'on average' over A. Specifically, he found the following upper bound
for the second moment:
- Y" (AX(N) - Cn(N)J < N2 log"* N,
L /—'
\<L
with any E > 0, whenever L > exp F(log iV Log log iVI/2) and N is large enough.
In this formula C is an absolute constant (Artin's constant). Explicitly,
C = TT f 1 - , l
JJV p(p-
= 0.3739558136 ...
was estimated by Wrench [1360], who expressed logC in terms of /^p6Pp~fc. A
more sophisticated approach to this constant (and other related constants) is to try
and express C in the form IIfc>2 ((^)ek f°r suitably chosen e^- Moree [847] gives a
general approach for estimating tails of products of the form YlPeP A ~ f(p)/9(p))
for certain polynomials / and g. Using this approach, Artin's. constant can be
rapidly estimated with thousand-digit precision.
Stephens also gives several results on the distribution of the period t\(p) of A
modulo p. In the later papers [1241] and [1242] he improves these results. First,
he shows that, under the Generalized Riemann Hypothesis,
p<N

3.2. RESTRICTED PERIODS AND ARTIN'S CONJECTURE 51
and he gives explicit formulae for C(X) > 0 depending on the factorization^of A. He
also proves several unconditional results 'on average' over A. For example,
L/ ¦ / -. "— " \ ¦* ' / I "•*>. ^ • * ~*J >-, ^ "
for any E > 0 and L > exp(clog1'2 A'') with some absolute constant c > 0 and
These results are motivated by applications to prime divisors of binary recurrence
sequences, as mentioned in Section 6.3.
Von zur Gathen and Pappalardi [427] obtained a series of results on distribution
of primes p with t\(p) = p — 1 in intervals N <p < N + H on average for 1 < A < L.
Part of this work is to estimate the minimal prime p(X) for which A is a primitive
root (again, on average). In particular, they show that p(X) < log A for all positive
X < L with at most O (L exp(-0.4782 log L/ log log L)) exceptions, and p(X) < A1/2
for all positive X < L with at most O(L1//2 log L) exceptions. They also mention
that Hooley's asymptotic formula [542] implies that for any non-square A > 2,
p(X) < ACL°slosl°sA
for some absolute constant C > 0 (under the Generalized Riemann Hypothesis).
Similar results are obtained for the distribution of primes p with t\(p) = (p—l)/k for
some fixed k (see [427], [848], [887], [1321]). These results (especially concerning
the case k = 2) are motivated by applications to Gaussian periods over finite
fields [423], [428], [429], [430]; see also Section 12.1. A related generalization of-
the classical result of Hooley [542] is given in [977].
The problem of the distribution of primes in arithmetic progressions having
a prescribed primitive root is important for some applications to coding theory,
and to the theory of exponential sums over finite fields. These problems have been
studied by Moree [839], [845], [846], [848]. Moree [843] also proves that
where \p is the quadratic character modulo p and h is the largest integer with
Xllh e Z. In [844] this formula has been extended to primes in a prescribed
arithmetic progression.
All these and many other relevant results about primitive roots can be found
in [906, Chap. 2]. Material on the distribution and location of primitive roots in
finite fields is in [725, Chap. 3] and [1202, Chap. 2,3].
Further progress was made by Gupta and Rarn Murty [487], by Ram Murty
and Srinivasan [895], and finally by Heath-Brown [521]. In the last paper, it was
shown (unconditionally again) that the exceptional set E{N) of A < N for which
the conjecture fails cannot contain three pairwise co-prirne elements. Thus, for
instance, E(N) = O(log2 iV) and for at least one A from the set {2, 3, 5} Artin's
conjecture is true. Murty [891] addresses an elliptic curve analogue of such results.

52 3. PERIODICITY
For applications to linear recurrence sequences similar results are needed for
algebraic number fields — for instance, see [1091]. In fact, several partial gen-
generalizations of these results are known. For example, [700], [888], [889], [1090]
provide generalizations of Hooley's result; [323], [538] give estimates of the size of
the exceptional set, and [907], [908] deal with generalizations of Heath-Brown's re-
result. Lenstra's paper [700] introduced methods from Galois theory to the subject,
allowing a large class of generalizations to be treated. Unfortunately, none of these
results is close to the complete generalization of the corresponding statements over
3.3. Problems Related to Artin's Conjecture
Versions of Artin's conjecture have been formulated over other algebraic struc-
structures. In 1977 Lang and Trotter conjectured that for any elliptic curve E defined
over Q, and any rational point G on E, G is a primitive point (that is, a generator
of Ep) on the reduction Ep of E modulo p for infinitely many primes p. They also
gave the expected asymptotic formula for the number of such primes. Later, this
question was studied by Murty [888] and by Gupta and Murty [488], [489], [891].
For a wide class of elliptic curves — the curves with complex multiplication — the
paper [488] gives an unconditional precise lower bound and, for certain curves, an
unconditional asymptotic formula for the number of such primes. In [489], Gupta
and Murty completely describe the class of elliptic curves E defined over Q for
which Ep is a cyclic group for infinitely many primes p, and show that for such
curves there are at least
f(E,N) >c(E)N Log N
primes p < N for which Ep is cyclic. Moreover, for curves with complex multipli-
multiplication the asymptotic formulae
f(E,N)~C(E)ir(N)
holds. On the other hand, under the Generalized Riemann Hypothesis the same
asymptotic formula holds for any elliptic curve by [888]. In those papers, similar
results are also obtained for finitely generated groups on elliptic curves. For other
relevant results see [622].
Li [718], [719], [720], Li and Pomerance [721] and Martin [779] consider
elements with the largest possible multiplicative order modulo a composite number
n. This is a natural generalization of the notion of a primitive root, and several
analogues of the results above have been obtained. Average orders are considered
in [426] and [756].
In [980]. a result of Bilharz from 1937 [114] on Artin's conjecture for function
fields over finite fields is obtained with an explicit square-root bound on the error-
term; see also [559] and the monograph [1089, Chap. 10] for an overview.
Clark and Kuwata [242] establish an elliptic curve version of Bilharz's result,
showing that for any elliptic curve E over a function field K over ?q the density of
prime ideals p e K for which the reduction Ep modulo p is cyclic is given by
m=l;gcd(m,ij) = l

3.3. PROBLEMS RELATED TO ARTIN'S CONJECTURE 53
where dm is the degree of the minimal extension of K in which all the m-torsion
points of E are defined.
Notice that nothing better than the trivial lower bound t\(q) > \ogx(q + 1)
can be obtained globally, since this is attained for integers of the form q = A4 — 1.
If there are (as suspected) infinitely many Mersenne primes, then this cannot be
improved even on the primes. However, there are non-trivial lower bounds of t\(q)
'on average'. For example, it is straightforward to prove that t\(p) > p1/2/ Log logp
for almost all prime numbers. To prove this, put T = iV1//2/Loglog N and consider
the product
W(T) = n(A4 - 1).
4=1
All primes p < N with t\(p) < p1//2/Loglogp < T divide W(T), so there can
be no more than u(W(T)) < Log W(T)/Log log W(T) < T2/logT = oGr(a:)) of
these. By considering the number of integer divisors one can get an essentially
weaker lower bound of t\(q) for almost all integers q. Similarly, this may be done
for almost all square-free integers as in the proof of [1049, Lemma 8.3, Chap. 5]).
Hooley [542] shows that this idea can be combined with sieve methods, leading
to the estimate t\(p) > p1//2/logp for all but O(N log N) primes p < N. He
uses estimates for the number of prime p such that p — 1 has a divisor in a given
interval (notice that t\p — 1). An improvement of this result was obtained recently
by Pappalardi [979] (cf. C.3) below). Other results on multiplicative orders of
integers can be found in [354], [657], [658], [893].
Now consider a finitely generated multiplicative group V of the form A.13),
and let Vq denote the reduction of V modulo q. The quantity |Vq| is an analogue
of t\(q). Notice that
C.1) |Fq|»(logN(q))r-
for any integer ideal q and
C.2) |Fpfc|»N(pfc)
for any unramified fixed prime ideal p of degree one.
Pappalardi [979] proves that, for an arbitrary r < A - log2)/2 = 0.153...,
C.3) |Vp|>N(pr/e-+1)exp(logTN(p))
for a set of prime ideals p with asymptotic density 1. This is a straightforward
generalization of his earlier results for the rationals: It can be reduced to that case
by noticing that in an algebraic number field almost all prime ideals p are of first
degree and N(p) = p (so the corresponding residue ring is isomorphic to Fp).
It should be explained why the result C.3) is important despite the fact that it
seems to give only a very modest improvement on the previously known estimate
which holds for almost all prime ideals p and which can be obtained quite easily
along the same line as the corresponding estimate of t\(p) above (see [979]). The
essential feature of the estimate C.3) that makes it so important is that even for
r -= 1 it exceeds the square-root bound.
The estimate E.5) below gives an example of a result which becomes non-trivial
for periods t\(p) > p1//3+e, but for many applications it is essential to overcome the

54 3. PERIODICITY
square-root bound for periods t\(q) or for the size \Vq\ (see Theorem 5.1 and esti-
estimates E.2). E.3) below). It has been shown by Murty, Rosen and Silverman [893]
who prove that for any r < e"~7 = 0.561..., where 7 is the Euler constant, the
bound
|^|>N(q)Tr^r+1)
holds for almost all integer ideals q > 1. Notice that rr/(r + 1) > 1/2 for r > 9.
It follows that the estimate E.2) below is applicable to groups with at least 9
generators. This and other results from [893] are derived from very precise bounds
for the sums
?N ' EwW?
IP
taken over all non-zero integer ideals q and prime ideals p, respectively. Kurlberg
and Rudnick [658] have shown that there exists some constant 6 > 0 such that for
any integer A with |A| > 2, for almost all integers q the bound
tx(q)>q1/2exp(logSq
holds. Kurlberg [657] has shown that under the Generalized Riemann Hypothesis,
for any e > 0, the bound
tx(q)>g1-e
holds for almost all integers q. In fact both results are obtained in the more general
setting of matrices in SZ^Z)..
On the other hand, for applications to linear recurrence sequences it would
be very useful to obtain an analogous result for the set of prime ideals of degree
d = [K : Q] (that is, prime ideals for which the residue ring modulo p is a finite
field with N(p) = pd elements, where p is the rational prime which p divides). "Un-
"Unfortunately, a lower bound on the order of pnl2 for the period of a linear recurrence
sequence modulo infinitely many primes p does not seem to be accessible with cur-
current methods. Such a bound would allow Theorem 5.1 to be used, for example.
Indeed, if an integer linear recurrence sequence a has an irreducible characteristic
polynomial /, then it can be represented in the form a(x) = T(Aax) where a is
one of the roots of /. Assume that p is a prime with a prime ideal divisor p in
K = Q(a). Then the period of a modulo p coincides with the period of a modulo
P-
Pappalardi, in [978] and [979], also considers the case when the number of
generators of the group increases with the modulus. Let G(p) denote the small-
smallest positive G for which the set {1,2,... , G} generates Fp». If g(p) denotes the
least primitive root modulo p, then trivially G{p) < g(p). So, a first approach to
estimating G(p) is to use known results about g(p): The unconditional bound
g{p) =
due to Burgess [187], Shoup's [1182] improvement
g(p) = O (u(p - IL Log4 u(p - 1) log2 p)
of Wang Yuan's result conditional on the Generalized Riemann Hypothesis, and
the mean value upper bound
1 J2 () « l2
C-4) -1- J2 9(P) « l0§2 N Log4 log N
' ^ ' P<N

3.3. PROBLEMS RELATED TO ARTIN'S CONJECTURE 55
of Burgess and Elliot [188]. Murata [886] shows that under the Generalized Rie-
mann Hypothesis, the right-hand side of C.4) can be replaced by log N Log7 log iV,
see also [343]. An upper bound on the smallest primitive root modulo p2 is given by
Elliott and Murata [343]. Several more estimates can be found in [906, Chap. 2].
On the other hand, Graham and Ringrose [472] proves that the minimal quadratic
residue N(p) 3> log p log log p infinitely often. Results of this sort can also be ap-
applied to G(p), since G(p) > N(p). Pappalardi [978] studies G(p) more directly, and
obtains slightly better upper bounds on average for G(p) compared with a direct
application of C.4).
Several more results about G(p) and the generalization G(m) to composite
moduli m can be found in [47], [189], [190]. For example, the estimates
G(m) = O(ml'3el/2+e)
for any integer m > 1, and
G{m) = 0(m1/4el/2+e)
for m ^ 0 (mod 8) appear in [190]. On average, it is shown in [189] that
M
A/ Y] G(m) = O(log97A/).
m=l
As an auxiliary result, Konyagin and Pomerance [628] show that the size of the sub-
subgroup of the unit group of the residue ring Z/A/Z generated by {1, 2,... , [logc A/J}
exceeds A/1/0 for any constant c > 0, provided M > 4 and 21ogc A/ < p, where
p is the least prime factor of M. Similar results have been obtained by Cangelmi
and Pappalardi [201].
Several partial generalizations of the results above to the case of algebraic num-
number fields are known, but many open problems remain and the entire situation is
unsatisfactory (this is discussed in [1202, Chap. 2, 3]). This prevents the direct
application of such results to linear recurrence sequences, where results about peri-
periods of elements A ? Zk modulo integer ideals q of an algebraic number field K are
needed.
The period modulo m of the doubly exponential sequence ge* modulo m,
x = 1,2,..., has been studied in [411] in the case where m is a product of two
primes, which is of primary interest for cryptography. In particular, the question
is equivalent to the question about the period length of the power generator, see
Section 13.2.
Analogues of several of the results in this section to elliptic curves (and even
to abelian varieties) are given in [58], [452], [453], [455], [488], [830], and [893].
Periods of shrunken and self-shrunken sequences (operations on linear recur-
recurrence sequences explained in Section 4.2) are studied in [258] and [806]. It is shown
in [258] that if both a and s are M-sequences over F2 of orders n and m, respec-
respectively, with gcd(m,n) = 1, then the shrunken sequence as is a linear recurrence
sequence of period T = Bn - lJm~1, and it is mentioned that a similar result
holds in more general situations as well. The period of the sequence obtained by
the self-shrinkage of a binary M-sequence of order n is shown in [806] to divide
2n~1, and is at least 2Ln/2J.

56 3. PERIODICITY
Marsaglia [778], in creating new types of pseudo-random number generators,
introduced 'add-with-carry1 and 'subtract-with-borrow' sequences. These are mod-
modifications of the basic linear recurrence sequences scheme. 'Add-with-carry' se-
sequences satisfy the congruence
a(x) = a(x - r) + a(x- s) + cx (mod M), 0 < a(x) < M - 1
where
0, ifa(x-r-l) + a(x-s-l) + cx-i<M-l;
Cx ' 1 if a(x-r-l) + a{x-s-l) + cx-i > M.
Thus cx is the 'carry' of the previous computation a(x — r — 1) + a(x — s — 1) + cx-\
in the base M. Similarly, 'subtract-with-borrow' sequences satisfy the equation
a(x) = a(x - r) - a(x — s) - cx (mod M) x eN
where
0, ifa(x — r — l)>a(x — s—l) + cx-i;
Cfr ^ 1, if a(x-r- 1) < a(x-s- 1) + cx_i.
Thus cx is the 'borrow' of the previous computation a(x—r— 1)—a(x—s—1) — cx_! in
the base M. Marsaglia [778] shows that the period of an 'add-with-carry' sequence
equals the period of the M-ary expansion of k/q for some k, 1 < k < q and
q = br + bs — 1. This means that the period can reach the period q modulo M. A
similar result holds for 'subtract-with-borrow' sequences.
The sequences considered above can be derived from more general coordinate
sequences, defined as follows. To a sequence a defined over Z/pkZ, associate k
coordinate sequences ao(x),..., ak-\{x) over Fp, defined uniquely by the represen-
representation
C.5) a(x) = ao(x) + ax {x)p + ¦¦¦ + afc_i (x)pk~1.
Sequences of this form, and their generalizations, are considered in the series of
papers [652], [655]," [656], [662], and [663]. For p = 2, similar sequences are
considered by Dai [275] and by Dai, Beth and Gollmann [276].
Kuz'min and Nechaev [663] show that if a is a sequence of period t = rpfc~1,
then each of the coordinate sequences ar is a linear recurrence sequence over Fp
of period tr = rpr (it is clear that tr < rpr, but is less obvious that tr attains
this value). The characteristic polynomials and orders of sequences ar are also
considered in that paper; some of the results obtained are described in Chapter 4.
Non-linear recurrence sequences have also been studied in residue rings. These
satisfy congruences of the form
C.6) a(x + 1) = F(a{x)) (mod M) 0 <a(x) < M-1, x eN
where F is a 'rational' function modulo M — the notion of rational function makes
sense after defining
Z-l=z^M)-1 (modm).
Two special-cases have been extensively studied: These are the quadratic sequences
with
F(X) = f2X2 + hX + /0,
so
C.7) a(x + 1) = f2a(xJ + fia(x) + /0 (mod M) 0 < a(x) < M - 1, x e N,

3.3. PROBLEMS RELATED TO ARTIN'S CONJECTURE 57
and the inversive sequences with
F(X) = f^X^'1 + fQ,
so
C.8) a(x + 1) = /_1a(a:)v'(A'/)-1 + f0 (mod M) 0 < a(ar) < M - 1, a: e N.
References and results on these sequences can be found in the monograph [936,
Chap. 8] and in the survey papers [328], [935], and [938]. The motivation for
considering such sequences is the hope of finding new algorithms to generate pseudo-
pseudorandom numbers. It follows that the problem of finding lower bounds for the period
length is of central importance. For example, it was shown in [392], that for a
prime M = p, a sequence given by C.8) has the maximal period p if and only if
X2 — foX — /-i is an irreducible polynomial over Fp with the period t satisfying
gcd ((p2 — l)/t,p+ l) = 1. In particular, any primitive polynomial X2 — JqX — /_j
generates a sequence of period p. The proof is based on a reduction to a special
binary linear recurrence sequence. For such sequences, an analogue of Theorem 3.3
holds as well [331]. Huber [551] gives a precise formula for the maximal possible
period Tm of the sequence
F(X) = /-¦lX'pW-1 + /o
modulo an integer M > 2 as follows. Let M = pki .. .pkss denote the prime factor-
factorization of M; then Tm = lcm(TPl,... ,TPs) where
{Pi, ' if ki = 1;
(Pi + 1)^"V2, if ki > 2 and Pi > 3;
2ki~\ if ki > 2 and Pi = 2.
All possible values taken by periods of such sequences over a finite fields are deter-
determined by Chou [232], [233], [234]; see also [1380].
The next result is well-known — see [619, Sect. 3.2.2, Ex. 8]. Write M =
Pj1 .. .p'l3 for the prime factorization of M, and assume that gcdF, A/) = 1. Then
the quadratic sequence C.7) has the largest possible period M if and only if
gcd(/0,M) = 1, h=0 (mod pi), /i = 1 (rnodp^), i = l,...,s.
The case gcdF, M) > 1 has a simitar result (but needs additional conditions modulo
4 and 9).
In [912], [913], [915], [1007] and several previous papers of the same series,
Nechaev and Polosuev consider the structure and period properties of sequences
satisfying the equation A.7) in a residue ring or a finite field, firstly with polynomial
coefficients and then with arbitrary periodic coefficients. Analogues of many results
for linear recurrence sequences were obtained; they are more complicated and so
are not presented here. In particular, versions of Theorem 3.1 and 3.3 hold.
Mullen and Vaughan [873] describe the cycle structure of iterations of mappings
generated over ?gn by a linearized polynomial
n-l
i=0
If
h=0

58 3. PERIODICITY
is algebraic over ?g(X), where ?q is of characteristic p, then the sequence (a(px))
is periodic by [812].
Thus far in this section we have considered sequences over finite rings. For
infinite rings some of the questions still make sense. For complex linear recurrence
sequences the question about the period (if it exists) is essentially the question of
finding the least common multiple of periods of characteristic roots (which must
be roots of unity in this case). Thus, Theorem 1.2 gives an upper bound for the
largest possible period.
In several papers, periods of non-linear recurrence sequences of first order
a(x + 1) = F (a(x)), a(x) € ft, x € N,
with a polynomial F over some ring ft (not necessary finite) are studied — see [72],
[73], [225], [235], [250], [251], [253], [292], [398], [399], [509], [510], [511], [512],
[667], [668], [857], [858], [859], [860], [861], [863], [864], [865], [911], [993],
[994], [995], [996], [997], [1380]. Narkiewicz [910] provides an excellent guide to
many other papers in this field. This line of research is closely related to the Galois
groups'of iterated polynomials, studied in [42], [863], [973], [974], [975], [1216],
[1218], [1219], [1252], and [1307],
Following [910], for a given polynomial F € ft [A"], denote by Cycl^(F) the set
of all possible periods of such sequences over all possible initial values a(l) € ft.
Chasse [225] shows that over an algebraically closed field K, CyclK(F) is infinite
for any non-linear polynomial F. Moreover, CyclK(F)'contains all primes with at
most degF exceptions. If K is of zero characteristic, then CyclK(F) contains all
natural numbers with at most one exception; see [910, Sect. 12.4].
. The polynomial F(X) = X2 — X shows that exceptions really occur; for this
polynomial it is clear that 2 0 CyclK(F). To see this, notice that if a = (a2 — aJ —
(a2 — a) then a = 0 or a — 2; in both cases a — a2 — a, so this generates a cycle of
length 1 rather than 2.
Iterations of quadratic polynomials over finite fields, in particular their period
length, have also been considered in [832], [870], [986]. The case of F(X) = X2
corresponds to the Blum, Blum and Shub generator considered in Section 13.2.
Over a field of characteristic p > 0, there are several less evident exceptions.
For example, pk 0 CyclK(F) for F(X) = Xp - X by [910, Theorem 12.5]. More
precise results on the structure of CyclK(F) appear in [995].
If K is not algebraically closed then empty cycles can occur: If F(X) = X2 + 1,
then CyclR(F) = 0.
Let Ttz(F) denote the largest element of Cycl^(F) if this set is finite, or oo if
Cycl^(F) is infinite. Narkiewicz [910, Theorem 12.11] proves that for any alge-
algebraic number field K, 7k(F) is bounded by an effective constant. Using a different
method, Pezda [994] gives an essentially improved bound for this constant, showing
that
C.9) TZk(F) <2d+1Bd-l)
for any F € Zk[X], where d = [K : Q]. For K — Q this is the previously known
(and elementary) upper bound T%{F) < 2. In the same paper, Pezda shows that
for the cyclotomic field Km of degree d = tp(m) over Q,
7zXm (F) < p(m,J

3.3. PROBLEMS RELATED TO ARTIN'S CONJECTURE 59
where p(m) is smallest prime number congruent to 1 modulo m. Thus Linnik's
theorem can be used to obtain an upper bound that is polynomial in d (in [733],
Linnik showed that the least prime congruent to 1 modulo m is bounded by mP for
an absolute constant C; many authors have provided estimates for C and in 1993
Heath-Brown [523] showed that the least prime is bounded above by cm5-5 for a
computable constant c). Pezda's estimate C.9) follows from a precise result giving
all possible length of periods over Zp: For any F G Zp[X],
{1,2,4}, ifp = 2;
{1,2,3,4,6,9}, ifp = 3;
{kl : Jfc|p-1, i<p}, if p > 3.
In fact an even more general result is proved in [994], which can be applied to very
general rings.
In [993], Pezda extends these results to the case of m-dimensional sequences
((ai (x),... , am(x)) given by a system of equations
di(x+ 1) = Fi (ai(or),... ,am(x)), i = l,...,m. . x G N
with polynomials Fi € 1Z[Xi,... , Xm]. In particular, he generalizes C.9) by show-
showing that the lengths of periods of such sequences over an algebraic number field K
with degree d over Q are bounded by 2rfA+3m+3m2).
Morton [861] and Flynn, Poonen and Schaefer [399] prove that a quadratic
polynomial over Q cannot have rational periodic pointy of period 4 nor 5, respec-
respectively. Several more specific results appear in [859].
Morton and Silverman [864], [865] prove similar but sometimes weaker re-
results for rational functions. They also consider iterations of points on elliptic
curves [865]. One of the conjectures of [864] implies the uniform boundedness
of torsion of elliptic curves over algebraic number fields (the strong uniform bound-
boundedness conjecture — UBC — of Mazur and Kamienny states that if E is an elliptic
curve over a number field K, then the order of the torsion subgroup of E(K) is
bounded by a constant which depends only on the degree of K over Q; this was
finally proved by Merel [814]). Flynn, Poonen and Schaefer [399] discuss this and
other links to elliptic and hyperelliptic curves.
Fletcher and Smith [398] study the periodic structure of the mapping generated
by the quadratic polynomial F(X) = X2 + c over a residue ring Z/il/Z. An integer
M is perfectly cyclic for any c € Z if the corresponding sequence a(x+l) = a(xJ+c,
a(l) = c, is purely periodic modulo M. That is, for some t e N, a(x + t) = a(x)
for any x € N, not just for any x beyond some point. They show that there
are only finitely many perfectly cyclic numbers, namely the 36 numbers of the
set {2k2>ihm : 0 < k < 3, 0 < ?,m < 2}. They also show that for any fixed
a, b € Z, a =? 0, the only possibly perfectly cyclic prime numbers with respect to
the polynomial F(X) = aX2 + bX + c (under the same definition) are divisors of a
and 2, 3, 5,7. This question is related to a classical question about the distribution
of patterns of quadratic residues and non-residues, and thence to Weil's theorem.
Lagarias, Porta and Stolarlski [667], [668] study the period structure of se-
sequences of the form A.9) with
aX, for 0<X<1/q;
qA-q)-1A-X), for l/a<X<l;

60 3. PERIODICITY
where a > 1. Define Per(a), Per* (a) and Pero(o;) to be the sets of initial values on
the interval [0,1] for which the corresponding sequence is periodic, purely periodic
and of period 1 (that is, identical to zero after some point), respectively. Recall
that an algebraic number a > 1 is called a PV-number (Pisot-Varadarajan number)
if it is an algebraic integer with the property that for every conjugate ft ^ a of a,
\/3\ < 1, and is a Salem number if it is an algebraic integer with the property that for
every conjugate C y^ a of a, \f3\ < 1 with equality at least once. The very interesting
problem of possible traces of PV and Salem numbers is discussed in [801], [800].
Firstly, in [667] and [668] they define special PV-numbers as numbers a for
which both a and /3 = a/{\ - a) are PV-numbers. Then they prove that for such
numbers, the set Per(a) is maximal in the sense that
Per (a) = Q(a)n[0,l].
On the other hand, they show that there are only finitely many such numbers, and
demonstrate a list of 11 such numbers (including a = 2, a = A + 51//2)/2 and
The paper [668] gives a characterization of the set Per* (a) for algebraic a. For
example,
Per* B) = {l/q : 0 < ? < q, gcd(p,g) = l, 2 | ?}
Pe,
where GG) is the algebraic conjugate of 7.
Also, for any special PV-number a, they show that Per* (a) can only contain
a finite set of algebraic integers. For instance, Per* (A + \/5)/2) contains only 0,
while Per* (C + \/5)/2) contains only 0 and (—1 + \/5)/2 and no other algebraic
integers.
Finally, they show that
PeroB) = {?/2k : Jfc > 0, 0 < ? < 2k}.
The period structure of recurrence sequences satisfying A.9) with F(X) = {fX}
for a fixed real / > 1 (that is, sequences defined by iterating the map sending a
to the fractional part of fa) is studied in many papers as well; in particular the
special role played by PV-numbers is studied in [1138]. How far this extends to
Salem numbers is studied in a series of papers by Boyd [142], [144], [145], [146].
Other dynamical aspects of this map have been studied in [395], [396], [397].
Among the results shown there is the following sharp estimate on the growth of
periodic orbits. Let Nf(t) denote the number of initial values a(l) e [0, 1) which
generate sequences of period t; Nf(t) is finite since any iterate of F(X) is a piecewise
expanding monotonic function. The dynamical zeta-function is defined as
Now let A/(/) denote the smallest absolute value of the poles of (/ in \z\ < 1 apart
from z = 1//, and put M(f) = 1 if no other pole exists in this disc. Then, by [395]

3.4. THE COLLATZ SEQUENCE 61
and [397],
Concerning M(/), it is known that 1 > M(f) > (\/5 - l)/2, and asymptotically
that
and
Results of this type are closely related (see [396]). J;o Mahler's famous 3/2-problem
which will be discussed in Section 8.3 below.
The analytic and arithmetic properties of the dynamical zeta function (in which
Nf (t) is replaced by the number of points of period t in some dynamical system) en-
encode subtle properties of the regularity of the underlying dynamical system (see [40],
[983] and [1224] for three very different aspects of this from the viewpoint of dy-
dynamical systems). Parry and Pollicott [981], [982] exploited the fact that the
dynamical zeta function for many hyperbolic dynamical systems has a meromor-
phic extension to give analogues of the Prime Number Theorem for the number of
orbits of a given period in such systems. Hinkkanen [537] studies the dynamical
•zeta-function of a rational function of degree d > 2 over C, showing that it is a
rational function with a special structure. In both cases, results of Section 3.1 then
gives various estimates on the number of initial values generating cycles of a given
period.
Vivaldi [1304], [1306], Hatjispyros and Vivaldi [520], [1307] and Morton and
Vivaldi [866], instead of iterations of polynomials, consider iterations of roots of
a fixed polynomial (which is relevant to the former problem as well). Given a
polynomial / of degree m over a field F and a rational function F € F(X), define
a sequence of monic polynomials (//J by fo(X) = f(X) and
where a^, i = 1,... , m are the roots of fh{X) = 0 (in an appropriate extension of
F). Periodic orbits, Galois groups, and the corresponding dynamical zeta-function
of such mappings are studied.
3.4. The Collatz Sequence
Finally, we mention the '3x + 1' or Coiiatz sequence defined by
i , -n _ / a(x)/2> if a(x) is even;
a[X +i>-\ Ca(x) + 1) /2, if a(x) is odd.
The famous — and still unsolved — 3a; + 1 conjecture claims that for any value
of a(l) € N, a(x) = 1 for some x. This implies, in particular, that 1,2 is the
only possible cycle. Although several non-trivial partial results are known [32],
[33], [34], [35], [36], [37], [79], [86], [172], [338], [438], [640], [664], [777], [976],
[1357] the conjecture is still open (many additional references can be found in [499,
Sect. E16]). The conjecture has been verified for all a(l) up to 240 (see [664],
[338]). Eliahou [338] shows that the length of the smallest non-trivial cycle (if
it exists) is at least 17087915 (see also [230] for a similar but weaker estimate,

62 3. PERIODICITY
and [506] for some improvements). Barone gives a heuristic argument in support
of the conjecture in [67]. Attempts have been made to study these sequences using
ergodic theory [191]. [670], [789], dynamical systems [218],p-adic analysis [874],
logic [777], and many other methods.
Applegate and Lagarias [34], improving a series of previous estimates, prove
that for at least cN0-81 initial values a(l) < N the sequence ends up with the cycle
1,2. More precisely, if Qa(N) denotes the number of initial values a(l) < N with
the property that a(x) = a for some x then, for any a ^ 0 (mod 3), Qa{N) ^>
N0-81. More recently Krasikov and Lagarias [640] improve this result to N0-84.
Notice that for a = 0 (mod 3) the pre-images of a are exactly a2k, k = 0,1,..., so
Qa(N) = logiV + 0A) for such a. In [35] they define na(x) to be the number of
initial values a(l) for which a(x) = a and show that, for any a ^ 0 (mod 3),
1.302053* < na(x) < 1.358386*;
it is conjectured that na(x) = D/3)x+°[x>. Both papers use a mixture of ingenious
arguments together with a great deal of computation. For example, the lower bound
for Qa(N) involves solving a linear programming problem with C9 —1)/2 variables.
Several generalizations of the Collatz sequence are known, with equally myste-
mysterious behaviour [156], [425], [563], [664], [790], [817], [1298], [1299], [1377].
Franco and Pomerance [403] note that if Cq(m) is the largest odd factor of
qm +1, then the Collatz conjecture is equivalent to the statement that the sequence
denned by a^(x + 1) = C% @3(x)) stabilizes at 1 for any initial value a(l) € N.
Similarly, one can consider a sequence aq(x + 1) = Cq (ag(x)) for an odd q e N.
The behaviour of such sequences can be different, with non-trivial cycles appearing.
For instance 13.33.83,13 forms a cycle for q = 5. A much longer list of examples
appears in [403]. Franco and Pomerance [403] reduce this question to the problem
of Wieferich numbers (that is, numbers q with gcd(g,2i|J — 1) > 1 where tq is
the period 2 modulo q). Relying on properties of these numbers, they show that
for almost all q 6 N the set of initial values aq(l) € N, such that aq{x) = 1 for
some x G N, is of asymptotic density 0. The statement is based on results on the
distribution of prime numbers in arithmetic progressions, so it can be put in an
effective form in the following sense: The number of 'bad' q < N can be estimated
effectively rather than as just being o(N). Several related estimates have been
obtained in [842] and [875].
In a different direction, the Collatz sequence may be generalized as follows. Fix
two real numbers a € A,2) and C, and define the sequence
if aag(x) is even;
c) is odd.
The 3x -I- 1 function is the case a = | and C = \. Brocco [166] shows that for
certain choices of a and C the sequence is acyclic for a set of initial values with
positive density. That paper also contains an announcement of Mignosi's result
that for a = 21//fc or a = 22//3 and C = 1, all such sequences are cyclic and there
are only finitely many distinct cycles.
Two more generalizations met in the literature will be mentioned here. Given
integers k.i.m., one may define a recurrence equation by
_ ik,e,m(%)/mi if Q>k,e,m(x) = 0 (mod m);
kak,e,m(x) +1, otherwise;

3.4. THE COLLATZ SEQUENCE 63
(see [499, Sect. El6]). The second class of sequences is generated by the»recurrence
equation
„/„ . -n - / 3a(z)/2> if a(x)is even;
1 + > \ [3a(x) + 1/4J , if a{x) is odd.
Very little is known about the behaviour of these sequences, see [499, Sect. El7].
In general, deciding pure periodicity for a recurrence sequence is clearly a very
subtle problem. To end this section, consider two further examples. It is known that
the difference sequence (a(x + 1) — a(x)) is purely periodic for any max sequence
satisfying
a(x + 1) = max (a(y) + a(x - y)).
l<y<x
On the other hand, problems about periods of aliquot sequences satisfying a(x +
1) = a (a(x)) — a(x) seem hopeless. It was conjectured that any such sequence is
periodic independently of the initial value a(l), but there now seem to be good
reasons to believe that it is unbounded for some initial values, see [499, Sect. B6].
H. W. Lenstra has shown that there are arbitrary long monotonically increasing
aliquot sequences. The question of small periods is even more remote: For example,
cycles of length one correspond to perfect numbers. In [1078], te Riele surveys
results on periods of iterations of various arithmetic functions; several more recent
references are provided by Guy [499, Sect. B41], see also [70], [71], [249], [350].
Robinson [1084] and Swart [1268] study periodicity properties of Somos-A; and
more general sequences (see page 9 for the definition of Somos sequences).

CHAPTER 4
Operations on Power Series and Linear
Recurrence Sequences
An immediate consequence of the representation A.4),
is that over a field for which such a representation holds, the element-wise product
or sum of two linear recurrence sequences is a linear recurrence sequence.
Here we give a more direct proof which does not rely on A.4), and indeed can
be generalized to sequences satisfying the equation A.7) on page 7 and to certain
non-linear recurrence sequences (this argument appears in the proof of the second
part of the main theorem of [1042]).
Theorem 4.1. Let a and b denote linear recurrence sequences of orders k
and ? respectively, over a field F. Then the product cx(x) = a(x)b(x) and sum
c+{x) = a(x) 4- b(x) are linear recurrence sequences of orders at most hi and k + l,
respectively.
PROOF. Consider the sequence cx; the other case is similar. For any h G Z+,
the sequences (a(x + h)) and (b(x + h)) are linear combinations of the sequences
(a(x)),... , (a(x + k — 1)) and (b(x)),..., (b(x + k — 1)), respectively. It follows
that the sequences defined by c?(x) = a(x + h)b(x 4- /i).are linear combinations of
kt sequences of the form (a(x + h\)b{x + /i2)), hi = 0,... , k, hi = 0,... ,?. Thus,
the sequences (cq (x)) ,... , (c^(x)) are linearly dependent. D
In this chapter similar but deeper problems are addressed. The product taken
in Theorem 4.1 is the simplest example of a Hadamard operation. The effect of
taking a Hadamard quotient is already highly non-trivial, as is the general problem
of giving good bounds on the degree of linear recurrence sequences arising as a
result of applying Hadamard operations to given linear recurrence sequences. Some
complexity and transcendence results for other operations on recurrence sequences
are discussed.
4.1. Hadamard Operations and their Inverses
Theorem 4.1 can be reformulated in terms of the Hadamard product (or 'stu-
'student product')
oc
h=l
65

66 4. OPERATIONS ON POWER SERIES AND LINEAR RECURRENCE SEQUENCES
of two power series
r(X) = Y, a(h)Xh, q(X) = J^ b(h)Xh.
h=l h=l
Theorem 4.1 says that the Hadamard product of two rational functions over a field
is a rational function. Solutions of polynomial differential equations are also closed
under the Hadamard product, and arguments in [108] and [1042] show how to get
a quantitative form of this result (that is, how to estimate the order and the size
of the coefficient of the new recurrence equation in terms of the orders and sizes
of coefficients of the original ones). The same result also holds for power series
expansions of algebraic functions over finite fields (see [288] or [736. Cor. 2.9]) and
even for 'algebraic' functions modulo pk by [736, Cor. 3.2]. Surprisingly this result
fails over fields of zero characteristic: The simplest example (see [736], [1027],
[1030]) is the function
whose Hadamard square
f m\2,. 2 r/2
?-—/ \ h I 7J-
is a complete elliptic integral known not be an algebraic function over C.
The Hadamard product can be denned similarly on multi-variate functions as
well. Together with the notion of the diagonal f(X,... , X) of an m-variate power
series f(X\,... ,Xm) this is a powerful tool in the study of multi-variate power
series representing rational, algebraic and other functions [736]. In addition to the
'main' diagonal, other diagonals can be considered.
Cerruti and Vaccarino [216] consider some algebraic properties of 7?.-algebras of
linear recurrence sequences with respect to the element-wise sum and (Hadamard)
product over a commutative ring R. Similar results are also obtained when the
Hadamard product is replaced with the composition a * b of two linear recurrence
sequences over TZ
(a*b)(x) =
h=l
We have seen how the equivalence of Theorem 1.5 between linear recurrence se-
sequences and ratiomil functions works in one direction: The statement that the
element-wise product of two linear recurrence sequences is a linear recurrence se-
sequence implies a non-trivial result about rationality of the Hadauiard product of
two rational functions.
The next result is a statement trivial for rational functions that gives a non-
trivial result for linear recurrence sequences: Since the composition a * b is the se-
sequence of coefficients of the product r(X)q(X)X~1, we conclude from Theorem 1.5
that a * b is a linear recurrence sequence of order at most hi. Theorem 4.1 gives an
upper bound for the order. For fields of positive characteristic, Theorem 4.1 can be
improved. In a field of positive characteristic p, (u + v)v = up + vp. so (ap(x)) is a
sequence with order less than or equal to the order of the sequence a. but there are
non-trivial improvements beyond this. In 1973, Ziegler and Mills [1379] found the
first results in this direction. Later results and additional references can be found

4.1. HADAMARD OPERATIONS AND THEIR INVERSES 67
in [195], J459], [531], and [1098]. Precise upper bounds have been obtained for the
largest possible order of the sequence obtained as the product of two or more linear
recurrence sequences, and for fields of small characteristic this can be essentially-
less than the general bound kl of Theorem 4.1. Some of these results are highly
technical, so we just present an upper bound from [531] which will be needed later.
Theorem 4.2. Let a denote a linear recurrence sequence of order n over a
field of characteristic p > 0. Then the sequence of s-th powers (as(x)) is a linear
recurrence sequence of order at m,ost
where s = sq 4- S\p + • • • + srpr is the p-ary expansion of s.
In particular, Np(s,n) < (n + p — 2)(p~1)logps (for small p this is essentially
better than the bound Np(s,n) < ns given by Theorem 4.1).
Kurakin [653], [654] proves that the convolution
of two linear recurrence sequences is a linear recurrence sequence, and gives upper
bounds for its order.
Larson and Taft [680] consider another operation on the set of all linear recur-
recurrence sequences. Given k sequences a\.... ,ak, define their interlacing "to be the
sequence
ai(l),... ,ofc(l),oiB),... ,ofcB),oiC),... ,ofcC),... .
which is a linear recurrence sequence as well. Indeed, if fi is the characteristic
polynomial of a*, i = 1,... , k, then the interlacing sequence satisfies a recurrence
equation with characteristic polynomial f\(Xh)... fk{Xk), and so is of order
k
As described in Chapter 3, k coordinate sequences can be canonically associated
to each sequence over Z/pkZ by C.5), so there is also an interlacing sequence
associated to any such sequence.
Stoll [1253] studies convolutions of sequences with polynomial coefficients, pro-
providing an upper bound on the order of such a convolution. Yet another operation,
quantum convolution, has been introduced and studied by Ng and Taft [922].
Kurakin [655], [656] and Kuz'min and Nechaev [663] prove that if
s=0
is a linear recurrence sequence of order n over Qp, then each of the sequences as
is a linear recurrence sequence as well, and they give upper and lower bounds for
their orders. The most precise results are due to Kurakin [656]: Writing A^s,fc(ri)
for the orders, these bounds take the form

68 4. OPERATIONS ON POWER SERIES AND LINEAR RECURRENCE SEQUENCES
as n —> oo.
For the sequence
bF(x) = F(a0(x),... ,ofc_i(x))
where F(X1:... ,Xk) ? ?[X1:..., Xk], the order is
NPtF,k(n) (^) A + Oin-1)) , n - oo,
where /?(i?) > 1 is the largest sum ro +pri + • • • + pk~lrk~i over all monomials
Xq° .. -X]^Si in F. In [655], Kurakin studies the first coordinate sequence only
and shows that its order depends on the irregularity index of p.
Several similar (but weaker) results on coordinate sequences over Z/2fcZ, and
on polynomial functions on elements of linear recurrence sequences over F2, can be
found in [275], [276] and [277].
Another approach to estimating the order of coordinate sequences has recently
been proposed in [649]; see also [529].
A natural question is whether Theorems 4.1 and 4.2 can be inverted. In 1920,
Polya [1008] (for f(h) = h) and, later, Cantor [203], [204] proved the following
general statement. Let
be a power series over a field F of zero characteristic. Assume that the coefficients
belong to some ring 71 finitely generated over Z, and let P € TZ[X] denote a non-zero
polynomial. Then if
h=l
is a rational function, so is r(X). This statement can be reformulated in terms of
differential operators. Let D denote the differential operator -j^. Then, roughly
speaking, for any non-zero polynomial P and power series r over 71, the rationality
of P(XD)r(X) implies the rationality of r(X). Bezivin and Robba [112] showed
that the same statement holds for a wide class of linear differential operators. A
differential operator
1=0
with rational coefficients Ri (X) is called a Polya operator if the rationality of Lr(X)
implies the rationality of r{X). Bezivin and Robba give the following characteriza-
characterization of Polya operators over an algebraic number field.
Theorem 4.3. Let K denote an algebraic number field, and let L denote a
rational differential operator in K(X)[D]. For a prime ideal p, denote by Lp the
reduction of L modulo p. Assume that 0 is not an irregular singularity of L, and
that there is an infinite set S of prime ideals of K with
pip
such that for all p in S the equation Lpf = 0 has no non-zero solution mod p. Then
L is a Polya operator.

4.1. HADAMARD OPERATIONS AND THEIR INVERSES 69
A natural question is whether the polynomial can be replaced by a linear re-
recurrence sequence. This question is the fladamard Quotient Problem. As a result
of the work of van der Poorten [1020], [1021], [1022], [1025] (see also [437],
[1026], [1028], [1099]) we know that the answer to this question is positive. The
paper [1026] surveys many previous attempts to solve this intriguing problem and
discusses the motivation and ideas behind the proof. For several particular cases
like Theorem 1.11 this had been done by Cantor [205] and others.
Theorem 4.4. Let b and c denote linear recurrence sequences over a field ? of
zero characteristic. Denote by J the set of x with b(x) ^ 0. Assume that, for all
x € J, c(x)/b(x) belongs to some ring 71 finitely generated over Z. Then there is a
linear recurrence sequence a such that a(x) = c(x)/b(x) for x € J.
This result has been generalized in [262], where it is shown that if the charac-
characteristic roots belong to Z the same statement holds if the assumption 'for all x € T
is replaced with 'for infinitely many x € </'. It is also remarked that this result
can be extended to the case of sequences with dominating roots. Finally, that pa-
paper establishes very interesting links with the theory of Diophantine equations, see
also [264]. In [263] the general case is solved, showing that if the ratio is integral
infinitely often then there is a polynomial p with the property that p(x)c(x)/b(x)
is a linear recurrence sequence for all n in some arithmetic progression. This im-
important paper introduces a new method to deal with the absence of a dominating
root.
In [1119] Schinzel considers integer values of fractions of the form
h(x)
where f,g,h,F,G are polynomials over Z, and a, b G N. Barsky and Bezivin gen-
generalize some of those results to more general expressions of the form
and
i-l
1=1
The celebrated Hadamard Root Problem again asks for a property of the terms
of a linear recurrence sequence to translate into a property of the associated rational
function. Let P denote a polynomial over a field F of zero characteristic and assume
that b is a linear recurrence sequence over F such that there is a ring 71, finitely
generated over Z, containing a root of the equation P(z) = b(x) for every x ? N.
The conjecture is that in this case there is a linear recurrence sequence a such that
b(x) = P(a(x)). Several researchers [262], [419], [987], [1026], [1033], [1100],
[1101] have solved special cases or made reduction steps for this problem. For the
classical case of k-th roots, P{z) = zk, the Hadamard k-th Root Problem is solved
in [987] (and in a more general form in [1100]; see also [1026]) for sequences
b whose characteristic polynomial has only one dominating root with respect to

70 4. OPERATION'S ON POWER SERIES AND LINEAR RECURRENCE SEQUENCES
some norm on F. Finally, the general case of the k-th root problem without any
assumptions is solved by Zannier in [1375].
Larson and Taft [680] deal with a question about the Hadamard Inversion of
linear recurrence sequences. Here the result is quite different to the Hadamard
Quotient and Root problems as it is clear that there are non-zero linear recur-
recurrence sequences a for which (l/a(x)) is not a linear recurrence sequence. Thus the
Hadaniard Inversion Problem is to characterize linear recurrence sequences a such
that the inverse sequence (l'/a(x)) is also a linear recurrence sequence. Larson and
Taft show that such a sequence must have the following structure: There are inte-
integers k and numbers hg, gg € C, such that a(kx + ?) = heg*, ? = 1,... , k. In [1272]
a multi-variate analogue of this result is obtained. Benzaghou and Bezivin [80]
consider the same inversion question for sequences satisfying A.7) on page 7: In
this case there are non-trivial examples.
Another operation on power series is studied in [812], leading to a result in
the spirit ofthe Hadamard Quotient Problem. For p a prime, define the p-binomial
coefficients to be the bi-variate function
over Zp, where
A = J2 Atpfc, 0 < Afc < p - 1, H = Y1 HkPk 0 < nk < V
fc=0 k=0
are the p-ary expansions of A, fj, € Zp. For a formal power series
oc
h=0
over a field F of characteristic p, and a fixed A € Zp, define the 'exponentiation' /A
by
(T) U(x)-i)he?[[x}}.
The following result is proved in [812].
Theorem 4.5. Let ?q be of characteristic p, and let f denote a formal power
series in Fq[[X]] with f(X) ^ /o = 1. If X E Zp, and both f and fx are rational,
then A is rational.
If / is algebraic and non-constant, and A is irrational, then fx is transcendental.
The questions discussed in this section are related to a very old problem con-
concerning" the characterization of divisibility sequences. An integer sequence a is a
divisibility sequence if a(y) I a(x) whenever y x, in which case
gcd(a(x),a(y)) = agcd(x,y)-
Sequences of the form a(x) = xk and a(x) = a\ — a% are evidently divisibility
sequences. The main result of [111] claims that if a linear recurrence sequence a
is a divisibility sequence, then it is a divisor of a product of such sequences. More

4.2. SHRINKING RECURRENCE SEQUENCES 71
precisely, for any divisibility sequence a (suitably normalized) there is a sequence b
of the form
, P\i P2i
such that a(x) | b(x) (moreover, a is a divisor of b in the ring of exponential polyno-
polynomials, see Section 9.1). This result is the culmination of a series of many previous
partial results (see [989]; many other references are in [111], along with perspec-
perspectives on further generalizations).
For elliptic sequences satisfying A.10) from page 9, with initial values a@) = 0
and a(l) = 1. the same question is completely solved by Morgan Ward [1330]: Such
a sequence is a divisibility sequence if and only if aB), aC) and aD) are integers
and aB) | aD) (the sequence itself is then determined by aB), aC) and aD)).
A similar problem is the characterization of recurrence sequences that are
both additive and multiplicative. A sequence (or function) / is additive (respec-
(respectively, multiplicative) if and only if f(km) = f(k) + f(rn) (respectively, f(krn) =
f(k)f(m)) for all pairs of co-prime integers k and m. An example of a multiplica-
multiplicative linear recurrence sequence is a(x) = xk. Less trivial examples of additive and
multiplicative linear recurrence sequences are given by periodic additive and multi-
multiplicative functions. Methfessel [815] shows that there are no other such functions:
If a linear recurrence sequence a is multiplicative, then a(x) = xkf(x), where f(x)
is a periodic multiplicative function; if a is additive then a is a periodic additive
function. Bezivin [107] proves analogous results about multiplicative functions
which are coefficients of power series expansions of solutions of homogeneous differ-
differential equations with polynomial coefficients. For previous results see the references
quoted in [107] and [815]; several more related results have been obtained in [759],
[760], [764].
Lucht and Methfessel [763] show that any complex linear recurrence sequence
a satisfying an affine equation of the form
a(kx + ?) = na(x) + A
for some constants k, I G N, n, A G C for x large enough, must be of the form
a(x) = a + (x + r)mh(x)
where a G C. r G Q, m G Z+ and h is a periodic sequence.
4.2. Shrinking Recurrence Sequences
For linear recurrence sequences a and s over F2, Coppersmith, Krawczyk and
Mansour [258] define the shrinkage of a with respect to s as the shrunken sequence
(as(x)) which comprises those elements a(x) for which s(x) — 1 (in order) . The
sequence s is called the selector sequence. More formally, as(x) = a(hx) where hx
is the position of the ar-th 1 in the selector sequence. The whole procedure is called
the shrinking generator. In the very interesting case where a is a shift of s (usually
just by one element) this is called the self-shrinking generator.
This operation can be defined for any sequences (not necessary linear recurrence
sequences) and can be generalized to sequences over other fields (in many ways),
but the case of linear recurrence sequences over F2 is the most interesting one
because of its many applications to pseudo-random number generators, for instance.
Motivated by this application, the authors of [258] study this operation primarily

72 4. OPERATIONS ON POWER SERIES AND LINEAR RECURRENCE SEQUENCES
for the special case of two M-sequences over F2 (but mention that some of the
results hold in a more general setting). It is shown in [258] that if both a and s
are M-sequences over F2 of order n and m, respectively, with gcd(m,n) = 1, then
the shrunken sequence as is a linear recurrence sequence of order N, where
D.1) n2m~2 < N < n2m~1.
The linear complexity (defined on page 226) of self-shrinking generators is also
studied by Blackburn [120], who settles one of the conjectures from [806].
Some further properties of shrunken sequences are described in Section 13.1.
Many of these results can be considered (and actually are obtained) in the slightly
different context of estimating the linear complexity of sequences — see Section 13.2.
4.3. Transcendence Theory and Recurrence Sequences
A related question about the arithmetic nature of series of the form
bh
D.2) tf =
for integers q >2, k >1,? >0, and a 'regular' sequence (bx) has been considered by
Becker and Topfer [77]. This problem has also been considered by (among others)
Bundschuh, Erdos, Graham, Kiss, Mignotte, Nishioka, Petho; see the surveys in [77]
and [960]. Recent results are due to Corvaja and Zannier [264], Duverney, Kanoko
and Tanaka [318], Nishioka [961], [962], Matala-aho and Prevost. [785] and Brown,
Pei and Shiue [170], Some of these results are based on bounds for the number
of solutions of equations of the shapes B.11) and B.12) on page 38 in a linear
recurrence sequence. In [77, Theorem 4], Becker and Topfer show that if a is a
binary integer non-degenerate linear recurrence sequence, b^ does not grow too
fast, and q > 3, then Roth's theorem and an effective lower bound from [1179]
implies that d defined by D.2) is transcendental. The non-effective but general
Theorem 2.3 is sufficient to prove that the same is true for any non-degenerate
sequence. As usual, we suppose that a\ is the largest characteristic root.
Theorem 4.6. Let a denote an integer non-degenerate linear recurrence se-
sequence without zeros, and let q > 3, k > 1, ? > 0 be integers. Assume that the
non-zero sequence of integers (bx) satisfies
for some 5 > 0. Then
^ a(kqh + ?)
is transcendental.
Proof. Let Q(H) = \cm(a(kq+ ?),... ,a(kqH +?))¦ Then there is an integer
P(H) for which -d - P(H)/Q(H) = $H, where
__bh
The trivial upper bound on \a(x)\ gives
a(kqh

4.3. TRANSCENDENCE THEORY AND RECURRENCE SEQUENCES 73
and Q(H) > \a(kqH+?)\ -+ oo. On the other hand, by Theorem 2.3 (with e = S/2q)
and the upper bound on bht
( oo
_ o I V \aAiq~2~S)qh~1\ai\~il~s/2q)qh
= O
= O (|a1|(-2-<5/2^") = O
Moreover
tftf > l/|a(^H+1)| - |tf*+1| > fa!^1-*/2^"*1 +0 (lailt-2-'/^"*1) > 0,
for H large enough. This provides infinitely many rational approximations
0 < \d - P{H)IQ{H)\ = O (q{H)-2-qa6'^ , Q(H) -f oo
which are too good for ^ to be an algebraic number. ?
For q = 2 the situation is more complicated. The same method shows that i9
is irrational for sequences (bx) satisfying
In this case infinitely many approximations of the form
0 < |tf - P(H)/Q(H)\ = O (q(^)-1-0-4^), Q(H) -. oo,
are obtained, which are too good for $ to be rational. The example
for the Fibonacci sequence f(x + 2) = f(x+l) + f(x), /(I) = /B) = 1, shows that
algebraic numbers really occur. On the other hand,
oo oo 1
are transcendental. The situation is clarified in [77, Theorem 3], which covers all
these examples.
Several more relevant results can be found in [741]. For the Fibonacci sequence
again, these results imply that the numbers
°° 1
) rC ^^ J., Z, . . . ,
are algebraically independent, and, for a 'reasonably' growing coefficient sequence
(bx) and a wide class of linear recurrence sequences a, the numbers

74 4. OPERATIONS ON POWER SERIES AND LINEAR RECURRENCE SEQUENCES
are transcendental — see [741, Theorems 2, 3]. Several important examples of
transcendental numbers may be found from these results. Among these are
h-l h=l
transcendental for any algebraic i9, |i9| < 1 and bh = ih/kh where integers ?h,kh
satisfy
logmax{|4|, \kh\} = o{2h).
These results use the functional equation technique from transcendence theory cre-
created by Mahler and developed by Loxton and van der Poorten among others;
see [76], [105], [740], [741], [743], [745], [960], [1024]. In the particular case
a(x) ~ 2X it is noticed in [1039] that any series of the form
is transcendental, by a result from [741].
Duverney [317] obtains irrationality results about power series of the form
OO /j
D.3) tf ?
If q, \q\ > 2, is an integer r = b/a ^ 0, gcd(a,6) = 1, and |?-| < \q\, he shows
that the question of rationality of D.3) is related to the densit)' of the set of prime
divisors of the binary linear recurrence sequence a(x) = aqx — b: that is, the kind
of question discussed in Section 6.3 below. Write
6 =
p\a(x)
where the product is taken over all distinct prime divisors of elements a(l),aB),...
(notice that 5 = oo for many values of q and r). Then for 5 > \b\2/\q\, $ is irrational.
Thus, for example, for 5 > 1 any such power series with \q\ > b2 is irrational. If
\q\ > 3 and r are both odd integers, then 5 > 2 and the same holds for \q\ > ^r2.
Less trivial examples include the power series
The first is irrational because 5 | 33 - 2, so 5 > 51/4 > 4/3. The second is irrational
because 11,13,23,37,47,59 divide 44 - 3, 42 -3,44 -3, 413 -3. 421 -3, 425 -3,
respectively and so
6 > 111/10 x 131/12 x 231/22 x 371/36 x 471/46 x 591/58 = 2.34 • • • > 9/4 = 2.25.

CHAPTER 5
Character Sums and Solutions of Congruences
The problem of estimating character sums over linear recurrence sequences
arises in many branches of mathematics, and includes many classical problems in
number theory as well as modern problems in cryptographic analysis. The main
problems and results are described in this chapter, both in finite fields and in
characteristic zero. These results are then applied to give estimates for the number
of solutions to congruences and other equations in linear recurrence sequences.
5.1. Bounds for Character Sums
Estimating character sums for exponential functions over finite fields is equiva-
equivalent to estimating Gaussian sums. Indeed, if a G Wq has period t and k = (q — l)/t,
then
x-=l q x€F'
for any additive character x of Fq (an additive character is a homomorphism Fq —>
C). Analogously, character sums in linear recurrence sequences can often be reduced
to sums with sparse polynomials. We shall use the language of character sums with
linear recurrence sequences and exponential functions. The following general upper
bound begins the study.
Theorem 5.1. Let a denote a linear recurrence sequence of order n with period
t overFq. Then, for any non-trivial additive'character \ ofFq,
Y (a(x)) <{ qU/2' ifN=t'
2_uX(a(x)) - | qn/2(\ogt + l), if N < t.
1=1 v
Proof. The proof is based on two observations. The first is that
?(/) = {(co«(^) H hcn_ia(x + n-1)) : c0,... ,cn_i G Fq},
where / is the characteristic polynomial of a. Indeed, the n sequences hi{x) =
a(x + i), i = 0,... ,n — 1, are linearly independent over Fq (otherwise the charac-
characteristic polynomial of a cannot be of degree n). Hence det (a(i + j + l)"~_!0) ^ 0.
Therefore, any other sequence b e ?(/) has a unique representation as a linear
combination of those sequences. Hence, for any integers c and N,
N
Wc(f,N) = V Vx(&(^))expB7rica;/t) = Y expBrcic(x - y)/t)
75

76
5. CHARACTER SUMS AND SOLUTIONS OF CONGRUENCES
where T(N) is the number of x and y, 1 < x,y < N, with a(x + i) = a(y + i),
i = 0,... ,n — 1. If TV < ? then the only solutions of this system are pairs (x,y)
with x - y. Thus in this case T(N) = TV, and Wc(f,N) < qnN. Indeed, it is easy
to see that in general Wc(f, N) = qnN.
The second observation is that t distinct sequences a,h(x) = a(x + h), h =
0,... ,t — l, give the same contribution to Wc(f,t). This shows that
X (Kx)) expBnicx/t)
Setting c = 0 gives the first bound.
For the second estimate, standard techniques are used to reduce estimates for
incomplete sums to estimates for complete ones, see [550, Sect. 14] (the parameter
c is used for this). ?
This bound was first proved by Korobov [632] in 1953. In 1965, Nechaev and
Stepanova [916] extended Korobov's result to the case of an arbitrary finite field
(using the language of residue rings modulo a prime ideal in an algebraic number
field). For further generalizations and improvements see [725, Chap. 8] and [1211].
Improvements to Theorem 5.1 concern the constants only: It is possible to show
that the bound cannot be improved to o(qn^2). On the other hand, it,is possible"
that the bound O(tl^2+e) holds for a wide class of useful sequences. The identity
Wo(f) = qnt obtained in the proof of Theorem 5.1 shows that the latter bound
holds for all but qnt~2e sequences from ?(/).
The same approach works for other sequences over other finite rings. In [915]
Nechaev extends Theorem 5.1 to the case of sequences satisfying the equation A.7).
In the special case when the characteristic polynomial / of a is irreducible over
?q and /(()) = 1 (that is all roots of / are of norm 1 inF9), then [582, Theorem 4.1.1]
implies (after some standard transformations) that
E.1)
1=1
In turn, it has been shown in [1209] that the bound E.1), combined with
the bounds E.4) and E.5), implies an improvement of Theorem 5.1 for arbitrary
irreducible characteristic polynomials /. Similarly, one can combine the bound E.1)
with Theorem 5.8, see [1209]. We remark, that the above results are not explicit
in [582] and [1209] where the more traditional language of Gaussian sums is used,
however they can easily be derived from those estimates.
A particularly important generalization of Theorem 5.1 is the following bound
for finitely generated groups of the form A.13),
Let Aq denote the residue ring modulo an integer ideal q in an algebraic number field
K, and let x denote a primitive additive character of Aq. Then, for any a e Aq.,
E-2)
E
v€Vq
X(av)

5.1. BOUNDS FOR CHARACTER SUMS
77
It is not clear how to estimate incomplete sums like
?
v€V,
|T(av)|<Q
in this setting. However, for the case K = Q and r = 1, the estimate
N ' w° ifiV = i,
E.3)
expBrciagx /m)
holds for incomplete sums. This result seems to have appeared first in print in
a paper from 1972 by Korobov [637], but apparently had been known for many
years; see also [1257]. Thus, the bound in Theorem 5.1 has many generalizations.
In contrast, the following upper bounds are proved for very special cases only,
and any generalization would be of great interest. It is natural to try to improve
Theorem 5.1 and the bounds E.2), E.3) by considering higher powers of character
sums. Generally this produces systems of equations in four or more variables about
which little can be said. However, for a single exponential function modulo a prime
number, the recent improvement by Garcia and Voloch [424] of the Weil bounds
allows more to be said. By considering fourth powers of exponential sums, a bound
stronger than E.2), E.3) was derived in [1198] (see also [1202, Sect. 9.2]). Heath-
Brown and Konyagin [524] provide an elementary proof of the result of [424]; the
ideas of this proof are used in [629] to obtain a generalization of some results
of [424] and [524] which allow "further improvements to the bounds of exponential
sums from [1198]. This work gives estimates of the shape
E.4)
expBiriagx/p)
«
1/4
where gcd(ag,p) = 1, and t is the period g modulo p. The bound E.4) is non-
trivial for values of t on the order of p2/5, and is better than the analogue of E.3)
for t < p2!3. For t < pxl2 it is further improved in [629] to
E.5)
by using the same kind of arguments applied to the eighth powers of exponential
sums. The bound E.5) is non-trivial for values of t between p1/3 and pll2.
Certain incomplete sums can be dealt with as well. The following bound follows
from Konyagin's estimates [627] for Gaussian sums. If
t >logp(logplogp)~1+e
then
E.6)
expBniagx/p)
where C(e) is a positive constant depending only on e > 0. Although this bound is
quite weak, it has been used for several additive problems with exponential func-
functions: For example, Heilbronn's conjecture on the smallest number of summands
in Waring's problem modulo p is proved in [627] using this bound.
Working modulo a prime number, generalizations to finitely generated groups
are automatic: The reduction Vp modulo p of any group V defined by A.13) is a

78 5. CHARACTER SUMS AND SOLUTIONS OF CONGRUENCES
cyclic group, since it is a subgroup of F*. Unfortunately, the results and methods
of [424], [524] used to prove E.4) and E.5) work well for prime fields only. Thus
these bounds cannot be immediately extended to arbitrary finite fields. However,
when combined with other bounds for exponential sums they produce nontrivial
upper bounds for linear recurrence sequences of period slightly less than qnl2 and
with irreducible characteristic polynomial; see [1209].
The bound of Theorem 5.1 is meaningful for sequences with large period close
to qn, but is trivial for period t < qnl2. For example, if a and b are M-sequences
of order n over ?q with distinct characteristic polynomials, then c{x) = a(x) + b(x)
is a linear recurrence sequence of order 2n by Theorem 4.1 with the same period
qn — 1. Theorem 5.1 says nothing about this case, which is important for coding
theory. However, using other methods in special cases (including the sum of two
M-sequences), character sums can still be estimated. The next result shows how to
reduce estimates for sums over linear recurrence sequences to estimates for character
sums over single exponential functions gx with g integral.
The;orem 5.2. Let a denote a linear recurrence sequence of period t over?q and
let G^ denote its group of multipliers. Then for any non-trivial additive character
X of?q,
+ t\G^\~1q1/2, - any t and q;
< { \R-t/(q-l)\, |GM| = q-1 ;
q = p is prime;
where R is the number of x, 1 < x < t with a(x) = 0.
Proof. For any A e G/(.
so
x=l -^ |G^
Since G^ is cyclic, any bound for character sums over a single exponential function
can be applied to the inner sum in the double sum. Setting.n = 1 in Theorem 5.1
(or using E.2)) shows that each summand does not exceed g1/2; if |GM| = q — \ then
each of them equals —1; finally, if q = p is prime E.4) and E.5) may be applied. ?
Certainly, including E.1) in the previous arguments would lead to a new series
of bounds.
To ap>ply Theorem 5.2 an upper bound for the number of zeros R is needed;
bounds for this will be described in Section 5.4. The main obstacle is that Theo-
Theorem 5.2 is useful only when |GM| > q1^2, or at least |GM| > p3^7 for prime q = p.
It is not clear how to estimate |C?M| in general, but for special sequences it can be
described in terms of the period t and q only (see Theorem 3.6). In particular, this
includes the sum of two M-sequences when |GM| = q — 1.
The same method can be used to estimate incomplete sums over a part of the
period. Combining the approaches of the proof of Theorems 5.1 and 5.2 gives the

5.1. BOUNDS FOR CHARACTER SUMS
79
< gn
following bound (see [1184, Lemma 2])
E.7)
where i/j is any (possibly trivial) multiplicative character of ?q. This bound, to-
together with the identity
N ' 2
o(x)g?(/) x=l
where i is the period of / e F9[X] (obtained in the proof of Theorem 5.1) are
crucial ingredients in several further results on the distribution of linear recurrence
sequences in finite fields. In particular, the bound E.7) leads to Theorem 7.2
(see [1184], [1196]), while the identity E.8) is used in the proof of Theorems 12.10
and 12.11.
The next bound is applicable to sequences of growing order over arbitrary rings.
Being purely combinatorial, it covers non-linear recurrence sequences A.9) as well
(but turns out to be non-trivial only for sequences with nearly maximal periods).
Theorem 5.3. For any non-linear recurrence sequence a satisfying A.9) of
period t over a finite ring 7Z with m elements, and any non-trivial additive character
X of 71, and any positive integer N < t, the bound
" \ n
E.9)
N
?
x-=l
¦n/2
holds.
Proof. From the recurrence,
n
where |i9| < (H h n - \)/n < n/2. Since N < t, the n-tuples
(a(x),... ,a(x + n — 1))
are distinct for x = 1,... , N. It follows that
N
<
i=i
= N E E xMx(
ak)
E
because the last sum is not equal to zero if and only if h = k (in which case it
equeils mn). ?

80
5. CHARACTER SUMS AND SOLUTIONS OF CONGRUENCES
If 7V = t then the term n/2 can be dropped from the right-hand side of E.9).
Theorem 5.3 is only useful for sequences with period t > mn/n. However,
the method itself is applicable in several more situations. For simplicity, the next
theorem is stated for the case 71 = F2, though a similar result holds for any finite
ring.
Theorem 5.4. Fix X G @,1). Then for any non-linear recurrence sequence a
satisfying A.9) of period t > 2Xn over ?-2, and any N <t the bound
N
'_iWz)
x=l
holds, where f(X) = 1 — 2^(A) and ip(X) is the unique root of the equation
—rjj log ip - A - ip) log(l - ip) = A
on the interval 0 < ip < 1/2.
The proof is based on the same reduction to estimating double sums, and then
the combinatorial estimate
0, if n ^ s (mod 2)
((n+ns)/2), ifn = s (mod 2)
for
M, <
:r<iV :
= s
h=l
(see also the proof of Theorem 14.7 below). In [1188] the same estimate is proved
for linear recurrence sequences (the language of code weights is used in that paper;
see also Section 14.3) but.the proof holds for non-linear recurrence sequences as
well.
Several new estimates for non-linear recurrence sequences are given in the series
of papers [252], [478], [496], [497], [942], [943], [944], [945], [946], [954], [955],
[956]. Surveys of recent results can be found in [947], [948]. In particular, The-
Theorems 7.7 and 7.8 on pages 124 and 125 are based on the following two estimates
from [497] and [942], respectively.
Theorem 5.5. // the sequence a, defined by C.8) with a prime modulus M =
p, is periodic with period t > N > 1, then for any integers ho,... ,hs-i with
gcd(/i0). ¦• ,hs-i,p) = I,
< DS
The bound is non-trivial for N > pl/2+e.
Theorem 5.6. If the sequence a, defined by C.6) with a prime modulus M = p
and F G FP[X] of degree d > 2, is purely periodic with period t > N > 1, then for
any integers ho,... ,hs-\ with gcd(/i0,--- ,hs-i,p) = 1,
N
. s-l
1=1 \ r j=0
where the implied constant depends only on d and s.

5.1. BOUNDS FOR CHARACTER SUMS
81
This bound is non-trivial only for N > plog p, and it would be very useful
to reduce this threshold to p1//2+?.
The main ideas on which Theorems 5.5 and 5.6 are based will now be described
for the case 5=1. First notice that for any integer k,
N N
Y^ exp Bmha(x)/p) - ^ exp Biriha(x + k)/p)
x=l
Therefore, for any K € N,
N
E.10)
1=1
<2\k\.
exp Bmha(x)/p)
where
W =
N K-l
Y^ Yj exp faihatx + k)/p)
x=l k=0
= W
N
n=\
K-l
exP {2mha{x + k)/p)
k=0
N
= E
x=l
K-l
(where Fk is the k-th. iteration of the function F in C.6)). By the Cauchy-Schwartz
inequality,
2
N
w2 <
<
x=l
K-l
exp BrihFk (a{x))/p)
k=0
K-l
K-l
exp BniaFk (w) /p)
k=0
exp.Bma (Fk (w) - Fe (w)) /p)
k,e=o
= KNp + 2N
K>k>e>0
exp Bma (Fk (w) - Fl (w)) /p)
Now if F is a polynomial (or a rational function) then Fk — Fe is a polynomial
(or a rational function) as well (ignoring some complications with poles of rational
functions). The degree of Fk — Fe can easily be estimated, and then the Weil
bound used to estimate the last sum. If F is a polynomial, then the degree grows
exponentially with k and thus only rather small values of K can be used, and in
this case the bound is rather weak. However, for the inversive generator C.8) the
function Fk — Fe is a ratio of two linear functions for all k > ? > 0 so a sufficiently
large value of K can be chosen, and then the Kloosterman bound may be applied
to the last sum.
If N = t then the term O(K2) disappears from E.10) and so the size of the
shifts k is not important. This idea has been used in [414] where the freedom to
choose shifts is exploited, and then in [408], [406].
The next important case is that of linear recurrence sequences modulo a power
of a fixed prime number. The following result is a particular case of the general

82 5. CHARACTER SUMS AND SOLUTIONS OF CONGRUENCES
formula of Korobov [637]. If p > 3 is a prime and gcd(ag,p) = 1, then
tk
E.11) y^expBTriagx/p) = 0, k > s,
x=l
where tk is the period gx modulo pk, and s is defined by t\ = ¦ ¦ • — ts < ts+\. For
p = 2 the same result holds provided k > s + 1. Korobov [637] gives a general
result for composite numbers m = pkl ... pk» whose exponents fci,... , A,v are large
enough.
For incomplete sums over a part of the period, the bound E.3) can be used
hefe, but the following bound due to Korobov [637] is particularly interesting. For
N < tk, put r = \ogpk/hgN. If gcd(a,p) = 1 and N >pSs: then
N
E.12) Y^exPBnia9X/Pk) <3Nl~c/r\ k>12s,
x=l
where c = ^ x 10~6. An important feature of this estimate is that it provides
non-trivial results even for very short sums of length N ~ exp (l50(ln?fcJ/3). The
constants can certainly be improved.
Using the polynomial representation of Theorem 3.5 on page 48, the following
bound is proved in [1183].
Theorem 5.7. Let p > 3 denote a fixed prime number and let a denote an
integer non-degenerate linear recurrence sequence with a square-free characteristic
polynomial f, ivith p| /@). Then there is a constant C(a,p,e) such that the bound
tk
exp B-Kia{x)/pk)
x=l
1-l/n+e
holds, where tk is the period of the sequence a modulo pk.
Possibly the same estimate can be proved for p = 2 as well. Moreover, results
of [829] show that the same estimate holds with e = 0. The case of multiple
characteristic roots can be worked out without any major modification of the scheme
of proof.
The following example is due to Korobov, and demonstrates that up to the
factor tek, the bound of Theorem 5.7 is essentially the best possible. Let g denote
a primitive root modulo all powers of p > 3. Consider the sequence a(x) = (gx +
l)n - 1, of order n > 2. Then tk = y(pk) = (p - l)pk~l and
tk
exp BTria(x)/pk) = \] exp ( 2iri—v— ) — Y^ exp I 2ni ^ j
~, r» \ c / „ r» \ c /
Both these sums can be explicitly computed: The first is of order pk(-x l^n\ while
the second equals zero (for k > 3).
On the other hand, it is quite possible that for special sequences a much stronger
bound holds.

5.2. BOUNDS FOR OTHER CHARACTER SUMS
83
5.2. Bounds for other Character Sums
In some cases stronger bounds can be found for averages of character sums.
Consider the sum
-^ ?
l... ,Cn-l=0
tk
x=l
n-1
j=o
for a linear recurrence a. For Q = pk, this sum can be computed precisely: W(pk) =
tk- For smaller values of Q, Theorem 5.7 gives
t
*-2/n+e
For Q > p2/c/'1 the better bound
E.13) W{Q)<t2kQ-1logtk
follows from Theorem 7.6 by the following argument. Notice that
The estimate
Qn Z-, 11 Z_/
expB7rii?c)
c=0
where \\'&\\ is the distance from iTto the nearest integer, is well-known. Split the
sum over x and y into pk double sums, corresponding to x and y for which
max
{a{x + j) -a(y
= h/pk, 0<h< {pk -
Denote the set of x,y, 1 < x,y < tk satisfying this condition by 5^. The sum
corresponding to h = 0 is equal to tk, since the set So is the diagonal x = y. The
other sums do not exceed Qn~1pk/h. Therefore,
H
On the other hand, Theorem 7.6 gives the bound
H
h=l
showing E.13).
Incomplete sums can be estimated using the same polynomial representation,
and various bounds for sums with polynomials (see the books [550] and [725]; the
latter containing an extensive bibliography). In some cases this is done in [1363],
but in full generality it has not been worked out yet.
The next result is a new bound from [629]. which deals with almost all moduli
p rather than with almost all sequences.

84
5. CHARACTER SUMS AND SOLUTIONS OF CONGRUENCES
Theorem 5.8. For each integer t and prime ? = 1 (mod t) fix an element gt/
with exponent t modulo I. Then, for any fixed integer k > 2, and any U > 1, the
bound
max
t-1
x=0
holds for all primes I = 1 (mod t), excepting at most U/logU of them.
One of the ingredients in the proof of this result is the following asymptotic
formula, which has independent interest. Let t denote an integer and ? = expBni/t)
a t-th root of unity. For any fixed fceN the equation
?*i +...+?** =?**+! +...+?*afc)' 0 <*!,... ,Z2k<t-l.
has A(k)tk + O(tk~l) solutions where
A;!, if t is odd;
Bfc-l)! if Ms even.
Theorem 5.8 may be applied in the following kind of argument. Let t and A have
the property that there are at least tA~1~? primes I = 1 (mod t), and such that
tA < ? < 2tA. Choosing U = tA~1~?k shows that for almost all primes t described
above,
A(k) =
max
gcd(a,?)=l
t-1
E
x=0
ft-{2k-A)/2k2 + t(-A+2)/2k2+e\
This bound is non-trivial if 2 < A < 2k (for A < 2 E.5) may be used). If A is an
integer, then the optimal choice for k is k = A — 1, which produces the estimate
t-i
max
gcd(a,?)=l
x=0
tl-(A-2)/2(A-lJ+e
for almost all I satisfying the conditions above. Theorem 5.8 is also used in the
proof of Theorem 12.15 below.
Motivated by cryptographic applications, sums of the form
t-i
E.14)
»=o
t-i
bgxy)/m)
x=0
where t is the exponent of g modulo m have been studied in the series of paper [198],
[199], [408]. The bound E.14) is based on the bounds for the number of solutions of
exponential congruences. For prime m = p such a result is given by Theorem 5.10.
For an arbitrary composite m an analogue of Theorem 5.9 has been given in [408].
The bound E.14) is also an important tool in the method of [412] for bounding
double sums
Tm(a,X,y) =
over arbitrary sets X,y C Z/tZ; see also [408], [413]. If some information about
the arithmetic structure of X or 3^ is known then one can improve these general
estimates - see [413].
One-dimensional sums of the form
Vm(a,Z) =

5.3. CHARACTER SUMS IN CHARACTERISTIC ZERO 85
over certain sets Z C 1/ti can be estimated as well [407], [408], [414], [406], [726].
The sets to which the above method applies should have some algebraic structure
(for example, they could be subgroups of Z/tZ). Thus, they include the sets of
powers xn, x e Z/tZ and the set of values of exponential function ex, x = 1,... , r,
where r is the exponent of e modulo t, gcd(e, f) = 1. In particular, these bounds
apply to studying the distribution of the power generator (cf. Section 13.2).
Exponential sums of the form
l
5p(al5... ,an) = ?
Xi,...,xn=0
have been estimated in [1208]. These results are directly related to study of the
Naor-Reingold pseudo-random number generator, studied in Section 13.2.
The paper [623] provides an analogue of the bound E.2) for a subgroup of the
group of points of an elliptic curve over a finite field.
5.3. Character Sums in Characteristic Zero
Sums of characters over C can be considered as well. Unfortunately, even for
single exponential functions, knowledge of the behaviour of sums
N
x=l
is poor. The full picture is much more complicated here than for the case of sums
with polynomials, which are relatively well studied [550]. In particular, for expo-
exponential functions the picture is not as clear-cut as it is for polynomials. Following
Weyl's result of 1916 [1341], it is known that for any polynomial P having at least
one irrational coefficient,
N
x=l
Subsequent papers of Vinogradov and others provide much more precise estimates,
see [550]. In contrast, for any g 6 Z there is on the one hand an uncountable set
of irrationals A with the property that liminf/v—oo S(X, N)/N > 0, while on the
other hand the identity
I
l
2,
i:
|S(A,A0|2dA = iV.
'o
implies that S(X, N) < Nx^2+? for almost all A 6 [0,1]. Using higher powers gives
quite precise estimates for the size of the exceptional set of A. Indeed,
" \S(X,N)\2kdX =
where Tk{N) is the number of solutions of the equation
pXl +--- + gXk =gyi +---+gyk, l<xi,yu... ,xk,yk <N.
The main contribution to Tk{N) comes from solutions with Xj ^ Xj, 1 < i < j < k.
In this case, the vector (yi,... , yk) is a permutation of (xi,... ,Xfc), so the number
of such solutions is k\N(N - 1)... {N - k +1). Estimating the contribution of other
solutions gives |rfe(iV) - k\Nk\ < k2k\2kNk~\ see [1220, Theorem 1, Chap. 3].

-¦.-86 5. CHARACTER SUMS AND SOLUTIONS OF CONGRUENCES
From these power moments of \S(X,N)\, various results about the distribution of
S(X,N) can be obtained by using standard methods of probability theory.
The only known individual bound is Usoltsev's estimate |5(A, N)\ < N -2g~2,
which holds for any g > 2 and q~N < A < l/2(g — 1) (this is the form given
by [1220, Lemma 3, Chap. 3]). This bound is very weak, but it is useful for some
number-theoretic applications [1220].
Bounds for S(X, N) for some specially constructed numbers A are known. For
example, Korobov [633] shows that for any function ip{N) —» oo, there is a A with
S(X,N) < ip{N). On the other hand, nothing is known about sums S(X,N) for
specific irrationals A like tt, e, \/2 and so on.
For linear recurrence sequences similar results can be obtained as well. Tradi-
Traditionally, instead of studying linear recurrence sequences, researchers have worked
with matrix exponential functions A(x) = ¦dJrx. Almost all results of this sort are
obtained in the wider context of normal numbers and uniform distribution modulo
1, which is discussed in Chapter 8. Any bound for the discrepancy (this is de-
defined on page 127) leads to the same bound for the corresponding exponential sum.
Moreover, the same bounds usually hold for both of them. An intriguing exception
is the result of [633] mentioned above — the best bound for the discrepancy is
O(Arl/3+e), which is much worse (for single exponential functions [635], [706] as
well as for linear recurrence sequences [715]).
The situation is similar to that of scalar exponential functions: There are precise
metrical results, many specially constructed examples, but no general individual
• bounds.
Sums of multiplicative characters over linear recurrence sequences have not
been studied systematically. An analogue of Theorem 5.1 is provided by [1184,
Lemmas 3. 5]. Notice that the group of multipliers Gfl appears again in these
bounds. Fix a multiplicative character tp over Fq (that is, a homomorphism from
F* to C; the order of tp is the minimal k such that ipk is the trivial character).
Then, for any linear recurrence sequence a of order n over Fq,
0, if ord^|(?-l)/|GV
q(n~1^2\G J, otherwise.
In particular, the bound does not exceed ^""^^(ord^). Thus, for a primitive
character of order q — l, the bound is at most O(q^n~1^2) (for G^ = {1}; otherwise
the bound is zero). If |GM| = q — 1, then all such sums are equal to zero. This
means in particular that for a sum of i\/-sequences of the same order, quadratic
residues and non-residues are distributed evenly.
Incomplete sums can be estimated along the same lines. For binary sequences
of the form Agx + B with A,BeZ. and g a primitive root modulo a prime p,
p\AB< this is done in [305].
5.4. Bounds for the Number of Solutions of Congruences
Bounds for exponential sums from the last section can be applied directly to
estimate the number of solutions of congruences and equations in linear recurrence
sequences. For example, Theorem 5.1 implies that for a linear recurrence sequence
a, with period /- over ?q, the number of solutions of the congruence
a(x) = c, 1 < x < t,

5.4. BOUNDS FOR THE NUMBER OF SOLUTIONS OF CONGRUENCES 87
is t/q+O(qn/2). Arguments using the group of multipliers can reduce the error term
to qfr-W2, and even to g(n~2)/2 for c = 0 (see Theorems 7.1 and 7.2). The case
of binary sequences over finite fields and residue rings is studied by Somer [211],
[1229] in more detail. Estimates obtained on this way are non-trivial for sequences
of large period.
In this section estimates which require new ideas will be presented, and upper
bounds are found which are non-trivial for segments of any length.
The following result is proved in [1237] and [1238]. Define the sequence
{5n)n>2 by the recurrence
E.15) 52 = l, 5^-^
Theorem 5.9. Let F denote a field, and Ai,... ,An,ai,... ,an e F*. Let
R(N) denote the number of solutions of the equation
Then
R{N) < 2nN (N~5" + r~5n)
where r is the smallest integer t > 0 with a\ = a*- for at least one pairs (i,j),
1 < i < j < n (and, formally, r = oo if such a pair does not exist).
In the case F = Fp, a similar result was obtained in [1186] with Sn = 2~n+2.
For the sequence denned by E.15), 5n > exp(-clog2n) for some effective absolute
constant c > 0. In both cases the proof is an induction argument (in [1186], the
inductive step is from n to n— 1, while in [1237], [1238] it is from n to [G7. + 1)/2J).
Both methods can be generalized to sequences with multiple roots as well. On the
other hand, the method of [1186] (producing worse estimates) can be generalized
to sequences over other rings. For example, van der Poorten and Shparlinski [1041]
obtain an estimate for sequences over rings of multi-variate polynomials, presented
below as Theorem 5.13, but this approach fails to give an analogue of Theorem 5.9
where working in a field is essential.
A better bound for the number of zeros in the full period of a linear recurrence
sequence over Fq can be extracted from the upper bound on the number of zeros
of sparse polynomials given in [198]; see also [409], [410], [1202], [1203]. The
original result is given below as Theorem 9.3. For convenience, it is presented
here in the form of an upper bound on the number of solutions of an exponential
equation.
Theorem 5.10. Fix Ai,... ,An,a\,... ,an eF*. Let R denote the number of
solutions of the equation
--- + An a? =0,
Then
where
t = max minx;,-.
l<i<n j#i J
and Tij is the smallest positive integer t such that a\ = a*-, 1 < i < j < n.

88 5. CHARACTER SUMS AND SOLUTIONS OF CONGRUENCES
Now consider an algebraic linear recurrence sequence of order n. For technical
reasons it is easier to work in the splitting field K of the characteristic polynomial of
the recurrence. As in the proof of Theorem 2.6, introduce matrices D{{X\,..., Xi).
For an integer ideal q of Zr, define T(q) to be the largest integer T such that
q| Yl max{l,|Ndet?>n@:z2,... ,xn)|}.
l<x2,...,xn<T
The following lower bounds can be obtained using the same arguments which were
used in Chapter 3 to estimate the period modulo almost all primes:
(LogN(q), for any integer ideal q;
N(pI/("+1)-?, for almost all prime ideals p;
exp (Log1 N(p)), for almost all integer ideals q.
Theorem 5.11. Let an integer ideal q ofL% be co-prime to infinitely many ele-
elements of an algebraic non-degenerate linear recurrence sequence a of order n, whose
characteristic polynomial splits in K. Then the number R(M,N,q) of solutions of
the congruence a(x) = 0 (mod q), M + 1 < x < M + N, has
R(M, N, q) < (n + /z(n, K)) (N/T(q) + 1)
for any iVeN and M 6 Z+.
The proof of Theorem 5.11 is similar to that of Theorem 2.6, but was obtained
earlier in [1192].
The estimate E.16) gives upper bounds for the number of solutions of the
congruence; in particular, R(M,N,q) <C iV/LogN(q) + 1. This bound appears to
be the best possible general estimate: If a(x) = 3X — 2X and q = 3k — 2k then
R{M,N,q) > [N/k\ >N/Logq-1.
In the case q = pk, p a fixed prime ideal, the p-adic technique of [1013], [1015],
[1035], [1038] leads to the following result from [1040].
Theorem 5.12. Let a prime ideal p of Zk be co-prime to infinitely many el-
elements of an algebraic non-degenerate linear recurrence sequence a of order n,
whose characteristic polynomial splits in an extension K of degree d over Q. Then
the number of solutions of the congruence a(x) = 0 (mod pk), M +1 < x < M + N
does not exceed
( )
for any N 6 N and M 6 Z+, where C(a, p) is an effective constant depending on p
and the sequence a only.
The proof goes along the same lines as that of the Skolem-Mahler-Lech The-
Theorem in Section 2.1 with one new ingredient — an upper bound for the number
of solutions of polynomial congruences. Such a bound was obtained in [1040] and
is of independent interest. No doubt, other results about polynomial congruences
from [624], [625], [630] and [1199] could be used here as well. Theorem 5.11 is a
generalization, and Theorem 5.12 is an improvement of the bound for R(M, N, q)
found in [100].
Analogously, the number of solutions of the congruence F(x) = 0 (mod pk),
M + 1 < x < M + N for an exponential polynomial of the form B.14) is estimated
in [1040]. The next result is a polynomial ring analogue of the corresponding result
of [1186], which was obtained in [1041].

5.4. BOUNDS FOR THE NUMBER OF SOLUTIONS OF CONGRUENCES 89
Theorem 5.13. LetlZ = F[X\,... ,Xr] be the ring of polynomials inr variables
over afieldF. Assume that the irreducible polynomial n 6 It is co-prime to infinitely
many elements of a non-degenerate linear recurrence sequence a of order n over It
with a square-free characteristic polynomial. Then, for any power $ = irk of n, the
number of solutions of the congruence a(x) = 0 (mod ty), M + I < x < M + N
does not exceed
for any JV GN and M 6 Z+ for some effective constant C(a) depending on the
sequence a only.
In this result no restriction is placed on the ground field F. In the special case
F = Q, an analogue of Theorem 5.11 holds as well [1041].
Theorem 5.14. Let It denote Q[Xi,... ,Xr], the ring of polynomials in r
variables over Q. Assume that the polynomial ty 6 It is co-prime to infinitely
many elements of a non-degenerate linear recurrence sequence a of order n over It
with a square-free characteristic polynomial. Then the number of solutions of the
congruence a(x) = 0 (mod ty),M + l<x<M + N does not exceed
C(a)(iV/deg* + l)
for any N 6 N and M 6 Z+, where C(a) is an effective constant depending on the
sequence a only.
The next result shows that non-linear recurrence sequences satisfying first order
equations can be treated by elementary arguments. Consider the class of sequences
satisfying the equation
E.17) a{x + l)=Fx(a{x)), xeN
where for every x 6 N, FX(X) = F(x, X) 6 Z[X] is a polynomial which is monotonic
and positive for X > 0.
Theorem 5.15. Let a satisfy the equation E.17) with a(l) 6 Z+. Assume that
for every x 6 Z+ the polynomial F(x,X) 6 1\X] is monotonically increasing and
positive on Z+. Denote by Hx and Dx the height and the degree of FX(X). Then
the number of solutions of the congruence a(x) = 0 (mod q), 1 < x < N does not
exceed
(N\ogLN \
C[a) : hi,
where
= max Dx LogHx + 1
Kx<N
and C(a) is an effective constant depending on the sequence a only.
PROOF. First notice that
a{y) = A(y,x) (mod a(x)),
where A is defined by A(x,x) = 0, and A(y +l,x) = Fy (A(y,x)) for y > x. To
prove this, it is enough to recall that polynomials over Z[X] preserve congruences.
Therefore
a{x +1)=FX (a(x)) = Fx {A(x, x)) = A{x + 1, x) (mod a{x)),
a{x + 2) = Fx+1 {a{x + 1)) = Fx+1 {A{x + l,x)) = A{x + 2, x) (mod a(x))

90 5. CHARACTER SUMS AND SOLUTIONS OF CONGRUENCES
and so on.
If there are Q solutions of the congruence
a(x) = 0 {modq),l<x<N,
then there are M + 1 < x < y < M + N with y - x < N/Q and a(y) = a.(x) = 0
(mod q). Thus
Q\A{y,x).
On the other hand,
0 < A{y,x) < Ny^Hy N
a calculation gives the bound
It follows that q < exp \0{L^J )J, so Log log qj log L n < N/Q and the bound
follows. ?
In particular, if F(x, X) — F(X) does not depend on the first variable then we
obtain Q {N, q) <C N/ Log log q + 1.
Similar arguments work for sequences of the form
E.18) a{x + 2) = fxa{x + l) + a{x), - x>3
also. The most interesting example of such a sequence is the sequence of denomi-
denominators of convergents of a continued fraction.
Theorem 5.16. Let a satisfy the equation E.18) with a(l),aB) 6 Z+ having
gcd (a(l),aB)) = 1, and let fx 6 N for all x G N. Then the number of solutions of
the congruence a(x) = 0 (mod q), 1 < x < N does not exceed
where C is an effective absolute constant.
PROOF. First notice that gcd (a(l),aB)) = 1 implies that
gcd(a(x),a(x + l)) = 1, x 6 N.
By E.18), for y > x + 2 there are integers A and B < (/x+i + 1)... (/y_2 + 1) with
a(y) = Aa(x + 1) + Ba(x) (an empty product is as usual defined to be 1). It follows
that
gcd (a(y),a(x)) < (fx+1 + 1)... (/y_2 + 1).
If Xi,... ,xt are all divisible by q then Xj > Xj_i + 2, so
T-l JV-2 JV-2
and the bound follows. ?
This result is most useful if a^ is not too large. For example, if the coefficients
are bounded by an absolute constant or if they are bounded 'on average' in the
sense that
E.19) limsup[TT/x ) <oo,
x=l

5.4. BOUNDS FOR THE NUMBER OF SOLUTIONS OF CONGRUENCES 91
in which case T(N,q) <*JV/log<? + 1. It is well-known that E.19) holds for the
convergents of the continued fraction expansion of almost every a G IR. Function
field versions of Theorems 5.15 and 5.16 can also be obtained (see [1041]).

CHAPTER 6
Arithmetic Structure of Recurrence Sequences
The simplest sort of questions about the arithmetic properties of linear recur-
recurrence sequences may turn out to be surprisingly deep: A simple example is to ask
how many terms of a given recurrence are prime. In this chapter the heuristic view
of this problem is described before we describe the deep results that have been
obtained on estimates for the size of the largest prime divisor of the terms of a
linear recurrence sequence. More refined results for special cases are given. The
problem of primitive primes and Zsigmondy's theorem are discussed, along with
deep results on primitive divisors for other sequences. The density of primes di-
dividing a linear recurrence sequence is defined, and recent work on computing this
is described. Estimates for arithmetic functions on linear recurrence sequences are
described, and finally the problem of pure power appearance in linear recurrence
sequences is discussed.
Most of the results in this chapter are stated for integer linear recurrence se-
sequences, though many of them can be transferred to algebraic sequences without
difficulty.
6.1. Prime Values of Linear Recurrence Sequences
It seems plausible that a linear recurrence sequence will contain infinitely many
prime terms after taking account of any generic divisibility. For example, odd terms
of Lehmer-Pierce sequences associated to reciprocal polynomials (cf. page 180) are
all squares, and have all terms divisible by the first. The result of [111] characterizes
precisely when there will be generic divisibility (cf. Section 4.1). Another kind of
generic divisibility can occur as evidenced by the sequence Dn — 1): For n > 1, the
terms will have non-trivial factors. Essentially the same kind of argument explains
Ribenboim's example in [1067, p. 64]: He points out that the Lucasian sequence
0,1,3,8, 21, 55,... (the even terms or bisection of the Fibonacci sequence) has only
one prime term.
For any sequence a, denote by Pa(N) the number of x < N for which a(x) G P.
It is widely believed Pa(N) —> oo unless there is generic divisibility. There seems
little hope of proving a lower bound for Pa(N), even for special sequences like
a+(x) = 2X + 1 and a_(x) = 2X — 1. It is well-known that a+(x) can only take
prime values for x = 2h, so Pa+(N) < log AT. The second sequence can only take
on prime values for x = p G P, so Pa_(N) = O(N/logN). The primes of the
form 22 + 1 are the Fermat primes, and the primes of the form Mp = 2P — 1
are the Mersenne primes. The upper bounds of Pa± (N) are unsatisfactory since
they arise for trivial reasons and are not matched by reasonable lower bounds: In
particular, it is not known if there are infinitely many Fermat or Mersenne primes.
See Section 6.1.1 below for a discussion about the likely shape of Pa(N) when a is
93

94 6. ARITHMETIC STRUCTURE OF RECURRENCE SEQUENCES
the Mersenne sequence. A similar discussion should hold for any linear recurrence
sequence which has no generic divisibility. A compendium of arithmetic properties
and applications of Fermat numbers is given in [643].
The references of [499, Sect. A3. B20, B21] (see also [675]) give relations
between questions of prime appearance of this sort and certain deep problems of
Diophantine analysis. Very few non-trivial results are known. Among them are the
following estimates of Hooley [543, Chap. 7, Theorem 8, 9]. The first result is a
conditional bound Pa{N) = o(N) for a(x) = 2X + b with |6| > 1 odd (under the
Generalized Riemann Hypothesis and some other conjecture about prime numbers
having a given ^-power residue — a kind of Artin conjecture). The same arguments
should work for more general sequences a(x) = ax + b.
The second result is an unconditional estimate Pa(N) = o(N) for the ternary
recurrence sequence of Cullen numbers a(x) = x2x + 1 (see [269], [270], [499,
Sect. B20], [583]). Again, the arguments can be extended to other sequences like
a(x) = 2x + x2, and maybe to other linear recurrence sequences whose characteristic
polynomial is not square-free.
The only known general result is N — Pa(N) —> oo, which shows that any such
sequence contains infinitely many composite numbers. We are not aware of any
explicit lower bounds for N — Pa(N) (though doubtlessly they can be obtained).
Instead, several authors obtained lower bounds for v (a(x)) (cf. page vii) which
show that the terms of a linear recurrence sequences are highly composite numbers
infinitely often.
Erdos and Odlyzko [355] show that for a set of a e N with density in @,0.5)
all numbers of the form a2x + 1 are composite. The smallest element of this set is
not yet known, though it is thought to be a = 78557 (this element is definitely in
the set, but there are 35 other candidates for being the smallest element between'
4847 and 74269; see [499, Sect. B21]). Several more results of the same spirit are
given in [227], [228].
It seems very likely that Pa{N) is uniformly bounded when a denotes an el-
elliptic divisibility sequence. Surprisingly, proofs in special cases are known, see
Section 10.5.
Finally, it seems likely that higher-dimensional sequences such as 2n3m ± 1
should contain infinitely many prime terms. The number of such primes with
\n\, \m\ < X can be predicted, using the appropriate analogues of Wagstaff's heuris-
heuristics (see Section 6.1.1 to follow) to be approximately C±X for constants C±. A
full discussion is contained in [368] which also contains details of numerical exper-
experiments. A fully satisfactory explanation of the data has yet to emerge.
6.1.1. Mersenne heuristics. Wagstaff gave a heuristic argument for the ap-
appearance of primes in the Mersenne sequence in [1322]. Roughly speaking, the
Prime Number Theorem implies that the probability a large integer N is prime
is 1/logiV. The Euler-Fermat theorem implies that if n is prime, then any prime
divisor q of 2n — 1 is forced to be greater than 2n. Thus, the probability that 2n — 1
is prime needs to be adjusted by Euler factors for primes less than 2n, leading to
the heuristic estimate of
prime n<x g<2n
-1

6.2. PRIME DIVISORS OF RECURRENCE SEQUENCES 95
Mersenne primes 2n — 1 with n < x. Using Merten's Theorem, the expression
in F.1) is asymptotically plogz where p = e7/log2, 7 denoting Euler's constant.
This rough argument actually does fit the data, although it should be added that
only 39 Mersenne primes are known. On the other hand, this kind of argument
can be extended to provide a reasonably satisfactory explanation (see [332]) of
prime appearance in the Lehmer-Pierce sequences (cf. page 180) which generalize
the Mersenne sequence. The Lehmer-Pierce sequences provide much more data
against which to compare the heuristic argument, because they may be chosen
with small growth rate.
Clearly, the growth rate of the underlying sequence plays a key role in the
argument. Hardy and Wright [516, footnote to p. 15] argued somewhat earlier that
this kind of reasoning gives a heuristic explanation for the conjectured finiteness
of the number of primes in the Fermat sequence a(n) = 22 +1. Once again, the
large growth rate of this sequence means a paucity of data against which to test
such hypotheses.
6.1.2. Other sequences. Extensive calculations have been made for many of
the classical sequences. For example, Dubner and Keller [312] found all (probable)
primes in the Fibonacci sequence with index up to 105. It is now easy to check
their results: The largest known prime in the Fibonacci sequence a is /(81839).
In other directions, there are many striking observations for specific recurrence
sequences. For example, Somos has pointed out that the eventually increasing
sequence 1,1,1,1,1,1,1, 2, 3,4,6,12, 24, 72,144.288,864, 3456,... satisfying the re-
relation
a(n) = (a(n - l)a(n - 6) + a(n - 3)a(n - 4))/a(n - 7)
for all n has the property that a(n) is always of the form 2a36.
6.2. Prime Divisors of Recurrence Sequences
For a linear recurrence sequence a(x), proving primality for infinitely many x
seems intractable so it makes sense to try to obtain weaker results. We will consider
estimates for P (a(x)) (cf. page vii). Various results concerning these and other
arithmetic functions on linear recurrence sequences will be described.
Define ¦ .
A/+/V ¦
u{M,N)= Yl \a(x)\, u>(N)=u@,N).
In 1934, Gelfond [432] proved that u>(N) —> 00 under some conditions on the
sequence. For a wider class of sequences this is done in [1331] (for binary sequences)
and in [691] (for sequences of any order); see also [816] and [1009]. Also in 1934,
Mahler [769] proved that P (a(x)) —> 00 for binary non-degenerate sequences. His
proof is based on Roth's Theorem and is therefore non-effective (see also [770]).
In 1984, [376] and [1023] show that general results about sums of 5-units [376]
and [1037] imply that for any integer non-degenerate linear recurrence sequence a,
F.2) P(a(x))-*oo, x->oc.
Indeed, more is true:
F.3) P (a(x)/a(y)) -> 00, x -* 00, x > y. a(y) # 0.

96 6. ARITHMETIC STRUCTURE OF RECURRENCE SEQUENCES
In fact, for any prime p
ordp a(x) = o(x), x —> oo.
The disadvantage of these results is that they are completely non-effective and
so do not provide any explicit lower bounds. Such bounds are still unknown in
general, but for special classes of sequences an effective lower bound of the form
P (a(x)) > C(a) log x with some positive constant C(a) was obtained in [1186].
This bound holds for sequences having only one dominating characteristic root
|a:i| > |a2| > ••• > \onm\ and such that a(x) ^ A\(x)ax. The bound can be
rewritten in the form P (a(x)) 3> Log Log |a(x)|, which looks exactly like the best
known lower bound for the greatest prime divisor of values of integral polynomials
(see [1233]).
More recently, Stewart [1245] showed that one can take C(a) = 1 — e provided
x is large enough, and that in this case Q (a(x)) > xl~?. These results were derived
from the following general statement [1245, Theorem 4]).
Theorem 6.1. Let K denote an algebraic number field, a?l with \a\ > 1 and
f G K[x}. Let u denote a sequence of integers of the form u(x) = f{x)ax + v(x)
where \v(x)\ < la^1"^* for some 5 > 0. If f(x)v(x) # 0 then
P{u{x))> (l-e)logx, Q{u{x))>xl~?
forx > xo(a,S,e,f,K).
Proof. The proof relies on bounds for linear forms in logarithms. If \u(x)\ =
p\l .. .p?r is the prime factorization of |w(x)|, then
0<
=O(a~d*).
Comparing this inequality with inequalities for linear forms in logarithms gives the
result. ?
In addition to linear recurrence sequences of the above mentioned special kind,
this result is applicable to sequences of the form (\dax J) with non-zero real algebraic
numbers ¦$, a such that |a| > 1, where it shows that
P([Xax\) > (l-e)logz, Q([\ax\) >xl~s
for x large enough.
¦ For a non-degenerate linear recurrence sequence we can estimate u>(M, N); the
best estimate is given in [1192].
Theorem 6.2. For any integer non-degenerate linear recurrence sequence a
with at least two different characteristic roots,
u(M, N) > C(a) min{JV, (M + N)f log N)
with some effective constant C(a) > 0 depending on the sequence a.
Note that improved lower bounds are possible when there is a 'Zsigmomdy'
Theorem available, see Section 6.3 below.
PROOF. Without loss of generality we may assume that there is no prime number
dividing all terms of the sequence and that a(x) ^ 0. For a prime p let
kv = max ordD a(x).
F M + l<x<M+N

6.2. PRIME DIVISORS OF RECURRENCE SEQUENCES 97
Theorem 5.11 shows that
The bound
(M+N
Y[ \a(x)\\ > N(M + N)
x=M+l
gives the result. ?
This is an improvement of results from [100] and [1186] which use the same
scheme but rely on weaker estimates for the number of solutions of congruences
with linear recurrence sequences. Of course, Theorem 6.2 implies a lower bound
for the greatest prime divisor, and the product of all prime divisors, of the product
considered.
Surprisingly, much more is known about u(M, N) for linear recurrence se-
sequences than is known about the analogous quantity for polynomials (see [1233]).
Indeed, since u(M, N) < N(M + N)/ log(M + N) the bounds
N/ log N < uj(M, N) « N2/ log N
are clear for linear recurrence sequences. Such tight lower and upper bounds for
the same question for polynomials are beyond current methods.
The following result is proved in [1192] under an addition condition on the
growth of the sequence. Notice that Theorem 2.6 shows that this requirement can
be dropped.
Theorem 6.3. Lete(x) be any function withe(x) = o(l). Then, for any integer
non-degenerate linear recurrence sequence a with at least two different characteristic
roots,
P(a(x)) > e(x)x
for almost all x G N.
The proof is a modification of the proof of Theorem 6.2. Instead of the product
of all consecutive terms, the product of those terms with P (a(x)) < i{j(x), x < N
is considered.
For a finite set of primes {pi,... ,pr] define the set
S = {pkll...pkr<- : kl)...,kreZ+}.
Now let A(S, M, N) denote the number of 5-units among a(M + 1),... , a(M + N),
that is the number of solutions of the equation
a(x) = s, x e N, s e S.
It is clear that A(S,M,N) is bounded for sequences covered by Theorem 6.1.
Kiss [588], [589] uses the same approach to prove the finiteness of number of so-
solutions of the equation Siai(x) = $2^2B/), x, y G N, st,S2 65 with two sequences
of the same type as well as of the equation a(x) = suv, x,u,v G N, 5 G S (with
v>C(a,S)) (cf. Section 2.1).
It is shown in [742] that A(S,0,N) = o(N) for any non-degenerate linear
recurrence sequence with at least two different characteristic roots. This estimate

98 6. ARITHMETIC STRUCTURE OF RECURRENCE SEQUENCES
is improved in [1197] to A(S,0,N) < C(a)rlog2 N and
Shapiro and Sparer [1161], among many other interesting results, show that
limsupf(a(x)) = oo.
x—>oo
For sequences with a(l) = 0 this is improved in [1190] to
limsup^(a(x))loglogx/logx > 0.
X—>OO
The approach of [1161] can produce an effective lower bound as well, but this
bound would be extremely weak.
The results above hold for sequences of any order n > 2. For binary sequences
more is known — the survey [1248] contains much of what is described below. In
particular, for binary sequences effective versions of F.2), F.3) are known. The
first quantitative result was obtained in 1967 (after the discovery of effective bounds
for linear forms in two logarithms) by Schinzel [1114] who proved that P (a(x)) »
xCl log02 n with absolute constants ci,C2 > 0. Shorey and Stewart, in the series of
papers [1168], [1170], [1171], [1178], [1243], [1244], [1245], combine joadic and
Archimedean estimates of linear forms with subtle sieve techniques to obtain better
values for the constants as well as many other results, some of which are presented
here.
Shorey "[1170], [1171], improving and generalizing several previous results,
shows that
/ X \1/(d+1)
P(a(x)/a(y))»(^—J and logQ (a(x)/a(y)) »
for x > y > C(a) where d is the degree of the splitting field of the characteristic
polynomial f(X) = X2-flX-f0 6 Z[X]. Yu and Hu [1369] use a better bound for
linear forms in p-adic logarithms to generalize this result to sequences of arbitrary
algebraic number fields, and eliminate the logarithm in the lower bound for the
largest prime divisor.
In [894] it is shown that the abc conjecture implies several stronger bounds on
prime divisors of Lucas and Lehmer numbers.
Luca [750] considers those ratios a(x)/a(y) which are 5-units with respect
to some fixed set of primes, where a is a binary linear recurrence sequence. In
particular, he shows, under some non-degeneracy conditions, that in such a case
x > "cy1 /logy for some constant c > 0-(depending on the sequence and on the set
of primes); see also [753].
Bugeaud, Corvaja and Zannier [180] prove that if integers a and b are multi-
plicatively independent, then for any e > 0 and sufficiently large n
gcd (an - 1, bn - 1) < exp(en).
In [753] the method of [180] is extended to estimate the greatest common divisor
of distinct terms of a general binary linear recurrence sequence. In [752] a similar
result is obtained for terms of linear recurrence sequences of higher orders whose
characteristic polynomial has only two distinct integer roots. Finally, in [418] it is
extended to higher order linear recurrence sequences whose characteristic polyno-
polynomial has distinct positive roots.

6.2. PRIME DIVISORS OF RECURRENCE SEQUENCES 99
It is remarkable that the method of [180] has led Corvaja and Zannier [265]
and Hernandes and Luca [532] to a proof of a conjecture of Gyory, Sarkozy and
Stewart on the greatest prime divisor of the product (ab + l)(ac + l)(bc +1). In
fact, in [265] this conjecture is proved in a stronger form and in [532] in a more
general form.
Stewart [1245] also shows that for binary sequences Theorem 6.3 can be sharp-
sharpened to P (a(x)) > e(x)xlogx for almost all x 6 N.
The following estimate is a weaker version of several results of Shorey [1168].
Theorem 6.4. Let a denote a binary integer non-degenerate linear recurrence
sequence with gcd(/o,/i) = 1. Then
\xM+i ) >> {iVlogiVLoglogiV/LogloglogiV, if N < Ml~?.
Another relevant result from [1168] is the following.
Theorem 6.5. Let a denote a binary integer non-degenerate linear recurrence
sequence, and denote by g(N) the largest positive g such that there are g pairwise
distinct primes pj with pj a(N + j), j = 1,... , g. //gcd(/o, f\)=l then g(N) »
For the Lucas sequences of the form ?~(x) = (of — a^/i^x —&2) and l+(x) =
ol\ + af further improvements can be obtained. It makes sense to remove trivial
factors and consider the related sequences -
(af -af )/(ai -a2), if a-is odd;
(af — <X2)/(a\ — al), if x is even;
and
+ _ J (af + 0.2)I[a\ + a2)) if x is odd;
1 a\ + a.% if x is even;
which are called Lehmev numbers. Gyory [500], refining some of the previous
paper [504], proves that
F.4) P{L-)>\{\og\ogL-)^
whenever \L~\ > expexpexp 1643. This bound is asymptotically worse than other
known bounds for general binary sequences, but is remarkable in that all the con-
constants involved are absolute. It immediately implies new results about the arith-
arithmetic structure of numbers of the shape (ux — vx)/(u — v) where u and v are integer
variables.
Lucas numbers factorize further as a product of cyclotomic polynomials. If
then ipx is an integer with the property that <px Lx and <p2X L+ (for x > 2).
This reduces the problem to that of prime divisors of cyclotomic polynomials, an
interesting one in its own right.

100 6. ARITHMETIC STRUCTURE OF RECURRENCE SEQUENCES
For the case of real 01,0:2 in [1243], and for arbitrary 01,02 in [1178], the
following estimates are obtained. For any S < log e = 1.442...,
P(<px) > C(a1)a2,5J-^^(x)\ogx
for all x G N with v(x) < 5 In In x and
P(<Px) > e(x)x log2 x/ log log x
for almost all x G N. In this connection, recall that u(x) ~ lnlnx for almost all x,
but is as large as log x for some x. In particular,
P(ipp) > plogp and P(w) > h2h,
giving lower bounds for Mersenne and Fermat numbers Mp = 2P - 1, F^ = 22 + 1.
Erdos and Shorey [356] prove that the estimate
P(Mp)>e(p)] , Pl^f ,
loglogplogloglogp
holds for almost all p G P.
It was shown in [1243] that the approach of [356] is applicable to many other
sequences. In particular, the following estimates have been obtained
P(hh + 1) > hlogh,
h2bh)
log log h
¦P(ah2-bh) » <p(h)bgh,
where a > b > 1 are integers.
Stewart, in [1247], provides lower bounds for Q(<px), and thus for Q(L^). He
proves the inequality
log Q(<px) > 2~^x) log2 x/ log log x
which immediately gives
{2"'/Wr(x)log2x/loglogx, forallxGN;
(logxJ+ln2-?, . for almost all x G N;
x(in2-e)/iogiogx) for infinitely many x G N.
Similar results hold for L+ as well. Applying the first estimate to Mersenne and
Fermat numbers gives
log Q{MP) > log2 pi log log p, logQ(Fh) > h2/\ogh.
Comparing the second inequality with the bound
logQB2'l-l)>/l3/log/i,
shows that although the sequences L~ and L+ are quite closely related and can be
treated by using the same methods, they differ in their arithmetic.
Kiss [590], proves that for any S > 0,
l -O2.
for a set of primes of positive density (this is a consequence of his more general
result on primitive divisors presented in Section 6.3).

6.2. PRIME DIVISORS OF RECURRENCE SEQUENCES 101
The method of proof of Theorem 6.2 can be applied to any. sequence provided
its growth rate and a non-trivial upper bound for the number of solutions of the
congruence with this sequence are known. In particular, sequences E.17), E.18)
can be included in this scheme; see [1192, Theorems 4, 5, 6].
For example, if in the notation of Theorem 5.15 we additionally have the lower
bound
a(x) >
with some constant c > 0, then
F.5) ,(aA)...
Indeed, it follows from the proof of Theorem 5.15 that
gcd (a(x),a(y)) < A(y,x) = exp (
Put M = [N/2\, and let r denote the number of distinct prime divisors of the
product a(M + 1)... a(N). There are x, y, M + 1 > x < y < N with y — x < r
and gcd(a(x),a(y)) > min (a(zI/V, a(yI/V). Therefore
F.6) exp (O(LrN)) > gcd (a(x),a(y)) > min (a(x)l/r,a(v)l/r)
and F.5) follows. In particular, if the polynomials FX(X) in E.17) are of bounded
degree and height for all x G Z+ (for example, if they do not depend on x), then
F.7)
Applying Theorem 5.16 to the sequence (qx) of the denominators of convergents of
the continued fraction of some irrational a G 1R gives
v{qi -..qN) >N2/logqNlog\ogqN.
Thus v(q\ ... q^) > N/\ogN for almost all a. It can also be shown (see [1192,
Theorem 5]) that for almost all oGl, P{qx) > ^{x)logqx for almost all x G N.
This estimate holds for a with bounded partial quotients (and thus for all quadratic
irrationalities). Shifted products qM+i ¦ ¦ -qM+N can be treated analogously. This
is an improvement on the previous double logarithmic estimate of Shorey [1169].
On the other hand, the papers [1169] and [1177] give many other interesting
results about the arithmetic structure of such convergents. For example, Shorey
and Srinivasan in [1177] prove that for almost all positive a,
F.8) Q{qx)>qx{logqxyl-e. •
It is interesting to compare this estimate with an old result due to Erdos and
Mahler [353], who prove that
for almost a. Another result of [1177] says that, for almost all positive a, Q(qx) =
Q(qy) for only finitely many x < y.
For sequences over function fields several similar results are given in [1041].
They are based on Theorems 5.13, 5.14 and other similar estimates. These gen-
generalizations are not straightforward as many new effects appear in this case. In

102 6. ARITHMETIC STRUCTURE OF RECURRENCE SEQUENCES
particular, the results depend on the characteristic of the field of constant and on
the dimension of the function field.
The papers [98] and [102] provide several results about the arithmetic struc-
structure of linear recurrence sequences over fields of zero and positive characteristic,
respectively. In particular, if G is a finitely generated group containing all elements
of a linear recurrence sequence a over a field of positive characteristic, then there
exist an integer k and elements hi,yi G G, such that a(kx + i) = hig%, ? = 1,... ,k.
For g-recurrence sequences of the form A.8) this is done in [105]. An analogous
result for sequences satisfying the equation u(x + 1) = F(u(x)) + a(x) where a
is a linear recurrence sequence is given in [101]. These papers are based on Sze-
meredi's theorem and bounds for 5-unit sums. Because of this no explicit bound
for the analogue of the function A(S, N) is obtained. Interesting results about non-
nonlinear recurrence sequences are also given in [973], [974] (see also [42]) which will
be considered in Section 6.3.
Several interesting results on prime divisors of expressions of the form [/la2]
with real algebraic a are given by Shapiro and Sparer in [1161]. In particular, if a
is an irrational Salem-number, then
lim sup v ([ax\) = oo.
More general expressions of the form [^(.i^a^J with functions A(x) satisfying cer-
certain technical conditions are also studied. Examples of sequences satisfying these
conditions from [1161] include
[2nVj , [22VJ , [n!anj .
Each of these sequences has infinitely many prime divisors (no effective lower bounds
are given in [1161]). On the other hand, the sequence [2n!anJ does not satisfy these
conditions.
In the same paper, Shapiro and Sparer consider prime divisors of sequences
which can be obtained as compositions of exponential polynomials A.6) and se-
sequences that are close to polynomial, like ly^i^a H ^ -^n^Zl w^h real positive
7i,... ,7n, Studying the latter sequences relies on a certain.result on uniform dis-
distribution of fractional parts of such sequences. This approach also works on another
example which is more relevant to-this section.
The notion of numbers normal to the base g will be described in Section 8.1.
Theorem 6.6. Assum,e that tf is normal to the base g > 2. Then
lim sup v (\Qgx\) = oo.
X—>OC
Proof. It is proved in [793] that if i) is normal to the base g, then so is rd for
any rational r ^ 0. Let M denote the product of the first s primes. Since M~lrd
is normal to the base g, the fractional parts {M~lrdgx} are uniformly distributed
modulo 1, so {M-l\fgh} < I/A/ for some h. Thus
M [M-ltigh\ < dgh < M([M~l^gh\ + {M^}) < M
so [dgh\ = M [M~1'dgh\ and v([tigh\) > s. D
The method can be applied to many other sequences as well.
Forman and Shapiro [401] prove that there are infinitely many composite num-
numbers in either of sequences LC/2)XJ and LD/3)XJ. Their method does not seem to

6.3. PRIMITIVE DIVISORS AND THE INDEX OF ENTRY 103
extend to general exponential'functions. Nevertheless, several improvements and
generalizations of their results have been obtained by Myerson [898].
Luca [751] studies the occurrences of a certain generalization of perfect numbers
among the terms of Lucas sequences.
The state of knowledge about the arithmetic structure of other generalizations
of linear recurrence sequences is rather poor. One of very few general results is
Eisenstein's Theorem about the coefficients of rational functions. This claims that
if
h=0
is a formal power series satisfying the equation F(X,f(X)) = 0 with F(X,Y) E
li[X, Y], then there are natural numbers L and M such that LMxa(x) is an algebraic
integer for any x E N, see [1009] and [214, Th. 5.1]. In this form the presence of L
is not necessary but it is needed to obtain the following effective result from [321],
improving an earlier estimate of Schmidt [1147].
Theorem 6.7. Let F(X, Y) E Z[X, Y] be of degree m in the variable X, of
degree n in the variable Y. and have coefficients bounded by H. Then Eisenstein'a
Theorem holds with
M<c(n)((l + m)HJn~1, L<HMm
where
c{n) = expA.0012n2 + 1.0012n3/2 + 3n4/3 + \n log2 n + 3n logn + \ log n + 2).
This exotic expression for c(n) comes from explicit estimates of some functions
on prime numbers. Schmidt conjectures that the same result holds with c(n) =
exp@(nlogn)) (see also [1030]).
Fraenkel, Porta and Stolarsky study some arithmetic properties of sequences
satisfying the equation a(x + 1) = sa(x) +1 [¦da(x)\, where t and s are integer and
i9 is a quadratic irrationality.
6.3. Primitive Divisors and the Index of Entry
Although proving theorems about prime appearance in recurrence sequences
seems hopeless, weaker results can have many useful applications. This is amply
demonstrated by the next result, the famous Zsigmondy Theorem. For m E N,
define the index of entry Im = Im(a) in an integer linear recurrence sequence a to
be the smallest x with m a(x) if such an index x exists, and put Im = oc otherwise.
This function is closely related to another notion. A prime p is called a primitive
divisor of a(x) if x — Ip. The same definition makes sense for algebraic sequences
and prime ideals.
Theorem 6.8. Consider the sequence a(x) = cx — dx, where c > d are positive
co-prime integers. Then a(x) always has a primitive divisor unless (i) c = 2, d = 1
and x = 6 or (ii) c + d = 2fc and x = 2.
This theorem was originally proved by Zsigmondy in [1382]. The result is very
useful in finite group theory, see [387], [1050]. A modern proof of Zsigmondy's
Theorem was given in [1088], which also shows how Wedderburn's classical result
about finite division rings follows easily from Zsigmondy's Theorem. Notice that

104 6. ARITHMETIC STRUCTURE OF RECURRENCE SEQUENCES
whenever a 'Zsigmondy' Theorem holds for a sequence, a stronger form of Theo-
Theorem 6.2 is possible. For the sequence a in Theorem 6.8, with u(N) defined as in
Section 6.2, the lower bound
F.10)
holds, for all sufficiently large N.
A weaker form of Zsigmondy's Theorem is extended to algebraic number fields
in [1047], [1115] and [1118] (weaker means that the exceptional cases are not
described explicitly). Transcendence methods allow a much better analysis for
certain sequences. In [500], [1244], [1316], [1317] and [1318], a successively better
understanding of primitive divisors for Lucas and Lehmer sequences is obtained.
Finally, in [116] the authors show the amazing result that for n > 30, the n-
th term of any Lucas or Lehmer sequence has a primitive divisor. The methods
use not only state of the art transcendence methods but also modern methods
in computational number theory (including a machine-year of computing time).
Schinzel's paper [1118] gives the following generalization. Under a non-degeneracy
condition, there exists an effective constant c(d, e) > 0 such that for
x>c(d,e){LogkI+?
there is a prime ideal of K that divides a\ — ^af, where ?& is a primitive k-th. root
of unity, and does not divide a\ — ^c^l with any y < x and arbitrary j. Here a.\
and a.2 are co-prime elements of Zr, and a.\/oL2 is not a root of unity.
In [590], Kiss deals with primitive power divisors of Lucas sequences; these are
numbers of the form pk\ with p a primitive divisor of a(x) and k = ordpa(:r). He
shows that for any 1 > <5 > 0 the density.DE) of x for which ?~{x) has a primitive
divisor greater then x2~5 is at least DE) > 1.5<57r~2. Several more relevant results
are given in [593].
Jarden and Jarden [555] show that for certain binary linear recurrence se-
sequences there are infinitely many composite primitive divisors (divisors of the nth
term that do not divide any earlier term); in the Lucas case Jarden [554] shows
that for any prime p > 5 the 5pth term has at least two distinct primitive prime
divisors.
If Im < oc then it cannot exceed the restricted period so Im < (mn —l)/(m—1).
For binary and ternary sequences, Ipk is studied for prime powers pk in detail by
Ward [1331], [1332], [1333] and Kurtz [660]. They show that, loosely speaking,
an analogue of Theorem 3.3 holds for Ipk as well (although some complications
arise).
Many of the results below hold for any integer m > 2, nevertheless from now
on we consider the case m = p eP only.
For n = 2 the inequality Ip < p + 1 is essentially the best possible. However,
if an integer binary sequence a(x) = Aia* + v^af an<^ ^s ^ua^ se(luence a,'(x) =
A2OC1 + A\a.2 do not contain any zeros, then the estimate can be improved to
IP <P~C{a)logp
provided Ip < 00 (this is a re-formulation of [1245, Theorem 2, Part 2]).
For Lucas sequences several results about the index of entry have been given
in [879], [882].
For n > 3 better estimates can be obtained. For instance, Theorem 7.1 gives
Ip = O{pn/2+l logt) where t is the period of the sequence a modulo p. For sequences

6.3. PRIMITIVE DIVISORS AND THE INDEX OF ENTRY 105
with characteristic polynomial irreducible modulo p, Theorem 7.2 shows that Ip =
O(pn/2\ogt). Apparently, one can get rid of the logarithmic terms. Several other
relevant results in the more general context of the distribution of values of sequences
over finite fields are presented in Section 7.1.
For elliptic divisibility sequences A.10), Ward shows that Ip < Ip + 1 [1330]
and that the behaviour of Ipk is described by an analogue of Theorem 3.3 (with t^
replaced with Ipk) [1329].
In [99], Bezivin considers the following problem. Given a polynomial / E Z[X],
describe the set of prime numbers p which divide at least one element of any se-
sequence from ?(/). He shows that this questions is related to cyclic difference sets
and gives several necessary and sufficient conditions on such primes. An impor-
important parameter is the order h(p) of the group generated by all pairwise ratios of
characteristic roots (if / is square-free modulo p this is the restricted period of all
sequences from ?*(/)). If / is irreducible modulo p, then h(p) | (pn — l)/(p — 1).
Indeed, for any two roots a and C of /,
{a/C){pn-l)/{p~l) = N(a//?) = N(a)/N(/?) = 1.
It follows from Theorem 7.2 that if / is irreducible and h(p) > Cpn^2 for some
prime p, then p satisfies the above divisibility property; more precisely
would suffice, see [99, Theorem 3].
For binary sequences, estimates obtained by Kiss [591] give some information
about the size of h(p) on average (see Section 6.4).
For an integer linear recurrence sequence a define
\{p<N : /p<oo}|.
Clearly for many sequences ira(N) = ir(N) + 0A) (for example, for all sequences
containing a zero term). For binary sequences with square-free characteristic having
integer roots the bound ira(N) » (log N/ Log log NI^2 is given by Bezivin [100].
Results on uj(M, N) lead to a general effective lower bounds for 7ro(iV) for sequences
of any order. It is clear that there is a constant c(a) > 0 such that na(N) >
w(|c(a)logJVJ), so
TTo(-W) > log N/ Log log JV
for any sequence satisfying the condition of Theorem 6.2.
Under the Generalized Riemann Hypothesis, Stephens [1241], [1242] gives
asymptotic formulae for Pa(N) for a wide class of binary sequences (showing that
the set of prime divisors of such a sequence has a positive density). He also proves
some unconditional results on average. These results were extended by Moree and
Stevenhagen [849] extended these results and gave the correct formula for the
density.
For special sequences, unconditional results are given by Lagarias [665]. To
formulate his results define the density of divisors (if it exists) by
S(a)= lim 7ro(iV)/7r(iV).
Ar-*oo
Using Tchebotarev's Density Theorem, Lagarias [665] proves that
F.11) S(h) = 17/24,

106 6. ARITHMETIC STRUCTURE OF RECURRENCE SEQUENCES
for the sequences
h(x + 2) = 3h(x + l)-2h(x), h(l) = 3, hB) = 5,
e^x + 2) = e^x + y + e^x), ^A) = 2, ^B) = 1,
?2(x + 2) = 5?2(x + l)-7?2(x), ?2A) = 1, ?2B) = 2.
The choice of these sequences is not random: All of them were discussed earlier in
papers of Hasse, Ward and Laxton. The method of [665] is a refinement of that of
Hasse (who proved the same result for the first sequence h(x) = 2* + l). In the same
paper, Lagarias mentions that Hasse's method gives 6(a) = 2/3 for any sequence
a(x) = gx +1 with a square-free g > 3. To see how Tchebotarev's Density Theorem
comes up in this question, notice that if g is a quadratic non-residue modulo p
then g(p~x)/2 = —1 (mod p), sop divides at. least one term of the sequence gx + 1.
Further, g is a quadratic non-residue modulo p if and only if the polynomial x2 — g
is irreducible modulo p. In [61], Ballot finds the density 6(a) for any sequence of
the form a(x) = gx + gx with gi,g2 ? Z. Particular examples are:
5(8*+ 1)
5((-2)* + l)
5A8'=+ 1)
5B8* + 169'=)
5A6* +81*)
5C24* + 1)
5A6*+ 6561*)
5((-4)* + l)
5((-16)* + l)
5((-144)* + l)
5((-1296)* + l)
= 17/24,
= 17/24,
= 17/24,
= 2/3,
= 1/6,
= 10/24,
= 1/12,
= 2/3,
= 23/24,
= 10/12
= 11/12.
and
For sequences of the form (gx + 1), g G Z, these densities (and other results)
were found earlier by Wiertelak — see [1349], [1343], [1344]. [1345], [1346],
[1347], [1348], [1350], [1351] — and by Odoni [972].
Moree and Stevenhagen [849] later obtained another general result giving the
density S(a) for a(x) = ex + ec, where e is any fundamental unit of a real quadratic
number field (e is the algebraic conjugate of e). The only possible densities obtained
are 2/3, 17/24, 1/3 and 5/12.
Moree [841] obtains better estimates of the error term in the asymptotic for-
formula for -K(l (N). In [838] he obtains the following general result on Lucas sequences
?a satisfying ?a(x + 2) = a?a{x + 1) + la{x) with ?a(l) = 2, ?a{2) = a. The density
of prime divisors is 2/3 unless \a\ = ?2(x) for some even x, in which case the density
is 17/24; see also [850], [851].
In [61], Ballot makes an explicit connection between those special binary recur-
recurrences to which the unconditional method of Hasse applies and the group structure
described in Section 1.1.7: Lagarias [665] had enunciated a set of conditions suffi-
sufficient for Hasse's method to work, and Ballot shows that all recurrences satisfying
these conditions are among the (rare) 'torsion' sequences of that group. For recur-
recurrences of higher order, this group is related in an essential way to the notion of

6.3. PRIMITIVE DIVISORS AND THE INDEX OF ENTRY 107
maximal divisors. A prime p is called a maximal divisor of an integer linear recur-
recurrence sequence a of order n if it divides n — 1 consecutive terms of the sequence.
For a binary recurrence, this is the usual notion of division used to define 7ra(iV).
Introducing further refinements in the method of Hasse, Ballot obtains density re-
results for the set of prime maximal divisors of some higher order 'torsion' sequences.
Writing A(a) for the density of prime maximal divisors of a (where this exists),
some examples are
AE* + 2 • 3X
AC* - 2X+1
- 3 • 5* - 3X+1
A(x-2X
A(l + J
A(ax + CX -\
- !)
-1)
-1)
-1)
p(n))
-/3s)
= 2/7,
= 65/224,
= 2/15,
= 17/24,
= 2/3 and
= 51/104,
where /(n) is the nth Fibonacci number (cf. page 177),
a = 4 + 2 v^ + a/49 and E = 4 + 2e4ni/3 v^
For each of the sequences above (except the third), A (a) is the density of primes
dividing two successive terms of the sequence a. The first three examples are
from [61], while the last three recurrences are from [62], [63] and [64] respectively.
In these three papers Ballot obtains new results extending the theme developed
in [61].
The reduction to Tchebotarev's Density Theorem is based on the following
observation. Assume that / is square-free. If p is sufficiently large then it is a
maximal divisor of a G ?(/) if and only if for some h ? N, all terms a\a^ , ana!^
from the representation A.5) belong to the same residue class modulo the principal
ideal (p) in the ring of integers of the splitting field of /. One further observation
is that equivalent sequences (defined in Section 1.1) have the same density of prime
maximal divisors.
Roskam [1091] studies the density of prime divisors of linear recurrence se-
sequences of arbitrary order under the assumption of Artin's conjecture in number
fields. We have already mentioned this link in Chapter 3.
Somer [1227] deals with the case Aa(iY) = 1. He proves that if the characteris-
characteristic polynomial of a is square-free and the sequence has almost all primes as maximal
divisors, then it can be represented in the form a(x) = mao(x + h) with m,h G Z,
where ao satisfies the same equation with initial values a(l) = • • • = a(n — 1) = 0,
a(n) = 1 (here it is convenient to consider two-sided sequences with index ieZ).
Thus no(iV) = n(N) + 0A) for such sequences. Schinzel [1117] gets the following
generalization of this result.
THEOREM 6.9. Let aij, Pi, i = 1,... , m, j = 1,... , n be elements of an alge-
algebraic number field K. Assume that for at least one k <m the numbers a^i,... , <y.kn
are linearly independent. Then if the system of congruences
n
ij = A (mod p). i = l,...,m,

108 6. ARITHMETIC STRUCTURE OF RECURRENCE SEQUENCES
is solvable for almost all prime ideals p ofK. the system of equations
is solvable in integers.
In a particular case a quantitative form of this result is obtained in [48].
Denote by P2(x) the number of integers n such that n = 2kp (mod p) for all
primes p < x (with some integer positive kp). Then /^(z) < exp(l.000081a;).
The bound is quite sharp because it is shown in the same paper that under the
Generalized Riemann Hypothesis there is an absolute constant C > 0 such that
-?2B) > exp(C:r1//2 log x). It is conjectured that indeed \ogP2ix) ~ Ax/\ogx for
some constant A.
Theorem 6.9 is used by Schinzel [1119] to show that if a\,... , a^ and P\,... ,flk
are non-zero elements of an algebraic number field K such that for almost all prime
ideal p of K and all integers n\,... , rik
then Qj = /3f, i = 1,... , k for some integer e. This result is generalized in [68].
Corrales and Schoof [261] address an elliptic analogue of this question.
Vajaitu and Zaharescu [1296] consider a multidimensional generalization of
Selfridge's problem of characterizing all possible pairs of integers (a, b) such that
2a - 2b\na - nb for all integers n, see [499, Sect. B47].
Tchebotarev's' Density Theorem also lies in the background of the follow-
following surprising results of Odoni. For non-linear recurrence sequences satisfying
a{x + 1) = F(a(x)) with F G Z[X] he proves that, for any e > 0, na{N) = eir(N)
for almost all non-linear monic polynomials F e Z[X], [973], and that ira(N) =
O (Tr(N)/LoglogN) ifa(l) = 2 and F(X) = X2 -X + l, [974]. This case is partic-
particularly interesting as it corresponds to the sequence a(x + l) = l + a(l).. ,a(x) which
shows up in the simplest proof of the existence of infinitely many primes. Odoni
mentions that perhaps the first estimate can be replaced by ira(N) = o(tt(N)),
but this needs some refinements of several results of [973]. These results rely on
results about Galois groups of iterated polynomials; some reference for these are in
Chapter 3.
Moree [840]. [841] shows how to use results of this kind to get an asymptotic
expansion for the number of integer divisors of sequences. For example, denote by
Ga,b(N) the number of positive integers d < N which divide at least one term of
the sequence ax + bx where a and b are co-prime integers with \ab\ > 1. The general
formula is technical; some consequences are that Ga,b(N) <C N/log N for some
S > 0 depending on a and b. For the particular case a = 2, b = 1, and for any
r > 0, there are positive constants Ci,C2 with
This research was motivated by an application to coding theory.

6.4. ARITHMETIC FUNCTIONS ON LINEAR RECURRENCE SEQUENCES 109
6.4. Arithmetic Functions on Linear Recurrence Sequences
Throughout this section it is assumed that a(x) ^ 0 (this is not a serious
restriction since only non-degenerate sequences are considered here).
Consider first sums of the form
n M+N
x=M+l
with i9(fc) depending on the arithmetic structure of k. Many such functions can be
represented in either of the forms , ¦ . ¦
F.12) .
d\k ¦ p\k
with some function ip (the second summation is over the prime divisors of k).
Non-trivial results are available for both ?o(fi, M, N) and ?o(u;, A/, N) only for
a very slowly growing function ¦0. For instance, non-trivial results about- such sums
are not known if fi(fc) is any of the naturally arising functions r(k),a(k) or <p(k),
nor for u(k) = ^(fc). On the other hand such functions as
F.13) ;.
and
F.14)
V K K
p\k
and many others can be handled.
THEOREM 6.10. Let ty denote a function with ip(k) = 0A) and let Q(k) and
uj(k) be given by F.12). Then for an integer non-degenerate linear recurrence se-
sequence a, there are positive constants V and 7 such that
5«(fi, M, N) = T + OiN-1 log(Af + N) + Log log N/ log JV),
and
Sa(u, M,N) = 7 + OiN-1 Loglog(A/ + N) + N-2'^-2n+2)),
Proof. Let the sequence be given by the representation
m rij— 1
a(x) = D~1J2Y/ ai:jxja^ xeN
for algebraic integers D, a^. For simplicity, assume that the algebraic numbers
aijCti, i = 1,... , m, j = 0,... , jh — 1 are all co-prime. Then for any integer d,
Theorem 5.11 gives a bound for R(M, N, d) (in the notation of Theorem 5.11). Let
A{M, N) = a(M + 1)... a{M + N); then
d\A(M,N)
Sa(u,M,N) = i
p\A(M,N)

110 6. ARITHMETIC STRUCTURE OF RECURRENCE SEQUENCES
Just as in Chapter 3, for any integer d there are ?(d) and t(d) wifh ?(d) + t(d) < dn
such that a(x + t(d)) = a(x) (mod d) for x > ?(d). Let p(d) = R{?{d),t{d),d).
From the upper bound on ?(d) and t(d) and the estimate G.2) below,
R(M,N,d,) = p(d)^ + O(dn), R(M,N,p) = p{p)
Thus, for any fixed Q > 1
Sa(tt,M,N) = T + Ai + A2 + A3: 5«(w, M,N) = 7 +
where
®
P
d>Q p>Q,
Since rp(d) = 0A), A2 = 0{N~lQn), S2 = 0{N-lQn/2~l). Turning to the other
error terms, Theorem 5.11 gives
The known bounds
1
- = 0(Logloglogfc)
d\k ~ p\k P
yield
d>Q
Sa{v,M,N) = 7 + 0 A^Q™/24 + JV~1loglog(iV + M
Let W(T) denote the product from the definition of T{d) in Section 5.4,
W(T)= Yl max{l,|NdetI>n@,a:2,-.-,a:n)|}.
l<x2t... ,xn<T

6.4. ARITHMETIC FUNCTIONS ON LINEAR RECURRENCE SEQUENCES m
Notice that if T{d) < T then d \ W(T). So
(±.--±-\ Y l
T=\ d>Q,
d\W(T)
h
T(d)<T
The sum over d can be estimated as
= O{\og\ogW{T)) =
d\ W(T)
Moreover,.there is a constant c > 0 such that for T < clogQ this sum is empty.
Therefore
1
Analogously.
2--< •nT(n'\ ~
I VV(T)
The sum over p can be estimated as
Y - = O(min{i/(W^(r))/0.LogloglogW^(r)})
p>Q-
= O(min{rn/Qlogr,Loglogr}).
Therefore,
1
pT(p) Qlogr
P>Q ^ ' \T<(QlogQ)!/» ^ & T>(QlogQ)i/n
Hence,
Sa(u;,M.N) = 7 +
Finally, selecting Q = Nl'2n for the first sum and Q = N2n^n2~2n+V for the
second gives the assertion. ?
These results are extended in [369] to the case of multi-variate exponential
polynomials (for functions F and / given by F.13) and F.14), but other cases
can be treated analogously). Moreover, that paper provides more general results
for sums of 5-units. For G{k) and M = 0 this result is presented in [1197].
Asymptotic formulas for higher moments of the function Cl(k) are given in [755].
Theorem 6.10 is a generalization of [592, Theorem 2] which deals with the case
of the function / on values of Lucas sequences (a weaker result is given in [604]).
On the other hand, as ever, for special cases more precise results are known.
For instance, it is shown in [1197] that for the sequence agx + b and M = 0 the error

112 6. ARITHMETIC STRUCTURE OF RECURRENCE SEQUENCES
term in the first asymptotic formula of Theorem 6.10 can be reduced to O(log N/N)
(in fact this is done for the function G, but the same is true for any function Q,(k)
satisfying the condition of Theorem 6.10). The proof follows the same lines as the
proof of Theorem 6.10, but for this case t(d) = T(d) which simplifies the argument
and gives the improved bound.
For Lucas sequences, Kiss [592] shows that f(?~(x)) <C a; Log2logo; and
/ (?~(x)) > Log log log a; + 0A) infinitely often (for x = p prime, and for x = ml,
respectively — cf. page 99). Kiss and Phong [605] show that
F.15) f(r(x))<ln^x + O(l)
(where hr^ denotes the n-fold iterate of the function In), which is a generalization
of the result of Erdos [349] concerning the Mersenne numbers.
For the index of entry Ip of the Lucas sequence, Kiss [591] gets
X1'2 v^ Ip X X1'2 v^ Ip
logo; *-r> p logo; logo; f-*f p
Also, for the function
Kiss [592] proves that
T 2 1 7 H
R(h) « fe S , V ii(/i) - Log log H.
h h=\
Define L~(x) to be the product of all primitive power divisors of ?~(x), that is
L~(x) =
Kiss [590] shows that
ly; log !-(*) =
Y, logL(z) = Ar
x<N
Erdos, Kiss and Pomerance [351] study the function p(x) = fBx — 1). They prove
that if N/ Log log log M ->• oo then
M+N
— J2 p{x)=i + o{l).
x-M+\
with some 7 > 0 (Theorem 6.10 provides the same results for Nf Log log M —> 00).
The paper [594] suggests the possibility of extending this to the case of Lucas
numbers, but some extra work is still needed. Further, it is shown in [351] that
mm{p_(x),... , p(x + k - 1)} > ln(fc+2) x-c ln(fc+3) x
for infinitely many x € N. They also show that under the Generalized Riemann
Hypothesis this bound is of the correct order, since
min{p(aO,... ,p(x + k-l)}< 3 ln(fc+2) x + ck
for all x. Unconditionally, they obtain
min{p(:r), p(x + 1)} < (lnC) :rJ/3(lnD)

6.5. POWERS IN RECURRENCE SEQUENCES 113
These are very interesting counterparts of the estimate F.15), see also [597].
Let Mx = L^x/L~t the ratio of Lehmer numbers. Jones and Kiss [561] prove
that
F,6, ?¦"%-""'- /<"-" ,+OOV-MogiV,
loglcm(Afll...,MN) 6@(n/{ ))
where
logged ((ai +a2J,aia2)
yj =
21ogmax{ai, a2}
This is a generalization of many previous results, see [7], [103], [561], [601] and
references therein. The paper [8] provides a similar formula for elliptic divisibility
sequences A.10) (see page 168).
Now we consider a sum which looks artificial, but is motivated by application
of linear recurrence sequences to the construction of good integration nets (cf.
Sobol [1226]). Let
and
F.17) rs = (s - \)t -st-
n=l
where t is defined by the inequalities st < s < st+i • Although this formula is es-
essentially [1226, Eq. F.26)], the notation is slightly different. Sobol [1226] demon-
demonstrates that
S lo?f S
< rs < slogs + O(s Log logs)
Log logs
and aaks if an asymptotic can be obtained for rs. Here we show that
F.18) ts = slogs + O(s Log logs).
Indeed, it is shown in [1226] that
2t
1 ilogi
Now
t t t
F.i9) YL^tn~l ~ l)vBn -i) < X^™ ~ w=112 2Un~1 ~2n+1 +1
n=l n=l n=l
t n-1
= t Yl ^n " 1)~1 " n-1) E 2m = OB*«"-1) = O(s),
n=l 7n=l
and F.18) follows.
6.5. Powers in Recurrence Sequences
Another interesting question about the arithmetic of recurrence sequences is
that of the distribution of perfect powers. A good outline is given by Shorey
and Stewart in [1180]. The following result is [1179, Theorem 3], and concerns
sequences with only one dominating characteristic root.

114 6. ARITHMETIC STRUCTURE OF RECURRENCE SEQUENCES
Theorem 6.11. Let the integer linear recurrence sequence a have the form
a{x) =
i=2
with some A\ ^ 0 and \a\\ > \ot2\ > ••• > |am|. If a(x) ^ A\af for x > xq.
then the equation a(x) = syk has no solution with k > ko(a, s), where ko(a, s) is an
effective constant depending on the sequence and on the constant s.
In [589, Theorem 2], s can denote a variable taking values from an S-unit group
(with the constant ko(a, S) depending on the group S rather than on s). Theorem 3
of that paper shows that the gap between a(x) and syk is exponentially large,
F.20) \a{x) -syk\> 7*, k > ko(a, S)
with some 7 > 1. Thus it includes equations of the form a(x) — syk + d for d
fixed, and many others. Many of these results were later improved in [1180]. In
particular, there it is shown that one can choose 7 = |ai|1-e (for k > ko(a,S,e)).
All these results are based on bounds for linear forms in logarithms, and follow
the same lines as the proof of Theorem 6.1. Several more results of this kind can
be found, in [598]. Theorem 4 of [1180] claims that for x > xq one can take any
7 < |c*i| in F.20) and
[_log(|ai|/7)
where d is the degree of a; unfortunately the constant xq is not effective (since
the proof employs Roth's theorem): Allowing 7 to be close to |a-i| is essential
as it immediately leads to non-trivial results about equations of the form a(x) =
syk + P(y) where P(Y) 6 Z[Y] is of degree at most k - 1. We refer to [1180] for
more details; see also [599]. Finally, Shorey and Stewart [1180] observe that similar
results hold for sequences having only one dominating root with respect to a p-adic
valuation. The results above*deal with high powers, and do not give any information
about, say, squares or cubes among terms of linear recurrence sequences. No such
results (about small powers) are known for linear recurrence sequences of higher
orders (apart from the partial results on the Hadamard Root Problem presented
in Chapter 4, and'results about special sequences [262]). For binary sequences
much more precise results, including squares and other small powers, have been
obtained by Kiss, Luca, McDaniel, Nakamula, Nemes, Petho, Ribenboim, Shorey,
Stewart, Walsh and others — see [567], [595], [757], [797], [903], [988], [990*],
[1068], [1069], [1070], [1072], [1073], [1074], [1075], [1173], [1179], [1180],
[1181, Chap. 9],"[1246], and references therein. Some of the results obtained are
of a general nature, while others concern certain special interesting sequences. For
example, the only squares in the Fibonacci sequence
f(x + 2) = f(x + 1) + /(*), /@) = 0, /(I) = 1
are /@) = 0, /(I) = 1, /B) = 1, /A2) = 144, and the only cubes are /(I) = 0,
/(I) = 1, /B) = 1, /F) = 8 (see the survey [1173]). Imin Chen has shown that
powers in the Fibonacci sequence are related to the class number one problem [226].
The equation a(xi)b(x2) = yk for two linear recurrence sequences a and b
has been studied in [163]; see also [600], [602], [603]. The case of xY = x2 has
been considered in [758]. We are not aware of any results about perfect powers in
generalizations of linear recurrence sequences apart from the results of Shorey and

6.5. POWERS IN RECURRENCE SEQUENCES 115
Srinivasan [1177] concerning the sequence (qx) of the denominators of convergeuts
of the continued fraction of an irrational a G E. Combining F.8) and F.9), they
prove that for almost all positive a and all sufficiently large A/, N, and any ? > 2
satisfying
\<N <?{M + N) (log(A/ + N))~3,
the product qm+\ ... Qm+n 1S n°t an ^-th perfect power.
It has been shown in [394] that if a\,oi2 are integers with a\ > \ot2\, then for
the corresponding Lucas sequences
?~(x) = — — and ?+{x) = af + a|
each of the equations
?-(x) = I™ ] and ?+(x) = I™ )
has only finitely many solutions in integers x > 0 and m > 2k > 2.
Palindromes among the values of Lucas sequences have been studied in [754].
Problems concerning numbers expressible as sums of terms from certain recurrences
and primes are addressed in [268], [1102], [1267].
Finally, we mention a result of Luca [748] which shows that among the terms
of a binary linear recurrence sequence only finitely many can be represented as
products of factorials. Grossman and Luca [485] consider representations of a
binary linear recurrence sequences via linear combinations of factorials.

CHAPTER 7.
Distribution in Finite Fields and Residue Rings
In this chapter the question of how the values of an integer linear recurrence
sequence are distributed when reduced modulo m is discussed. For prime (power)
values of m, much can be said, but for composite m new problems arise.
7.1. Distribution in Finite Fields
Let / 6 Wq[X] denote a monic polynomial of degree n with /@) ^ 0. Fur-
Further, let a,j(x) 6 ?*(/), j = 1,... , s, denote linearly independent sequences (that
is, no linear combination vanishes identically). For ¦#!,..., #s € Wq, denote by
Tjv($i ,... , i?s) the number of solutions of the system of equations
G.1) aj(x)=0j, ; = l,...,5, l<:r<JV.
For brevity, put TN>S = TN{0,... , 0).
Theorem 7.1. Let t = per(/) be the common period of the sequences (cf.
page 46). Then
The proof of Theorem 7.1 is based on the representation
N
x=lci,... ,cs6F,
and the bounds for exponential sums given in Theorem 5.1 (see [725, Chap. 8]).
In a number of contributions [926], [1184], [1196], [1211], the error terms of
these bounds have been improved for particular cases. For n — 2, N = t, s = 1, an
upper bound for Tt(-&) is given by Somer [1229].
In the case of an irreducible minimal polynomial the best bound is proved
in [1196] (refining previous estimates of [1184]). It is based on the estimate E.7).
THEOREM 7.2. Let / be irreducible and let t — per(/) and r = t/(t,q - 1)
denote the common period and restricted period of s linearly independent sequences
aj(x)eC*(f),j = l1... ,s. Then
and
for any non-zero n-tuple ($i,... ,#s)-
117

118 7. DISTRIBUTION IN FINITE FIELDS AND RESIDUE RINGS
If s = 1 then the requirement that / is irreducible can be dropped. Thus if
R(N)=TN,u
G.2) R(N) R(t)'2
for any-TV.
The results above show that R(t) > 0 if and only if R(L0) > 0 for some
Lo = O(qs+n/2 logt) for any /, and for some Lo = 0{qs+n^2~l logr) for irreducible
/, or for s = 1. This result for s = 1 is related to estimates for the index of entry
displayed in Section 6.3. For Lq the logarithmic terms in bounds of Theorems 7.1
and 7.2 can be eliminated, but it is not clear how this can be done in general. This
improvement is achieved by taking into account the cancellation of some double
exponential sums as well as bounds of individual sums. ¦
Now consider the solvability of the system G.1): Let V(N) denote the set of all
possible n-tuples ($i,... ,#s) 6 ?q* for which this system is solvable. Equivalently,
V(N) is the set of values of the vectors (a^rr),... ,aa(x)), x = 1,... ,N. Let
V = T/(per(/)) and M(N) = \V(N)\, M = \V\. Also, let No denote the smallest N
with V(N) = V. Evidently, No < t < qn - 1. It was observed in [872] that results
like Theorems 7.1 and 7.2 provide better bounds. In particular,
for any/
for irreducible/.
Also, V = F" whenever t > Cqs+n'2 and even t > Cqs+(-n~1)/2 if / is irreducible
over ?q (the constant C can be easily computed and is small — about 1). These
estimates improve and generalize a result of [236].
It is shown in [872] that quite elementary considerations produce the following
result.
Theorem 7.3. If f is irreducible over ?q then
{fl/(n-s+l)
t
ifN<t.
For s = l both inequalities hold for any /; indeed the argument below shows
that they hold for non-linear recurrence sequences as well. All n tuples
{a(x),... , a(x + n - 1)), x = 1,... , N - n + 1,
must be pairwise distinct, so M(N) > N — n + 1. For N = t we may consider all
tuples for x = 1,... , N — n + 1. Now, for s > 2 there is a non-trivial linear combi-
combination AiCi(a;) -I -I- Xsas(x) with coefficients in Fg« which is a linear recurrence
sequence of order at most n — s+1 (over ?qn) taking at most M(N) distinct values
for x = 1,... , N. Irreducibility of / implies that the smallest period of any such
combination is t.
A different method to estimate V(N) was proposed in [1192], and developed
in [872], [1196], [1200]. The most general estimate is presented in the following
theorem which is essentially a consequence of [872, Theorems 2, 3].
Theorem 7.4. Let ?q be of characteristic p. If f is irreducible over?q then
M(N) > min { M, N (P + n ~ V
V p-

7.2. DISTRIBUTION IN RESIDUE RINGS 119
where ? = [log M(N)/logp].
The proof is based on the same reduction to the case s = 1 used in the proof of
Theorem 7.3, and the following observation. Let V(N) = (a(l),... ,a(N)} denote
the value set of the linear recurrence sequence a of order n, and consider the product
' w{x)=
Theorems 4.1 and 4.2 give estimates for the order L of w in terms of M(N). If
V(N) ^ V. then w is not identically zero. So it contains at least one non-zero terms
amongst its L initial values, hence N < L and a lower bound on M{N) follows.
The inequality
fp + n - s - V
gives
M(N) > inm
which implies that No < [(pMI+plogp(n-s+1)J +1 and (since M < qs),
These bounds are non-trivial even when q — p, but are especially effective when
p is fixed.. In this case they take the form Nq < exp(O(logMlogn)) and A^o <
exp (O(s log q log n)). An important case is when both s and q are fixed; then the up-
upper bound Aro = n°^ is polynomial instead of the exponential upper bounds G.3).
The same method for s = 1 gives
which improves G.3) for values n > no(q) where no(q) ~ eq1/2.
One may also study the distribution of quadratic residues and primitive roots
for a linear recurrence sequence over ?q. The first such results "were obtained by
Korobov [632] for q = p a prime, and extended to general q in [916]. Some of
these results were improved in [1184]. In the particular case of an i\/-sequence
a of order n and period t = qn — 1, these imply that among any N consecutive
terms there are N/m + O{tl/2~l/2n logi) m-th power residues (m | q — 1). Previous
results provided the error term O(i1/2logi); all these results are obtained by using
bounds for character sums. The elementary method described above is also applied
in [1200]. For example, to study the distribution of quadratic non-residues one can
consider the sequence w(x) = a(a;)^9~1^2 — 1.
The distribution of non-residues and primitive roots in the sequence a given
by C.8) has been studied in [949] by using the method introduced in [942] and
in [945].
7.2. Distribution in Residue Rings
The question of how a linear recurrence sequence is distributed modulo an
integer m depends strongly on the arithmetic of m. In general very little can be
said. For m = p, a prime, the question could be included in Section 7.1, but for
a prime field specific questions arise concerning its representation Fp ~ Z/pZ. For
m = pk, where p is a fixed prime, quite different techniques can be used. Many

120 7. DISTRIBUTION IN FINITE FIELDS AND RESIDUE RINGS
of the results and some of the methods of the previous section can be adjusted to
the case of residue rings, though the cases considered are more restricted. Only
single linear recurrence sequences are considered, although doubtless the results
can be transferred to the joint distribution of several sequences. Also, instead of
congruences a(x) = -d (mod m), more general functions Tm(N,l) are considered:
For an interval 1 = [K + l,K + H) of length H e N, Tm{N,T) is the number of
solutions a(x) = y (mod m), 1 < x < N, y € X. It is not difficult to prove that
G.4) Tm(N,l)=N\l\/m + 0{mn'2+?) "
under some mild conditions on the sequence a. For the case of s linearly independent
sequences the same asymptotic holds, with \X\N/ms as the main term. However,
this formula is non-trivial for sequences of period t > mn^2+? at least. On the other
hand, as discussed in Chapter 4, our knowledge of the period structure of a linear
recurrence sequence modulo an arbitrary integer m is poor. If m = pk, then t <C m
and G.4) gives nothing for n > 2. On the other hand, for this case much stronger
results follow from E.11) (if n = 1) and from Theorem 5.7.
The case n = 2 is considerably easier than the case n > 3: For binary sequences
Somer [211] obtains more complete information about the value set. Morgan [852]
gives a complete characterization of the value set for binary linear recurrence se-
sequences of maximal period modulo 2m.
The series of papers [207], [208], [209], [210] introduces a new measure of
non-uniformity of distribution in residue rings, and provides a complete study for
the case of binary sequences.
The only interesting case when the asymptotic G.4) is really useful is m = p.
when M-sequences exist. For such m, other bounds of character sums given in
Section 5.1 can be used. For the single exponential function a(x) = agx, with
gcd(a, p) — 1, of period t modulo p, E.4) gives
Tp(t,i) = t\i\/P+o
Analogously, E.5) gives
Tp(t,i) = t\i\/P+o
The case of Tp(N,l) with N < t can be worked out without any difficulties too.
Even more is known if g is a primitive root modulo p. The famous results of
Burgess [187] yields
for any interval I with \I\ > p1/4+?.
Denote by Qa,p{N,H) the average value
- ? (Tp(N,l)-N\l\/pf
" 0<K<p-l,
X=fK+T,
over all intervals of length H. For a linear recurrence sequence a of order n the
bound
G.5) QaiP(N,H

7.2. DISTRIBUTION IN RESIDUE RINGS 121
can be proved by elementary methods. Indeed,
TP(N,1) = \
NH
.. p N
A=lx=ly6l
V~X N
so
p-1 p-1
p1 p-1
Qa>p{N,H) = -3E E exp[27r^(A1-A2)/p]
P /f=0AA=l
AT
x
exp
i
at
-3
E exP^l^ia^i) - ^20(^2
p-i
The sum over iiT is p if Ai = A2 (mod p) and is 0 otherwise. Hence,
1 p-i at
Qa>p{N,H) = — E E exp[27r»A(a(a;i)-a(a;2))/p]
P A=lx1)x2=l
Theorem 5.1 now shows that
2/1.2/2=1
p-i / N \ 2 / H
P X=l \x=l / \y=l
A=l \y=l
and G.5) follows. For the average value of Qa,P{N, H) over all a e ?(/) the formula
G6) 1 V- r, , „ m _ NH(P ~ H)
<
can be derived from E.8).

122 7. DISTRIBUTION IN FINITE FIELDS AND RESIDUE RINGS
Again, for the special case a(x) = agx where gcd(a,p) = 1 and g is a prim-
primitive root modulo p, better results are known. Denote the function analogous to
QatP{NiH) by Ra,g,piN'H)- Montgomery [831] proves that
—
Ra,9AN>H) = — (l + OiHp-'+Np-1 + pl'2HN~l log3 p))
and then, applying a sieve method in a very ingenious way, he obtains another
estimate
Ra,g,p{N,H) =
These estimates were motivated by applications to a sorting algorithm which will
be considered in Section 14.2. For this application the case H = [p/N\ is the
important one. For such N and H, the last estimate simplifies to give the form
Ra,g,p(N> H) ~ NH/P> NH~p,P-l>N> P5/?+?.
We have not written this bound in the form Ra>giP(N,H) ~ 1 as it is plausible
that the same asymptotic holds for a wider range of parameters (since it follows
from G.6), this is true 'on average' over a). Montgomery [831] mentions that a
very strong Generalized Lindelof Hypothesis would imply the exponent 2/3 in place
of 5/7. Currently the best known results from [629] can be summarized as follows:
l + o(l), if
V'-'; ^a,g,pV ilHI1 J ; — ^ /^/_n/84-fr y-2\ jf «l/2
Montgomery [831] also asks if a better estimate holds for Ra,9jP(N,H) 'on average'
over all primitive roots g modulo p (for smaller values of N). It is shown in [629]
that this can be done in some cases; in particular
1 ^ ~ " -l +0{NH2p~2 + h
where g runs over all the ip(p — 1) primitive roots modulo p.
Several very interesting results about the distribution of exponential function
modulo p have recently been obtained in the series of work [246], [247], [1094]. It
is quite possible the technique developed in these papers can be used to improve
the above results on Ra!g^p(N,H).
Next consider the case m = pk with p fixed, so all constants are allowed to
depend on p. Put Tpk(l) = Tpk(tk,l), where t/. "is the period of the sequence
modulo pk. It is an easy exercise to derive from Theorem 5.7 that under the
conditions of that theorem,
G.8) Tpk{l)=tk\l\lpk
For n = 1 — that is, for a single exponential function - Korobov [636], [637]
provides a better estimate with error term 0A) instead of 0(t?k). He also obtains

7.2. DISTRIBUTION IN RESIDUE RINGS 123
an explicit bound for an arbitrary m which depends on the prime factorization of
m and is 0A) if m is a product of powers of several fixed primes:
G.9) Tm{l) = tk\l\/m + 0{p1.,.pr)
where m = pkl.. .pkr. This result will be used later in Sections 12.1 and 12.2.
For n = 1, the bound E.12) implies an asymptotic for Tpk(N, T) as well. Indeed,
Korobov [637] uses E.12) to prove that
Tpk(N,l) = N\l\/pk + 0 (iV1"^2 logpfc).
so
G.10) Tp,(l) = N\l\/pk +o{N) for N > exp{Cpk2^ log1/:3 jfc),
where Cp is some constant depending on p only.
Some of Korobov's results are also obtained by Stoneham [1255], [1256], [1257]
but in a different form.
For n > 2 it is possible that e in the error term of G.8) can be removed, but
certainly the bound cannot be reduced to 0A). On the other hand, the elementary
theory of congruences shows that Tpk A) > 0 for intervals X of length |J| > C(a,p).
Theorem 7.5. Let p > 3 denote a fixed prime number and let a denote an
integer non-degenerate linear recurrence sequence with square-free characteristic
polynomial f such that p J1 f@), and of period tk modulo pk. Then there is a
constant C(a,p) such that
Tpk(I)>tk\l\/npk-C(a,p).
Proof. Apply Theorem 3.5 with s = k - 1. Then a(x + yts) = a(x) + bs(x)psy
(mod pk) where
Let ko be as in Theorem 3.3 and let s > s0 = max{3, kQ}. Then
s - 1< s + 1 < 2(,s - 1)
and Theorem 3.5 implies that
a(x + ts) = a(x + pts-i) = a(x) + bs-ips~lp (mod ps + 1).
This congruence is equivalent to bs(x) = 6s_i(x) (mod p). If bSo(x) = b(x), then
bs(x) = b(x) (mod p). Therefore, for k = s + 1 > so + 1,
G.11) a{x + yts) = a{x) + b{x)psy (mod pfc), x E N.
Define the sets
Xk = {x •• 1 < x < tk, b{x) ? 0 (mod p)}r
and let Tp,- A) be the number of solutions of the congruence
a(x) = y (mod m), x G Xk, V S T.
Applying lifting to G.11) gives T^0)(I) = T^X(X) = •. • = ^(I). Now assume
that \X\ = H> pso — then T${1) = \X8o\ [H/ps°\. Clearly, b{x) is not identically

124 7. DISTRIBUTION IN FINITE FIELDS AND RESIDUE RINGS
zero modulo p (for if not tSo = tSo+i, which contradicts s0 > &o)- Therefore it
cannot contain n consecutive zeros modulo p, so \XSo\ > tSo/n. Finally,
T$\l) > -tso [H/ps°\ > -tS0H/ps° - tso/n = -tkH/pk - tsjn.
11 ft ft
Using the trivial bound Tpk(l) > T k (X), this gives the assertion. D
Instead of the trivial estimate \XSo\ > ^0/n' anv other upper bound on the
number of solutions of congruences with linear recurrence sequences could be used.
For example, this could replace the coefficient 1/n with some constant c(p) > 0
with c(p) —> 1 for p —> oo.
The next result gives another application of similar elementary methods. Let
X = [K + 1, K + H] and C - Xn. Now let Vpk(C) denote the number of vectors
(a(x + 1),... ,a(x + n - 1)) G C (mod pk), 1 < x < tk. Analogously to G.8) one
can prove that
G.12) Vpk(C) = tk\C\/pkn + O (
which is non-trivial for cubes with side H > pk~1/n +?. For smaller cubes a better
upper bound is provided by the following theorem.
Theorem 7.6. Let p > 3 denote a fixed prime number and let a be an integer
non-degenerate linear recurrence sequence with a square-free characteristic polyno-
polynomial f such that pj( /(O). Then
Proof. Define s from the inequalities ps~l < H < ps, where C = Xn, X =
[K + 1, K + H] as before. Evidently, all vectors (a(x + 1),... , a(x + n - 1)) ? C
are distinct modulo ps. Thus Vpk{C) < ts < hp3'1 <hH. D
The same arguments work for any sequence having a similar period structure.
For sequences of the maximal period tk = {pn>— l)pk~1, Kuz'min [661] gives more
precise results on the distribution of values; see also [572].
Several results are also known on the distribution of linear recurrence sequences
modulo rn 'on average' over all mn distinct initial values modulo m. Results of this
sort are motivated by applications to pseudo-random number generators, for which
the two cases m = p (see [710], [1187], [1189]) and m = 2k (see [28]) are most
interesting (see Section 13.1).
Various results about the distribution of some non-linear sequences satisfy-
satisfying C.6) are given in [324], [325], [330], [580] (see also the references there, [936,
Chap. 8] and the surveys [328], [935]). The results obtained are too technical to
be stated here. Generally, the distribution over the full period when it is maximal
has been almost completely clarified for quadratic sequences C.7) and for inversive
sequences C.8). A new method to study the distribution of such sequences over
parts of the period has recently been presented in [945] and [942]. Several more
results are given in [478], [497], [944], see also surveys [947], [948].
The following result comes from [497] (for s = 1 it is obtained in [945]).
THEOREM 7.7. // the sequence a given by C.8) with a prim,e modulus M — p
is periodic with period t and t > N > 1, then

7.2. DISTRIBUTION IN RESIDUE RINGS 125
where DS{N) denotes the discrepancy of the points
' a(x) a(x + s — 1)
P P
The implied constant depends only on d and s.
The bound is non-trivial if N > pl/2+?. The definition of discrepancy is given
on page 127.
Sequences given by C.6) with an arbitrary polynomial F have been studied as
well. The following result is taken from [942].
Theorem 7.8. // the sequence a, given by C.6) with a prime modulus M = p,
and a polynomial F ? Fpf-X] of degree d > 2 is purely periodic with period t > N >
1, then
DS(N) = O (N-l'2pl'2\og-l'2p (loglogp)*),
where DS(N) denotes the discrepancy of the points
'a(x) a(x + s-l)\
JU —~ JL ^ • • • j J V i
P P
The implied constant depends only on d and s.
Theorems 7.7 and 7.8 follows from Theorems 5.5 and 5.6, respectively. Accord-
Accordingly, the bound of Theorem 7.8, although non-trivial, is much weaker than that of
Theorem 7.7.
In [478] some of the above results have been extended to sequences given
by A3.11). Distribution problems for non-linear recurrence sequences will be dis-
discussed in Section 13.1 in their natural setting of pseudo-random number generation.

CHAPTER 8
Distribution Modulo 1 and Matrix Exponential
Functions
In this chapter the notion of discrepancy — a measure of uniformity of dis-
distribution — is introduced, and estimates for the discrepancy of linear recurrence
sequences are given. Several constructions of sequences with known discrepancy
are described, and related problems concerning normality of real numbers.
8.1. Main Definitions and Metric Results
The discrepancy of a sequence of points (wx) = (u>ix,... , ujsx) contained in the
s-dimensional unit cube is defined to be
D(N)= sup \A(*B,N)/N-\<B\\,
<BC[0,l}3
where -4.B3, N) is the number of fractional parts ({ujix}, ... , {u>Sx}), 1 < x < N, in
the box OS = OS = [/?i, 71] x • ¦ • x [/?s, 7S], |93-| is the volume of 93 and the supremum
is taken over all such boxes. If D(N) —* 0 as N —* oo, the sequence is called
uniformly distributed. A sequence (u>x) of reals is called completely uniformly
distributed if. for any s = 1,2,..., the sequence "of points (u>x ,wx+s_i) is
uniformly distributed.
A very important notion related to uniform distribution of sequences is nor-
normality. A real number ¦& is called normal to the base g (g > 2 an integer) if the
sequence of fractional parts of $gx is uniformly distributed. A real $ is called
absolutely normal if it is normal to every base g > 2. A simple consequence of
the ergodic theorem is that almost every real number is absolutely normal. An
equivalent definition of normality is the following: ¦& is normal to the base g if any
sequence d\ ... dk of k p-ary digits occurs with frequency l/gk among the first N
digit of the p-ary expansion of $ as N —> oo (cf. Section 13.1).
Although normal numbers are the original motivation, many more general re-
results of this section (concerning linear recurrence sequences, matrix exponential
functions, and exponential functions $ax with real a) are still the best known re-
results even for these more special sequences. Moreover, several authors extend these
definitions to such sequences. Thus, for example, it is common to say 'a num-
number normal to the base a', for a real a, or 'a vector normal to the base T' for a
matrix T (in both cases, the uniform distribution of the corresponding sequence
is meant). However, the second definition of normality to an integer base is not
directly transferable to those more general situations.
There are three types of problems related to the distribution of any parametric
family of sequences:
• To estimate the discrepancy for individual interesting sequences.
127

128 8. DISTRIBUTION MODULO 1 AND MATRIX EXPONENTIAL FUNCTIONS
• To estimate the discrepancy for almost all values of the parameters (initial
values, characteristic polynomials etc.).
• To estimate the discrepancy for specially constructed good examples.
Here these questions are considered for single exponential functions, linear recur-
recurrence sequences and, more generally, for matrix exponential functions "QTX. Many
relevant results can be found in the surveys given by Cigler and Helmberg [241]
in 1961, Postnikov [1045], [1046] in 1960 and in 1966, Kuipers and Niederre-
iter [647, Chap. 1, Sec. 8] in 1974, and Harman [519] in 2002. There has not been
much progress in this area since then, but some new results have appeared. Un-
Unfortunately, nothing is known about the first question, even for single exponential
functions agx. Any progress here would be of great interest. On the other hand, for
the second question much is known. The most general metric result is obtained by
Pushkin [1057], completing a chain of many partial results due to several authors.
Theorem 8.1. Let 03 = [/?i,7i] x ••• x [/?m,7m] denote an m-dimensional
box. Assume that the complex-valued functions $i,... , "dn are holomorphic in some
connected region A G Cm containing 03. Then for almost all w G 03, and any non-
singular (n x n) matrix T with integer entries whose eigenvalues are not roots of
unity, the discrepancy of the sequence of points ($i(w),... ,ii9n(w))Jrx satisfies
This theorem is remarkable for several reasons. Firstly, the set of 'good' initial
values is the same, for all matrices T, and integers N > 1. This is a substantial
generalization of Borel's classical result [130] that almost all real numbers are
absolutely normal. Secondly, it deals with almost all points of an arbitrary analytic
manifold rather than Rn (where such a result was known earlier).
For sequences of vectors of the form A{x) = (A(x - 1)F + B) (in which the
fractional part is taken coordinate-wise), the uniformity of distribution for almost
all initial vectors A(l) G Rn is shown by Franklin [405]. Note that if B is zero then
A(x) = (^(l)^71). Nowak and Tichy [971] provide a dual result which improves
and extends many previous ones.
Theorem 8.2. Let k denote a strictly increasing sequence of positive integers.
Then for almost all real (n x n) matrices T with at least one eigenvalue of absolute
value larger than 1, the discrepancy of the sequence (J^^) in the n2-dimensional
unit cube is
For almost all matrices having at least one real eigenvalue of absolute value
larger than 1 the discrepancy can be reduced to
O
Several metric results about the distribution of fractional parts of linear recur-
recurrence sequences are given by Meiri [807]. If n = 1, Franklin [404, Cor. to Theo-
Theorem 15], among many other interesting results, proves the following.
Theorem 8.3. For almost all real a > 1, the sequence (ax) is completely
uniformly distributed.
The result below generalizes several results of Pjatetski-Shapiro and Postnikov
(concerning n = 1), and was independently obtained by Cigler and Polosuev

8.1. MAIN DEFINITIONS AND METRIC RESULTS 129
(see [241, Sect. 10.9] or [1046, Sect. 16.b]). The property it expresses (that an
almost uniformly distributed sequence is uniformly distributed) is called stability.
Theorem 8.4. If for some vector $ E Rn and an (n x n) matrix T with integer
entries there is a constant C > 0 such that
limsupi4(«8,JV)/JV<C|»|,
AT—oo
where A(*B, N) is the number of points in d, dF,... , dJrN~l in the box 23 C [0,1}
then the sequence {"dJ-1) is uniformly distributed.
For n = 1, Pjatetski-Shapiro [1004], gets an even stronger result about the
sequence "dgx: ¦& is normal to the base g > 2 if for any e > 0 there is a constant
C(e) > 0 such that
limsupA(Q3, N)/N < C{e)\B\l+?
AT—oo
for any interval B = [#,7] C [0,1]. Apparently the same improvement could be
obtained for matrix exponential functions as well, but this has not been worked out
yet.
The following useful observation follows from the multidimensional Weyl crite-
criterion for uniform distribution [647, Theorem 6.2]: If -QTX is uniformly distributed,
then for any integer non-singular matrix A, "QATX is uniformly distributed too
(here T is not required to have integer entries). An example of how this may be
applied is the following: For any k E N, -QTkx is uniformly distributed if and only
if -QTX is uniformly distributed. In one direction, this is implied by Theorem 8.4.
In the opposite direction, this follows from the remark above because for each
j = 0,... ', k — 1, the sequence -QT^Tkx is uniformly distributed.
This is a particular case of a much more general statement. For n = 1 it was
stated by Schmidt [1142] in 1960, who conjectured that its analogue holds for any
n (and proved it in some cases). Brown and Moran [169] proved it in full generality
in 1993. To present their result two definitions are needed.
An (n x n) matrix T is ergodic if $AX is uniformly distributed for almost all
•d E Mn. An invertible (n x n) matrix T is called almost integer if if its entries are
rational numbers, and the eigenvalues are algebraic integers.
Theorem 8.5. Let T and Q denote commuting, almost integer, ergodic matri-
matrices. Then either there are k,i E N such that Tk = Ql, or there are uncountably
many ¦& E Rn such that fiT1 is uniformly distributed but $QX is not.
A similar result has been obtained in [91], [92] as well. Pushkin [1056] gives
another generalization of Schmidt's result [1142].
For exponential functions with real base the picture is quite different. Indeed,
writing B(a) for the set of d E IK for which the sequence "dax is uniformly dis-
distributed, Moran and Pollington [835] prove that B(ak) <?. B{at) for integers k ^ ?
and almost all a > 3. On the other hand, it is known that if an ± a~n E Z for
some integer n, then B(a) C B(ak) for k = 1, 2..... For several related results,
see [836].
The paper [90] addresses similar questions on numbers normal to the base d,
where d is a PV-number (for such numbers there is a natural analogue of the notion
of normality).
For n = 1, Maxfield [793] shows that d is normal to the base g if and only if
¦dr is also, for any rational r ^ 0.

130 8. DISTRIBUTION MODULO 1 AND MATRIX EXPONENTIAL FUNCTIONS
Although the sequences considered here are uniformly distributed for almost
all parameter values, other non-trivial types of distribution occur (for uncountably
many values of parameters); see [241. Sect. 10], [647, Sect. 8, Chap. 1], [1045],
[1046] for descriptions of these and many other results.
8.2. Explicit Constructions
In the light of the previous section, it is reasonable to expect that N~1^2 is
the correct order for the discrepancy in metric results. To obtain a better bound,
special examples need to be constructed. Such constructions are interesting in any
case, as none of the metric result allow specific parameter values with the required
property to.be found. Moreover, although almost all of the constructions below
produce sequences with a good estimate for the discrepancy, some of them are
still the only known examples for the simpler qualitative question about finding
uniformly distributed or completely uniformly distributed sequences.
In [715], the following result is obtained.
Theorem 8.6. Let f e Z[X] be an irreducible polynomial of degree n > 1 with
no zero of unit modulus. Then there is an effective construction of the initial values
of a real linear recurrence sequence with characteristic polynomial f such that its
discrepancy is O (N~2/3{log NL/s). .
The same result should be true for reducible polynomials as well (if we replace
the words '/ is the characteristic polynomial' with 'linear recurrence sequence sat-
satisfying the equation A.1)', it follows from Theorem 8.6).
It is not known if the bound in Theorem 8.6 can be improved. There are
reasons to suspect that there are sequences with discrepancy O(N~1+?), but so far
the exponent —2/3 is the best result even for n = 1.
Theorem 8.6 is a generalization of results of Korobov [635] and Levin [706]
concerning a single exponential function -dgx. In [706] another generalization was
considered: For any integer g > 2 and s > 1, Levin gives a construction of $i,... , $s
such that the discrepancy of the sequence {"d\gx,... , $spx) is
(log N) I.
For s = 1 and g = p a prime, another construction is given by Korobov [635] using
normal periodic systems which are constructed using M-sequences over finite fields
(which is where the requirement that g be prime is needed).
Theorem 8.6 treats 1-dimensional discrepancy. The next result, from [709],
concerns the n-dimensional discrepancy of the matrix exponential function dTx.
Theorem 8.7. Let T denote an (n x n) matrix with integer entries such
that among its eigenvalues there are no roots of unity. Then there is an effec-
effective construction of a vector $M.n such that the discrepancy of the sequence ('dJrx)
?:so(iv-1/2(iogiv)n+1).
Levin also gives several related ingenious constructions. In [705], for any tran-
transcendental a > 1 he constructs i9 such that the sequence ($ax) is completely uni-
uniformly distributed. Furthermore, if a is an S or T-number in Mahler's classifica-
classification (see [1234], [1235]), then for any s = 1,2,..., and any function ij;(N) -»
oc, a construction is given such that the discrepancy of the sequence of points
(tfax,... ,i9ax+s~1) is O (N-l/2{logN)n+l/2i;{N)). This result applies to almost

8.2. EXPLICIT CONSTRUCTIONS 131
all a, and in particular to distinguished numbers like it, e, loge, etc. For an alge-
algebraic number a of degree d, the same is true for any s < d.
Now consider a sequence of real numbers a; > 1, i = 1,2, For each i G N,
define di to be the degree of oti if oti G Q, and put di = 1 otherwise. In [711] Levin
gives a construction of a sequence $i, $2>•••> sucn that for any for any r > 1, and
integers k\,... ,kr >1 the discrepancy of the sequence
is O (N~1/2(\ogN)s+3/2), where s = eh -\ h dr. This is a generalization of his
previous result [707] concerning the case r = di = 1 only (for which case a slightly
better estimate of the discrepancy is found). Choosing a; = i 4-1-gives an. explicit
construction of an absolutely normal number d such that for any g the discrepancy
of {tig*) is 0{N~1/2 log2 N Log log IV).
For n = 1. Levin [708] obtains the following constructive version of Theorem 8.3
as well.
Theorem 8.8. There is an effective construction of a number a G R suc/i that
for any s > 1 t/ie discrepancy of the sequence (ax,... , a1) is
The main idea of all these constructions above is as follows. The parameters
are given by extremely rapidly converging series. As a result, they have precise
approximations by ratipnals (with, usually, prime power denominators). These ap-
approximations are so fast that we can consider them instead of the original param-
parameters. This reduces the problem to one concerning distribution modulo m, where
many results are available (see Chapter 7). Moreover, although results stated for
almost all real parameters cannot lead to effective constructions, the same type of
results modulo m are inherently effective because of the finite nature of the prob-
problem — to find good parameter values only a finite search is needed. Unfortunately
these considerations become complicated even in the simplest cases. Theorems 8.9
and 8.10 give some impression of this direction.
This approach was discovered and developed by Korobov, then many other
authors contributed to it (see [241], [647], [1045]., [1046] for references). This
idea is also exploited in the series of papers of Stoneham [1254], [1255], [1256],
[1257].
Unfortunately very little is known about other arithmetic features of numbers
represented as series. For example, it is not known if there is an algebraic number
normal to some integer basis. The only known example of this special sort is the
amazing result of Stoneham [1258] who proves that any sequence of decimal digits
d\ ... dk occurs infinitely often in the decimal expansion of tt/4. This does not
mean that tt/4 is normal base 10 but nonetheless is an impressive result. He uses
the formula
m
lim TT(l-l/Bi + lJ) =tt/4
1KYI JL X v '
and notes that this gives a power series representation of the type needed.
Kano and Shiokawa [574], [575], [576] and Jung and Volkmann [566] obtain
another application of these idea. They construct sets of numbers which are normal
to some base g and non-normal to the base hg with some integer h with gcd(p, h) =

132 8. DISTRIBUTION MODULO 1 AND MATRIX EXPONENTIAL FUNCTIONS
1. All these authors acknowledge the priority of Wagner whose work has never
been published1 but is well known among specialists nevertheless. For instance,
Kano [575] gives the following construction.
Theorem 8.9. Let g > 2 and h > 2 be co-prime and let (Xm) and (/im) denote
strictly increasing sequences of positive integers satisfying
lim Am//im_i = oo, lim log/im/Am = oo.
m—>oo m—>oo
Let R denote the ring generated over Z by the set of all products of numbers of
the form A 4- >^MTn j with em = ±1. Then R is uncountable, and any $ e R is
normal to the base g and non-normal to the base gh.
In [574]. Kano gives a broad generalization of Korobov's constructions. The
discrepancy of the sequences obtained is estimated (the bound is weaker than the
example of Levin [706] giving O (iV/3(log iVL/3) mentioned above). Continued
fractions for some normal numbers of this type are found in [631].
Another (classical) approach to the construction of normal numbers is related
to the second definition via frequencies of groups of digits. The numbers obtained
in this way are more explicit. The discrepancy can be estimated as well but it has
not produced any records. To describe this, denote by [/] the p-ary expansion of
the integer /. Many normal numbers have been constructed in the form
(8.1) 0 = O.[/i][/2]...
fora chosen integer sequence (fx) (see [241], [1045], [1046]). For any polynomial
/ G 1i[X], setting fk = f{k) gives a normal number $; Schiffer [1113] shows that,
the discrepancy of dgx is 0A/ log iV), and this bound is best possible. Several
more relevant results are given by Dumont and Thomas [315] and by Nakai and
Shiokawa [576].
A different example is f^ = Pk, where p^ is the A:-th prime number — more
generally, //. can be any strictly increasing sequence of integers with
\{k : /fc < 1V}| » IV1
for any e > 0. Thus the numbers
0.12345678910 ... , 0.14925364964 ... , 0.235711131719 ...
are normal to the base 10; see also [1294].
Sziiz and Volkman [1271] give very general conditions on functions / such
that fk = [/(&)J generates a normal number. Here we present several interesting
examples from that paper, showing a wide variety of such functions:
• /I-?) = E"=l 1»X&V l0ST^» Where n > 1, In > 0, 0n > •¦• > 3U
• /(x) = vl with 0 > 0;
• /(*)=&.
On the other hand, no function of logarithmic order like f(x) — logT x produces a
normal number. Several more results of this kind can be found in [716].
Proving normality of numbers given by (8.1) is equivalent to studying the dis-
distribution of digits in the sequence (/*.), a subject of independent interest. The
March 10, 1990, Gerold Wagner tragically lost his life in an avalanche in the Alps.

8.2. EXPLICIT CONSTRUCTIONS 133
papers [66], [309], [310], [311], [314], [393], [465], [467], [468], [469], [991],
[1165] (among others) deal with different aspects of the digit distribution, includ-
including the sum of digits function and the distribution of digits with respect to two
different bases. Expansions with respect to recurrence sequences are considered as
well. As mentioned in Section 14.1, Shallit [1156] has shown that any 'sensitive'
numeration system arises from linear recurrence sequences; see also [1137].
Bugeaud [179] shows that among the Liouville numbers one can find both
normal and non-normal numbers to any base.
The digits of some specific numbers are studied too. For example, Blecksmith,
Filaseta and Nicole [123] define a block in the base g representation of m as a
sequence of equal digits of maximal length, and denote by B(m, g) the number of
such blocks. Using lower bounds for linear forms in logarithms, they show that if
a,g > 2 are integers such that log a/ log g is irrational, then
lim B(ax,g) = oo.
X —»OO
The proof apparently can be transferred to the values B (a(x),g) for a linear recur-
recurrence sequence a.
Luca [749] studies the number of non-zero digits in p-ary expansion of the nth
term of a linear recurrence sequence and, under some natural conditions, shows that
there are at least c log nj log log n such non-zero digits/where c > Q is a constant.
•¦¦ Some of these results are based on upper bounds for the number of solutions
of 5-unit equations and bounds for linear forms in logarithms. It follows that the
recent progress in both these areas improves those results.
Finally, for sequences growing slightly faster than linear recurrence sequences,
there is a simple construction providing very uniform distribution of the corre-
corresponding fractional parts. This construction may be applied to subsequences of a
linear recurrence sequence a like (a(x2)) or (a(p)) where p runs over the sequence of
prime numbers. Another interesting sequence which is covered by the result below
is x\.
Consider sequences / satisfying the growth condition
(8.2) \f(x + l)\>xl-B\f(x)\',
we wish to construct u such that for any s G N the discrepancy of the sequence of
points ({ujf(x)},... , {wf{x + s — 1)}) is uniformly distributed in the s-dimensional
unit cube with discrepancy DS(N) = O(N~l+e). The following result from [1185]
will be used, giving an explicit construction for a sequence (i?x) such that for any
s G N the s-dimensional discrepancy of the sequence of points (i9x,... , 1?X+S_1),
x = 1,... ,N, is DS(N) = O(N~l+s). This sequence (&h) is used to construct u
with the property required in the following way. Put
oc
(8.3) lo =
where the sequence (lux) is defined from the recurrence relation
x-l
(8.4)
Theorem 8.10. For a sequence f satisfying the growth condition (8.2), let u>
be defined by (8.3), (8.4). Then for any s G N, the s-dimensional discrepancy of

134 8. DISTRIBUTION MODULO 1 AND MATRIX EXPONENTIAL FUNCTIONS
the sequence of points
satisfies D8(N) = O(N~1+e).
Proof. It is enough to show that for any M, the discrepancy of points
({uf(x)},..., {uf(x + s - 1)}), x = M + l,..., 2M,
satisfies DS{M,2M) = O(M~1+e). For M <x< 2M,
(8.5)
(8.7)
and the assertion follows. D
Using the result of Levin [713], one can obtain a slightly stronger bound.
Although this result cannot be applied to an integer linear recurrence sequence
directly, selecting an appropriate subsequence gives a construction of u; such that the
fractional parts {a(x)} are very densely distributed in the unit interval (certainly a
must be a non-degenerate sequence to achieve this) in the sense that for any e > 0,
7 and iV > 1 there is x, 1 < x < N, with {ua(x) - 7} < A^"+e.
8.3. Other Problems
We close with several more questions on the distribution of fractional parts of
exponential functions. The surveys [395], [396] are good references for this.
In [773], Mahler asked if there exist numbers $ > 0 with the property that the
fractional part {t9C/2)x} < 1/2 for all x G N. Such numbers are called Z-numbers.
Mahler's 3/2-problem is the conjecture that there are no Z-numbers. Mahler [773]
proves that for any k G Z+ the interval [k,k + l) contains at most one Z-number;
since {$} < 1/2 the Z-number in this interval must lie in [k,k + 1/2]. Thus Z-
numbers (if they exist) are well separated. Mahler also proves that the number
of Z-numbers tf < .r is O(x^) with 7 = log(l + 51/2) - 1 = 0.70.... Flatto [395]
improves this by showing that one can take 7 = log 3 -1 = 0.59 — He also obtains
many interesting results about the structure of the set of Z-numbers. In fact he
(and other authors) consider, for 0 < t < 1 and a > 1, the more general set of
ZtiQ-numbers, where
Zt,a = {$ > 0 : {dax} < t, x G N}.
Among other results. [395, Theorem 7.1] shows that Zf,Q is either countable or has
cardinality of the continuum (without the continuum hypothesis); Theorems 7.4
and 7.5 op. cit. show that both possibilities occur. The first happens if
in which case [k, k + 1) contains precisely one Z^/^-number for any k G Z+. The
second happens if 2/(a - 1) < t < 1, in which case[fc, k + 1) contains a continuum
of ZfjQ-numbers for any k e Z+.

8.3. OTHER PROBLEMS 135
In [396], Flatto, Lagarias and Pollington extend these results even further to
the set of ZS)f,Q-numbers, defined by
Zs,t,a = {$ > 0 : s < {dax} < s +1, x G N}
where 0 < s < s+t < 1. The following statement from [396, Theorem 1.1] improves
and generalizes the results of Mahler.
Theorem 8.11. Let i and q denote co-prime integers and let s. t with 0 < s <
s + t < 1 be such that t < 1/q and {(? — q)} < q - it. Put
7 = min{log/ - 1, log, [it + {(i - q)}\}.
Then for any k G Z+ the interval [k,k + 1) contains at most one Zsj^q-nurnber.
and the number of Z3it^/q-numbers d < x is at most O(x~().
Several new results about the sets ZSit,a for rational numbers a are given by
Bugeaud [178].
As in [396], define
ft (a) = inf I Km sup {^a1} — liminfl^a1} I
so Mahler's conjecture implies that ft(l/3) > 1/2. The main result of [396] is the
following.
Theorem 8.12. The bound Sl(i/q) > 1/q holds for any co-prime i and q.
Tijdeman [1282] shows that Z1/(q_1))Q ^ 0. and therefore ft(ct) > l/(a - 1),
so ?l(i/q) < 1/A — q). Several other related results due to different authors are
given in [396] as well. Among them is the statement that ft(a) = 0 if a is a totally
positive PV-number (that is, a > 1 while the other conjugates are positive and
strictly less than 1). On the other hand, the estimate ft(a) < 1/2A + aJ is shown
to hold for only countably many values of a.
In Section 12.4, an analogue of Zf)Q-numbers modulo a prime i is considered.
Another old conjecture, supported by computational results, states that the se-
sequence C/2)x is uniformly distributed modulo 1. As a step towards this conjecture,
Kamae [571] considers the following easier problem. Let k denote a non-decreasing
sequence of integers such that k(x) —> oo as x —* oo. One may try to prove that-
the sequence B>x/2k^) is uniformly distributed. For k(x) = x this is the original
problem. Kamae proves uniform distribution for k(x) = logo; + 0A), and notes
that he cannot prove it even for k(x) — O(\ogx). His method exploits the fact that
3 is of maximal period 2k~2 modulo 2fc for k > 2. Here we describe an essential
improvement and generalization of this statement.
Theorem 8.13. Let r > 2, and q a prime power, be co-prime. There is a
constant c(q) > 0 such that for any non-decreasing sequence of integers k(x) —* oo
as x —* oo with
k(x)<c(q)(\ogxf/\Log\ogx)-ll\
the sequence (rx/qk^) is uniformly distributed.
PROOF. We may assume that k(x) > 0 for x ? N. Fix some sufficiently large N,
and separate the interval [1, AT] into m sub-intervals [Ni +1, iVj+i] on each of which

136 8. DISTRIBUTION MODULO 1 AND MATRIX EXPONENTIAL FUNCTIONS
k(x) takes the value fcj = fc(ATi + 1), i = 1,... ,m. Thus Nx = 0 and iVm+1 = AT
and fcj < ... fcm. Then
m < fc(ATm) < k(N) = O ((logJVK/2(Loglog A0~1/2).
Let 2 denote the set of i < m for which
Ni+1 -Ni< expiCpk2/2 log1/3 ^),
where p is the prime divisor of q and Cp is the constant from the estimate G.10).
Then
/ m \
pk2/3 log1/3 fc) = O I ]T N]'2 = O^1/2) = o(AT).
Without loss of generality we can consider intervals with the denominators qki in
the definition of the discrepancy of the sequence rx/qk(-x^> over x ? [Nt + 1, Ni+i].
Now applying the estimate G.10.) to intervals [A7* + l,Ni+1} with i ? J and the
trivial bound O(Ari+i - Nt) to i E 2 gives
and the assertion follows. ?
Other related results can be found in [1262].
The next result is a generalization of the Riesz-Raikov Theorem on algebraic
numbers which previously was only known for rational a (see [1036] for further
references).
Theorem 8.14. If a > 1 is an algebraic number, andip is a bounded measurable
1-periodic function on M., then
N
lim —-
x-\
for almost all D G
This result has to do with uniformity of the distribution of the fractional parts
of dax. On the other hand, behind it there is a quite different result related to
5*-unit equations.
Theorem 8.15. Let o¦ > 1 denote an algebraic number such that all the powers
ax, x G N are of the same degree d, and let u denote the number of prime ideal
divisors in Q(a) of a . If W is a subspace of dimension dim W < d — 1 of the
d-dimensional Q-vector space Q(a), then the set Aa(W) — {h : ah 6 W} is finite,
and
This result is proved in [1036], and is based on bounds for the number of
solutions of 5-unit equations. As usual, more recent results produce a better bound
for |.AQ(W)| (for Theorem 8.14 only the finiteness of Aa(W) is essential). Several
results presented in Section 12.1 on normal bases of algebraic number fields are
obtained in a similar way.

8.3. OTHER PROBLEMS 137
Maxfield's result [793] says that if -d is not normal to the base g, then neither
is rwd for any m G N. On the other hand, Mahler [774] shows that any irrational
number $ can be 'improved' in the same way: For any k G N there is a number
M(k) < 102fc+1 such that any sequence dx...dkoik decimal digits occurs infinitely
often in the decimal expansion of at least one of the numbers rwd, m = 1,... , M(k).
The existence of such a function M(k), depending only on k, is not obvious, let
alone the question of finding bounds for M(k).
Berend and Boshernitzan [81] extend this definition to any base g; for the
corresponding function M(g,k), they prove the upper bound M(g,k) < 2gk — 1.
This bound is quite precise as they show that
• M(g, k) > h{gk — 1) for any proper divisor h of g;
• M(g, k) > A — s)gk+l if g is not a prime power and k > ko(e);
• M(g, 1) >. 1.5(p - 1) for any odd g > 5.
They also show that for any polynomial / G R[X] with at least one irrational
coefficient (beside the constant term), there is a constant Mf(g,k) such that any
sequence d\ ... dk of k consecutive p-ary digits occurs infinitely often in the decimal
expansion of at least one number f(m) for some m. They do not give any up-
upper bound for the minimal m, but mention that m does not exceed some constant
M(g, k, d) depending on g, k and the degree d = deg /. It would be very interesting
to have an explicit bound. The method is based on considering limit points of the
sequence {aqx} (incidentally, it is straightforward to show that for any irrational
a there are infinitely many such limit points). They mention the following applica-
applications of the general result: Any sequence d\... d\~ of k p-ary digits occurs infinitely
often in the decimal expansion of at least one element of the following sequences:
• Inn (consider n of the form n = 2m);
• In In n (consider n of the form n = 22);
• rO with positive rational 7 = i/q (consider n of the form n = 2mq).
On the other hand, it is not known if this holds for In In In n or for n1 with irrational
7 > 0.
In a subsequent paper [82], they extend this research in many directions. There
it is shown that the same statement is not true for continued fractions expansions:
There exist uncountably many a such that the sequence of partial quotients of each
multiple ma converges. For such a, any finite sequence of positive numbers occurs
only finitely often in the sequence of partial quotients of ma for any m EN. On the
other hand, they also mention that for almost all real a each fixed finite sequence
occurs infinitely often (and even with some prescribed positive density). Finally,
they show that, for any quadratic irrationality a and for each sequence of positive
integers 61,... .bk, there exist infinitely many m for which this sequence appears
infinitely often in the continued fractions expansion of ma.
Graber, Tichy and Winkler [470] study the distribution of fractions of the
form a(x + l)/a(x) for a recurrence sequence a satisfying the equation A.7) with
asymptotically constant coefficients: In their main theorem they need fi(x) =
fi + O (x~x) for some fo,... ,/n-i € C and A > m, where m is the maximal
multiplicity of the dominating roots of the asymptotic characteristic polynomial
f(X) = Xn- fn-1Xn-x fiX-fQ.
Under some conditions on dominating roots of /, an explicit (rather complicated)
expression for the distribution function is given. An example from [470] is the

!38 8. DISTRIBUTION MODULO 1 AND MATRIX EXPONENTIAL FUNCTIONS
following: Let a satisfy A.7) with n = 2, fi(x) = fc + O (x~x), i = 0,1. Assume
that d = fi - 4/o > 0, A > 1, and tt arctan ((-dI/2/f\) is irrational. Then the
distribution function of a(x + l)/a(x) is
where
X(t) = t + arctan ,.
expTr(-dI/2 - cos2?rt)
Tichy [1278] gives a bound on error terms and shows how such results can be used
to study the uniformity of distribution of sequences satisfying the equation
a (:r)
where ax —*¦ a, 0X —* C and a2 < 4C. Tichy [1280] also studies the distribution of
fractional parts of log a(x).
Subtle problems concerning the distribution of fractional parts of n2a are con-
considered by Zaharescu [1371], [1372] and Rudnick, Sarnak and Zaharescu [1093].

CHAPTER 9
Applications to Other Sequences
Any polynomial over Q of degree n satisfies a linear recurrence equation of
order n + 1, by A.4) on page 4 for example. Thus, many of the results from
Chapters 1 to 8 can be directly applied to such polynomials, although they seldom
give something non-trivial for this particular case. On the other hand, there is
another connection between linear recurrence sequences, exponential polynomials
and algebraic polynomials, particularly n-sparse polynomials of the form
(9.1) F(x) = alXri + • ¦ • + anxrn
containing exactly n monomials. Letting r\,.. .rn be negative gives n-sparse ratio-
rational functions. In either case, the substitution x = gz with some g ^ 0, makes
F(x) = a(z) = al9^z + ¦ ¦ ¦ + angr"z,
and a is a linear recurrence sequence or more precisely an exponential polynomial
of order at most n. Over a finite field ?q, in order to study the behaviour of F over
Fq, it is reasonable to choose g to be a primitive root of ?q. The same idea works for
polynomials over residue rings modulo pk for odd prime p, and after some adjust-
adjustments over Z/2/oZ. By applying the Chinese Remainder Theorem, such polynomials
can be studied over arbitrary residue rings Z/mZ. In Section 9.1 these general con-
considerations will be illustrated using examples. One more application to algebraic
polynomials of quite different ideas which nevertheless traditionally belong to the
area of linear recurrence sequences and S-unit sums will also be given. In Sec-
Section 9.2, connections between linear recurrence sequences and continued fractions
are discussed, and in Section 9.3 some examples of sequences arising in combi-
combinatorics that have been successfully studied using linear recurrence sequences are
described. Finally, in Section 9.4, norm-form and exponential Diophantine equa-
equations are discussed in connection with linear recurrence sequences.
9.1. Algebraic and Exponential Polynomials
We begin by studying two related problems on factorization of exponential
polynomials, and fractional power factorization of algebraic polynomials. The first
is in the background of the proof of Theorem 4.3, giving a positive solution of the
Hadamard Quotient Problem.
9.1.1. Factorization of exponential polynomials. The first problem deals
with factorization in the ring of formal exponential polynomials A.6) — a subject
going back to Ritt's work [1080], [1081], [1082] of 1927-1929, where he essentially
proves a unique factorization theorem. This notion of 'unique' factorization has
to be suitably interpreted. There are many units of the form Aexpibz; worse,
polynomials 1 - Aexpipz have factors 1 - Axlnexp(tpz/n) for all n 6 N. To get
around this, let K denote an algebraically closed field of zero characteristic and let
139

140 9. APPLICATIONS TO OTHER SEQUENCES ¦
j
W denote a finitely generated Z-submodule of K. Denote by KZ{W} the ring of
exponential polynomials of the shape
rn
(9.2) E(z)
where the coefficients belong to K[z\ and the frequencies tpi,... ,ipm are distinct
elements of W. The exponential function — which looks exotic over an arbitrary
field — is only used here to have the formal identity exp(x + y) = expx expy. This
notation could be avoided by working in a suitable group ring, see [366]. It may be
shown that irreducible exponential polynomials do exist in the ring KZ{W} and a
unique factorization theorem does hold. For polynomials with constant coefficients
this was shown by Ritt [1080], and then it was noted in [366] that the arguments
work for any polynomial coefficients, and even for exponential polynomials in several
variables.
Theorem 9.1. An exponential polynomial E 6 KZ{W} factorizes, uniquely up
to units ofKz{W}, as a product of an algebraic polynomial A0(z), a finite number of
polynomials A{ (exp($iz)) with frequencies $i no two of which are rational multiples,
polynomials Ai 6 K[z], i = 1,... , s, and a finite number of exponential polynomials
each irreducible in KZ{W}.
Another of Ritt's results [1081] concerns divisibility of polynomials with com-
common zeros.
Theorem 9.2. // every zero of an exponential polynomial E is also a zero
of an exponential polynomial ~F, then there is an exponential polynomial G and
an algebraic polynomial A dividing each coefficient of E, such that G(z)E(z) =
A(z)F(z).
The assumption of Theorem 9.2 can be essentially relaxed [295], [1043], [1164].
It is also shown in [1043] that two notions of greatest common divisors for exponen-
exponential polynomials can be reasonably defined. The first of these is the Ritt greatest
common divisor Gr{E,F) = gcdR(E,F) defined as usual by the property that .
every divisor of both E and F divides Gr(E,F) in KZ{W}. The second is the
Hadamard greatest common divisor Gh{E, F) = gcd# (E,F), defined by the prop-
property that every entire function of analytical order at most 1, whose zeros are exactly
the common zeros of E and F (and no others), is Gh{E,F). Both these greatest
common divisors are uniquely defined up to a unit of the shape Aexpyjz.
Theorem 9.2 is related to a conjecture due to Shapiro [1163]: If two exponen-
exponential polynomials have infinitely many common zeros, is it true that all but finitely
many of these zeros occur because of a common exponential polynomial factor?
The condition forces the Ritt greatest common divisor and the Hadamard greatest
common divisor to coincide (up to a unit factor of the shape Aexpipz). The only
known results beyond some trivial observations implied by Theorem 9.1 are those
of Diab [294]. On the other hand, Rubel [358] shows that a natural generaliza-
generalization of Shapiro's conjecture is certainly false (he calls the Ritt and the Hadamard
• greatest common divisors the algebraic and the analytic greatest common divisors,
respectively).
These problems can be formulated differently. Instead of working with expo-
exponential polynomials from K2{W}, consider instead multi-variate polynomial factor-
factorization in fractional powers — the question originally considered by Schinzel [1116].

9.1. ALGEBRAIC AND EXPONENTIAL POLYNOMIALS Hi
Equivalently, given an algebraic polynomial /(zi,... , xn), consider the problem of
polynomial factorization of /(x'1,... ,z?n) for some qi,... ,qn 6 N. In [1043],
polynomials which remain irreducible for all such substitutions, are called irre-
irreducible in the strong sense. This notion of irreducibility was also studied by Gourin
[461], and arises in finding minimal non-mixing shapes for Zd-actions by compact
group automorphisms, [609, Sect. 3], [1335]. The structure of fractional power
factorizations is completely described in [1032].
Finally, Berenstein and Yger [83] develop mixed algebraic and analytic methods
to study ideals in the ring of exponential polynomials.
9.1.2. Sparse polynomials over finite fields. Answering a question of
Erdos, Coppersmith and Davenport [257] prove that the powers of any n-sparse
polynomial over a field of zero characteristic cannot be too sparse: They contain
at least log log n monomials. This implies a similar lower bound for the order of
powers of linear recurrence sequences of a special form; the most general form of
such a result with respect to linear recurrence sequences would be a very useful
addition to numerous upper bounds outlined in Chapter 4.
Redei, in his book [1063], among many other interesting topics about sparse
polynomials, considers sparse polynomials which split into linear factors over a finite
field. Such polynomials may be studied by using the following upper bound for the
number of zeros of a sparse polynomial over a finite field, which was established
in [198]; see also [409], [410], [1202], [1203]. This was presented in Theorem 5.10
in the form of an upper bound on the number of solutions of an exponential equation
(the proof given in [198] also deals with this form).
Theorem 9.3. For n > 2, elements ax,... ,an e F* and integers n,... ,rn,
denote by T the number of solutions of the equation
x=0, z€F.
i=l
Then
(9.3) T < 2(/1-1/(*
where
D = min maxgcd(rj — r^,q — 1).
l<i<n j^i
A result about sparse polynomials will be derived from Theorem 9.3 (see
also [1202, Sect. 3.3] for related problems).
Let Rn(q) denote the number of sequences
(9.4) 0<n < •¦¦ <rn <q-l,
for which there exist ai,... ,an 6 Fq such that the polynomial F 6 Fjz] given
by (9.1) splits into linear factors over Fq. Such a sequence of exponents rx,... ,rn
is called the type of the polynomial (9.1). Thus Rn(q) is the number of types of
n-sparse polynomials which split into linear factors over ?q.
Theorem 9.4. For any prime p and n > 3, Rn(p) = O (pn~l log logp).
PROOF. If a polynomial F G FP[X] of the form (9.1) splits completely over Fp,
then the equation
a1a;ri+--- + ana;r"=0, x € F*,

142 9. APPLICATIONS TO OTHER SEQUENCES
has at least (rn - r{)/n solutions. Indeed, the multiplicity of each non-zero root of
a polynomial of the form (9.1) does not exceed n (this is not true over arbitrary
finite fields, and this distinction is the main obstacle to an extension of the result
to general finite fields). From Theorem 9.3,
(9.5) (rn - n)/n = O
where
(9.6) .. D = min maxgcd(r,- - n,q - 1).
l<i<n j^i
For any fixed r\ and D j p — 1 there are at most
(9.7) o Upi-w»-i)Dm»-i)y-x D-
(n - l)-tuples (r2,... ,rn) satisfying (9.4), (9.5) and (9.6).
Taking the sum over all r\, 0 < rx < p — 2, and all divisors D\p — 1 and using
the well known estimate
d\M
gives the desired result. D
For n > 5, the condition (9.6) implies that there are at least three differences
Tj: — Ti, 1 < i < j < n, whose greatest common divisor with p — 1 is at least D.
Thus the bound (9.7) can be replaced with O(pn~2D~2), so Rn{p) = O (pn~l) for
n > 5.
The above approach works only for prime finite fields. On the other hand, for
polynomials over Z a similar (and even stronger) result was obtained in [1041].
This is based on relations of a rather different kind between algebraic polynomials,
linear recurrence sequences, and S-unit sums over function fields described in that
paper. The polynomials considered next are a generalization of sparse polynomials.
Theorem 9.5. Let n > 2, and let ipi,..- ,ipn and \&i,... , ^n be non-zero
polynomials with integer coefficients such that no two of the polynomials ^i,... , tyn
have the same set of zeros. Let rx,... , rn denote fixed integers. Define
m= max deg^, M = max deg\&;, p= min n, r= max n.
l<i< ' l<i< l<i< l<i<
Suppose that p > (n - 2)[1 + m + {M - l){n - l)/2], and that
is a polynomial of degree deg F > 6r where 6 > 0 is some constant. Then there
is an effectively computable constant' C > 0, depending only on the polynomials
¦01,,.. ,ifrn and ^i,... , \&n, such that the polynomial F has an irreducible factor
over Z of degree k > C log1/2 r.
The key idea of the proof is to view the polynomial F as an S-unit sum over the
rational function field Q(t). As usual, much stronger results are known for S-unit
sums over function fields (compared with algebraic number fields). Several such
new results about S-unit sums over function fields of zero characteristic are given
in [1041], Define as usual the norm of a polynomial / 6 Z[x\ to be |/| = 2desf and

9.1. ALGEBRAIC AND EXPONENTIAL POLYNOMIALS 143
denote by P(f) the irreducible factor of largest norm. Then Theorem 9.5 says that
|-P(-F)| > exp (C(LogloglFlI/2), which is much sharper than the corresponding
double logarithmic estimates for the largest prime divisor of a linear recurrence
sequences and 'dense' algebraic polynomials (cf. the remark before Theorem 6.1).
Ribenboim [1065] shows how the results about powers in linear recurrence
sequences outlined in Section 6.5 can be used to study possible factorizations of
trinomials xn — Bx — A.
Further, in [1201], rational exponential sums of the form
S(F,q)= ^ expBniF(x)/q)
for q an integer, are considered for n-sparse polynomials F given by (9.1). In the
particular case when q = pa is a power of a fixed prime number p > 3 (that is, when
the implied constant is allowed to depend on p), this bound is a direct consequence
of Theorem 5.7. Indeed, substituting x = gz where g is a primitive root modulo
p2 (any thus modulo any power of p > 3) the sum S(F,pa) can be reduced to a
sum involving a linear recurrence sequence of order n. It is shown in [1201] that
the method employed in [1183] to prove Theorem 5.7 allows the same bound to
be proved for any q. It is also observed there that one can consider the case when
some of the exponents ri are negative, and thus F is a rational function rather than
a polynomial.
Theorem 9.6. Let q > 1 and n > 2 denote integers, and' let F denote a
rational function given by (9.1) with distinct non-zero integers n,... ,rt. Assume
that gcd(g,ai ,an) = 1, and put r = max{|ri|,... , \rn\}. Then, for any e > 0,
where the implied constant depends on s and r.
Even in the most frequently used case of n = 1,... ,rn = n (thus r = n)
nothing essentially better than Theorem 9.6 is known (see [550], [725] for details).
The same bound (at least if all of n,... , rn are positive) may be applied to our
case as well, but it gives only
It is also shown in [1201] that the same trick works for exponential sums over
certain finite fields as well: Write
where x is a non-trivial additive character of ?2™ ¦ For such sums, there is the deep
Weil bound
Tm(F) < r2™/2,
where as before F is given by (9.1) with non-zero integer h,... ,rn and r =
max{|ri|,... , \rn\} (see [725] and [1202] for this and many other related results).
The following bound of [1201] is better than the Weil bound if r is large enough.
In particular, when r > 2m/2, the Weil bound gives nothing. However Theorem 9.7
is non-trivial.

144 9. APPLICATIONS TO OTHER SEQUENCES
Theorem 9.7. Let a G @,1) be a fixed real number, and let the exponents
n,... ,rn satisfy
r{2k ¦? rj (mod 2m - 1), 1 < i < j < n, k = 0,1,... , m.
Assume that
Bm-l,ru...,rn)<2am.
Then, for any rational function F given by (9.1) with a\,... ,at 6 F^m,
Tm(F)<7((l-a)/nJm + OBm), m - oo,
where j(X) = 1 — 2^>(A) and ip(\) is the unique root of the equation
-i/j log if) - A - ip) log(l - ip) = A
on the interval 0 < i> < 1/2.
The function 7(A) is the same as that of Theorem 5.4, and indeed that theorem
is an essential component of the proof of Theorem 9.7". One of the applications
of this results is an upper bound for k(ru... ,rt;m), the smallest k such that the
system
x\* H \-xr^=Ai, i = l,...,t; xu...Xk G F2-n
is solvable for any A\,... ,At G F2-n.
Theorem 9.8. Let a e @,1) denote a fixed real number and let the exponents
ru... ,rt satisfy
rx2k ¦? rj (mod 2m - 1), 1 < i < j < t, k = 0,1,... , m.
Assume that
.. .Bm-l,ri)<2am, i=l,...,t.
Then there is a constant C > 0 depending on a such that
u... ,rt;m) < Cmt2
Similar results can be obtained for any finite field of fixed characteristic.
The bounds E.3), E.4), E.5) can be written in the form
max
gcd(a,p) = l
p-i
x=l
rp
Certainly each estimate holds for all r — the trichotomy indicates which ranges
give the best bounds (one may easily check that the value x = 0 can be included
in the sum without harm).
In [579], some results from Section 7.1, in particular Theorem 7.3, are applied
to certain algorithmic problems about sparse polynomials. For example, for a
polynomial F 6 Fg[a;] given by (9.1) with 0 < n < • • • < rn < q — 1, denote
by V(F) the value set V(F) = {F(x) : x eFJ. Given an integer V > 0, how
quickly can one test whether |V"(/)| > VI The brute force algorithm takes time
g(loggH^1^. It turns out that for V < q1?71 this can be done faster. Moreover,
the representation (9.1) is not required: It is enough to know how to compute the
value of this polynomial at any particular point. Polynomials known in this sense
are called black-box.

9.2. LINEAR RECURRENCE SEQUENCES AND CONTINUED FRACTIONS 145
Theorem 9.9. Let F 6 Fq[x] denote a polynomial of the form (9.1) with
degF < q — 1, given by a black-box. Assume that a primitive root $ of Fq is
known. Then for any V > 0, \V(f)\ > V can be tested in time Vn(\ogq)°(-1K
Finally, regarding links between linear recurrence sequences and polynomials
there are the papers [625], [630], [1199] concerning bounds for polynomial congru-
congruences, and the papers [1040], [1192] on arithmetic properties of linear recurrence
sequences. These two groups of papers seem unrelated, but there are real links
between them. In [1192] a bound for the number of solutions of congruences in-
involving linear recurrence sequences is found (cf. Theorem 5.11). Later, it was shown
in [1199] that the same idea gives new non-trivial results for polynomial congru-
congruences as well. In [1040], a refinement and generalization of some of the results
of [1199] is given, as well as applications to congruences with linear recurrence se-
sequences (see Theorem 5.12). Konyagin and Steger [630] use an idea from [1199] as
well as several new ones. It is reasonable to ask if the process can go the other way:
Can new results on congruences with linear recurrence sequences be derived from
tho.se on polynomials? This is not straightforward, and further ideas are needed.
The approach of [630] does work for congruences with linear recurrence sequences,
but does not produce a better estimate than those of [1040], [1192].
9.2. Linear Recurrence Sequences and Continued Fractions
Consider the sequences (px) and (qx) of numerators and denominators of the
convergents of the continued fraction of a = [ci,C2,.-..] for some a 6 [0,1]..;In Sec-
Sections 5.4, 6.2, 6.5, results and techniques traditionally related to linear recurrence
sequences are applied to arithmetical properties of continued fractions. Here we
consider more explicit inter-connections between these two types of sequences.
The following natural question is considered by Lenstra and Shallit [702]: Given
an irrational a, could either of the sequences (px) and (qx) of the numerators and
the denominators be a linear recurrence sequence? The example of E1/2 — l)/2 =
[1,1,1,...] shows that this really can happen: In .this case px+2 = Px+i + Px- A
more subtle example is given by 31/2 - 1 = [1,2,1,2,...], satisfying the fourth
order recurrence px+A = 4px+2 — px- In both cases the same equations hold for the
denominators as well. Of course there is nothing special in these examples: Any
quadratic irrational has the same property, since for such a number the sequence
(cx) is periodic.
This statement is a direct consequence of the fact that if the coefficients
of the recurrence equation A.7) is periodic with some period T, then any solution
of this equation is a linear recurrence sequence (after some shift a(x + h), h €Z+)
of order at most nT; more details are given in [1028]).
Lenstra and Shallit [702] prove that this cannot occur for other irrationals.
Indeed, if (px) is a linear recurrence sequence then so are (px+2 — Px) and (px+\)-
By Theorem 4.4, this shows that (cx) is a linear recurrence sequence too. If there
is a characteristic root of (cx) with absolute value strictly greater then 1 then
Theorem 2.5 (Lemma 3 of [702] is another version of this result) or Theorem 2.6
shows that logpx 3> x2. However, this is impossible since px is a linear recurrence
sequence and therefore satisfies \ogpx < x. Hence, all characteristic roots are of
absolute value at most 1, therefore cx = 0A) and thus is periodic.

146 9. APPLICATIONS TO OTHER SEQUENCES
This result is generalized by Bezivin [106] in the following way.
Theorem 9.10. Let a and (cx) be sequences of integers such that
a(x + 2) = cxa(x + 1) + a(x).
If the generating function
r(X) =
h=l
is convergent in some non-empty disc on the complex plane, and satisfies a homo-
homogeneous differential equation, then (cx) is periodic and there is a shift leZ+ such
that (a(x + ?)) is a linear recurrence sequence.
A consequence of this result is that any sequence of quadratic irrationalities of
bounded period does not converge. Apparently there is an effective form of this
result. Bezivin [106] also obtains similar results for sequences satisfying a ternary
recurrence equation with variable coefficients. Again the key to all these results is
Theorem 4.4, which gave the solution to the Hadamard Quotient Problem.
The paper [466] treats general approximation properties of quotients of two
binary linear recurrence sequences with the same characteristic polynomial. It is
shown that their behaviour depends on the sign of the discriminant of the char-
characteristic polynomial. Approximations by quotients of consecutive terms of linear
recurrence sequences of higher orders are studied in [596], see also [306], [308],
[307]. In [1023, Sect. 2], interesting links are exhibited between linear recurrence
sequences, S-unit equations and a problem of Mendes Prance [808] on continued
fractions.
For a non-integer rational r, denote by L(r) the length of its continued frac-
fraction expansion. Mendes France [808] asks about the behaviour of L ((k/?)x) for
gcd(k,?) = 1, k > ? > 1. In [1023], a reconstruction of Pourchet's unpublished
proof that L ((k/?)x) —> oo as x —* oc is given. Later, Choquet obtained the same
result by another method (see [810] for the details and other relevant problems and
results). The strong conjecture is made that
lim -L ((k/?)x) = 121°g2 log^
z-*>oo x IT
for any 1 < ? < k with gcd(A:,^) = 1.
The proof of [1023] can be transferred to the case of continued fractions with
linear recurrence sequences.
Theorem 9.11. Let a and b denote integer linear recurrence sequences, each
having a unique dominating characteristic root a.\ and f3\, respectively. Assume
that |qi| > \3i\. If gcd (a(x),b(x)) = 1 for all x, then
Km L (|a(a;)/6(a;)|) = oc.
X—>CC
The proof depends on results about 5-unit equations, so is not effective. Recall
that L (f(x + I)/f(x)) > x for the Fibonacci sequence and this is the only extremal
example giving the worst case for the Euclidean algorithm. This example is not
covered by Theorem 9.11. On the other hand, in many cases one can effectively
estimate L(\a(x)/b(x)\) for sequences with the same dominating root. For such
sequences, it is enough to observe that

9.2. LINEAR RECURRENCE SEQUENCES AND CONTINUED FRACTIONS 147
and then use various properties of convergents to an algebraic number \A\ {x)jB\ (x)\
(using both the effective Liouville Theorem and the non-effective Roth Theorem).
On the other hand, the example a(x) = 2X, b(x) = 2X + 1 for which
2* + 1 1 + -L '
shows that for rational \A±{x)/B\(x)\ such a result cannot be expected.
A similar question was considered by Grisel [481], For a quadratic irrationality
a denote by T(q) the period length of its continued fraction expansion. It is known
that T(a) < 2 if a is a quadratic unit, so T(ax) < 2, x = 1,2,..., for any
such a. Grisel [481] shows that for many quadratic irrationalities, T(ax) grows
exponentially fast.
T{an) >C(a)n-1exp(c(Q)n),
where C(a) and c(a) are explicit positive constants. The result is based on results
about the prime divisors of convergents. For the special case a = c/1/2. where d > 2
is a square-free integer, better lower bounds are known [483].
In another paper, Grisel [482] proves an. analogue of Theorem 9.11 for continued
fractions of power series over a field of zero characteristic (except for polynomials
and their reciprocals). The case of fields of positive characteristic is considered
as well: For such fields, the corresponding limit does not exist. Instead, one can
consider the lower and upper limits which are finite and infinite, respectively.
For some special linear recurrence sequences a the continued fraction expansions
of y/a(x) is of special interest because the period length can sometimes be estimated
from below. An example is the Shanks sequence
(9.8) Sx = Ax + 8 • 2X + 1.
Although a number of generalizations are known [1031], [1353]. the general case
of arbitrary linear recurrence sequences has not been studied yet. An application
of such sequences is' to the difficult problem of finding explicit formulae for units of
quadratic fields.
In Section 13.1 parameters rs(/, m,p) and ps(A, M) related to the quality of
pseudo-random number generators from linear recurrence sequences are studied
(see page 212 and 214). For s = 2, both of these can be expressed in terms of
continued fractions. In the function case the following formula holds (see [930]
or [936, Theorem 9.9]). For any polynomial / of degree n over Fp,
r2(/,n,p) = n + l-F(/),
where H(f) is the largest degree of the partial quotients of the continued fraction
expansion of f(X)/Xn. Niederreiter [928] has shown that
i=0
where k is defined by 2k < n < 2fc+1. This holds over any field and can even be
slightly generalized, see [928]. Unfortunately, it is not useful for pseudo-random
number generators since the arithmetic nature of such polynomials is not known,
while for the application mentioned we need irreducible or primitive polynomials

148 9. APPLICATIONS TO OTHER SEQUENCES
over finite fields. Having this application in mind, Niederreiter [928] proves that
there is an irreducible polynomial / 6 Fg[-X] of degree n such that
2 + 21oggn,
and there is a primitive polynomial / 6 Fg[X] of degree n such that
The main disadvantage of these two results is that they are obtained by a non-
constructive method and give no clue how to efficiently find such polynomials (nei-
(neither does Theorem 13.2). Also, it has been conjectured that the two expressions on
the right-hand sides of these inequalities can be replaced with absolute constants.
Finally, notice that the same results hold (this is proved in [928]) for partial quo-
quotients of more general fractions f/g for any polynomial g 6 -^[-X"] with only one
exception: q = n = 2, g(X) = X2 + X + 1 for an irreducible numerator and with
two more exceptions, q = 23 , n = 1, g(X) = X + 1 for a primitive numerator.
Several more results about polynomial fractions f/g with small partial quo-
quotients can be found in [119], [681], [682] [683], [684]. In the integer case [936,
Theorem 5.17] shows that for any co-prime integers A and M,
where H(A,M) is the largest partial quotient of X/M (with a minor modification
— the last element is allowed to be 1).
It is known (see [925] or [93.6, Chap. 5]) that
(9.10) H (f(h), f(h + 1)) = 1, P2 (/(/i), f(h + 1)) = f(h - 1) > |/(/i + 1)
for two consecutive terms f(h) and /(/i + l) of the Fibonacci sequence. This gives a
very simple explicit construction: Recall that f(h)/f(h+ 1) is the /i-th convergent
to E1/2 - l)/2 = [1,1,... ,] (a further discussion is in [925]).
It is not difficult to show that for any M
K(M)= min F(A,M)<logM.
gcd(A,A/) = l
It is an old conjecture of Zarenlba that K{M) < 5. Recently, Niederreiter proved
that KBk) < 3 for powers of 2. It "is also known that
(9.11) KB2"-1)<2.
These and many other results about numbers with bounded partial quotients and
their applications are presented in the exhaustive survey of Shallit [1155] (see
also [530] and [936, Chap. 5]).
Laurent series over finite fields with the property that their continued fraction
expansions have bounded partial quotients are also related to the theory of pseudo-
pseudorandom numbers, see Theorem 13.11 below.
It is shown in [18] that the product
has linear partial quotients over Q((X)); this is a consequence of the identity
F(X) = A + 1/X)~l/2 in characteristic 3. Cantor [206] generalizes this result

9.2. LINEAR RECURRENCE SEQUENCES AND CONTINUED FRACTIONS 149
and presents an entire family of examples which establishes another link to linear
recurrence sequences. He considers functions of the form
and shows that any such function has linear partial quotients over a field F not of
characteristic 2 if and only if there no zeros in the binary linear recurrence sequence
au>v, where
au>v(x + 2) = uaUjV(x + 1) - 6aUjV(x), x E N,
with the initial values aUiV(l) = 1, au>vB) = u/2, where 5 = u2/A-v ^0.
In Chapter 4 power series in linear recurrence sequences are considered. Similar
power series are related to the theory of continued fractions. In particular, they
produce uncountably many numbers with partial quotients 1 or 2 only. Follow-
Following [1039], for any binary expansion a = O.aia2... set ao = 0 and consider the
power series
h=0
where Mh — 2h — 1, h = 0,1,... are Mersenne numbers. The paper [1039] describes
the complete structure of partial quotients of any specialization ^(r) with rational
r > 2, and in particular, any number FaB) has partial quotients 1 and 2 only.
Choosing ah — 0 for h > k gives (9.11). This line of research, studying continued
fraction expansions of specializations of power series of the form
h=0
for a linear recurrence sequence a, is pursued in many papers. For more results and
conjectures consult the expository paper [1029].
Normal numbers were the primary motivation for the notion of normal con-
continued fractions and subsequent research in this direction [1045], [1046]. Let
A = (Si,... ,Sa) denote an s-tuple of positive integers and denote by M(A) the set
of all numbers 0 < a < 1 whose continued fraction expansion starts with A. The
Gauss measure is defined by
... 1 f dx
^ = hT2
Then a has a normal continued fraction expansion a = [ci, C2,... ] if for any A
lim i-
N-+oo IS
where Ta (N, A) is the number of occurrences of the tuple A among
(Ci,... ,CS), (C2,...
It is known that almost air numbers 0 < a < 1 have normal continued fraction
expansions (see [260]). In [1045], one can find analogues of many results on normal
numbers such as Theorem 8.4, as well as explicit constructions. On the other hand,
there does not seem to be any construction with a good explicit bound for the error
term analogous to Theorems 8.6-8.8.

150 9. APPLICATIONS TO OTHER SEQUENCES
9.3. Combinatorial Sequences
In this section several unrelated sequences that have been studied using linear
recurrence sequences are considered. The first is the sequences of values of Ra-
manujan's r-function, denned to be the sequence of coefficients of the power series
expansion
oo oo
r(h)zh, \z\<l.
h=l h=l
The second is the sequences of Bell numbers B, denned by
exp(exP2 - 1) =
There are several equivalent definitions. There is a direct formula
h=0
and a recurrence relation
h=0
There is also a combinatorial definition: B(x) is the number of partitions of a set
of x elements into non-empty subsets. Finally, the Bell numbers arise as the coef-
coefficients in a formula for the higher derivatives of the composition of two functions.-
Although neither of them is a linear recurrence sequence various results about linear
recurrence sequence can be applied to these sequences. The first sequence contains
very interesting subsequences which are binary linear recurrence sequences, and the
second sequence is a linear recurrence sequence modulo any integer m.
9.3.1. Ramanujan's r-function. The recurrence equation
(9.12) r(/+2) = r{p)r{ph+1) -pnr{ph), heN
which holds for any p € P, gives a link between this function and binary linear
recurrence sequences, which already leads to interesting facts about this famous
function. There is more: r is multiplicative, so the values r{ph) determine its
behaviour. To be more precise, several results from [892] and [1172] are presented.
Although Deligne [286] has proved the very precise upper bound r(p) < 2pn/2,
we still do not know non-trivial lower bounds for r(p). The following result [892],
[1172] gives a lower bound for t(x) when r(x) is odd, which unfortunately gives
no information about values of r(p), which are known to be even.
Theorem 9.12. There is an absolute constant c > 0 with the property that for
any x for which r(x) is odd, |r(x)| > logcx.
Proof. It is enough to prove this bound for r(pm), m > 2 only. For large m, using
linear form, in logarithms (just as in the proof of Theorem 2.4) one can show that
there is an absolute constant C > .0 such that
where
J 1, if m is even;
r(p)s if m is odd.

9.3. COMBINATORIAL SEQUENCES 151
Apart from the constant 7m(p), this follows from Theorem 2.4. Indeed, since r(p) <
2pn/2, the characteristic roots of (9.12) are complex conjugates with absolute value
p11/2. Thus, since r(l) = 1,
|m/2| ,
(9.13) T(pm)=7m(p) II (r(pJ-4p11oos2-^T).
—\ \ Tn + i j
In particular, if m is even it follows that r{pm) = 0 if and only if r(p) = 0. Indeed,
4 cos2 (nr/(m + 1)) is an algebraic integer and therefore can be rational only if it
is 1, 2, or 3. However, none of r(pJ — p11, r(pJ — 2pn, r(pJ — 3pn can be zero
since rB) = -24 ^ ±26 and rC) = 252 ^ ±36.
Thus for in sufficiently large we are done. The case of small in > 2 needs
separate considerations which are based on the representation (9.13). This can be
viewed as a binary form in t2(u) and p11, and such forms are well studied in the
theory of Diophantine equations [1233]. There are two cases. If m > 6 then this
form has at least 3 distinct linear factors, and it is possible to show that there is a
constant a(m) > 0 such that either r(pm) = 0 or
\r(pm)\ > pa(m).
The case m < 5 is carried out by hand. The identities,
r(p3) = r(p) (r{pJ - 2pn) , r(p5) = r{p) {r(pJ - pn) {r{pJ - 3pn)
show that
min{|r(p3)|, |r(/)|} > ±Pn/2
whenever r(p) ^ 0. Also,
PU + r{p2) = r(pJ, 5p22 + 4r(p4) = Br(pJ - Sp11J '
and general bounds [1233] for the solutions of the equations f(x) = y2 then give
min{|r(p2)|, |r(p4)|}>logcp
for some absolute constant c > 0. D
The proof shows that the real constraints are r(p2) and r(pi), where nothing
better than a logarithmic lower'bound is known. Shorey [1172] shows that similar
arguments also lead to lower bounds for P (r(x)), and also proves an effective upper
bound maxjm, n, p} over all solutions (m,n,p) of the equation r(pn) = r(pm) with
m ^ n, p G P with r(p) ^ 0.
9.3.2. Bell numbers. In studying arithmetic properties of Bell numbers the
recurrent congruence
(9.14) B{x + p) = B{x + 1) + B{x) (modp), xeN.
for any p e P plays the central role. It follows from this congruence that the
sequence is purely periodic modulo p with some period Tp dividing ^f^ • There is
a conjecture (supported by calculations, see [1323]) that
pP-1
(9.15) Tp =
p-1

152 9. APPLICATIONS TO OTHER SEQUENCES
Although this conjecture is still open, a good lower bound for Tp is proved by
Lunnon, Pleasants and Stephens [765],
(9.16) Tp >
Radoux [1060] shows that the congruence B(x) = 0 (mod p) is solvable for any
prime p for which (9.15)holds. In fact this follows from-Theorem 7.1 or Theorem 7.2
(since the characteristic polynomial is the Artin-Schreier polynomial
which is known to be irreducible over Fp). Layman [692] demonstrates that this
and a stronger statement are valid for any p independently of the still un proven
conjecture (9.15). He shows that any prime p is a maximal divisor in the following
sense: There is an Mp such that
+ k) = 0 (modp), k = 0,1,... ,p - 2.
Moreover, an explicit expression for Mp is given: One can take
Let Jp denote the index of entry of p in the sequence of Bell numbers (as for linear
recurrence sequences, this is the smallest x with p B(x)). The existence of Jp
follows from Layman's result above. Independently, the existence of Jp has been
proved in [1192]: moreover the upper bound
JP <
is shown. The proof uses the same arguments as does the proof of Theorem 7.4:
Jp does not exceed the order of the sequence W(x) = B(x)p~1 - 1 (provided it is
known that Jp exists). This estimate immediately produces
Log log N
and shows that P (B(x)) > ^ logx infinitely often. Furthermore, it is demonstrated
in [1200], that for any integer a the congruence B(x) = a (mod p) is soluble, and
the minimal solution Jp(a) satisfies
p-1
Using this result, define Np and Gp to be the smallest x for which B[x) is a quadratic
non-residue modulo p and a primitive root modulo p, respectively. By considering
the sequences (over Fp)
U(.t) - 5(z)^+1) - B(x), V(x) = JI (B(x) - A),

9.3. COMBINATORIAL SEQUENCES 153
where A is the set of all V"= p - ip(p - 1) elements of Fp which are not primitive
roots, one obtains
Gr <
j=o
Both these bounds are better than the trivial Np < Gp < Tp. If the conjecture (9.15)
holds this is obvious, but even (9.16) gives
(9.17) Np = O(Tp0-69), Gp < Tpexp(-clogTp/LogloglogTp)
for some absolute constant c > 0. For more details see [1200].
Quite recently Voloch [1310] published an improvement of (9.16),
Tp > 2254p
which in turn implies the following improvement of (9.17):
Np = O(Tp0-55), Gp = O(Tp0-79).
It is interesting to remark that the primary motivation of the results of [1310] is to
sharpen the deterministic polynomial time primality testing algorithm of Agrawal,
Kayal and.Saxena [4]. Several generalizations of these results are possible. Follow-
Following Layman [692], define Bs by the expansion
exp (s(exp z-l)) = 2^ Bs{h)zh/h !
h=0
for an integer s. Then, instead of (9.14),
and everything follows along more or less the same lines.
9.3.3. Other combinatorial sequences. Granville and Sun [477] extended
work of Sun [1265] to show how to express residues modulo a prime p of Bp-i(a/q) —
Bp-i (where Bp-x{a/q) is the Bernoulli polynomial of degree (p - 1) evaluated at
a/q and -Bp_i is the (p— l)th Bernoulli number) in terms of the values of some linear
"recurrence sequence of order [q/2\. Sun [1266] uses linear recurrence sequence to
express values of Ylk=r mod m (fc) • The family of d-th. binary partition sequences
bd is defined as follows: bd{x) is the number of representations of x G N in the form
oo
i=0
Thus, (b2{x)) is the sequence A,1,1,...). The first non-trivial example is the Stern
sequence s(x) = bz(x) (the next sequence is less interesting, as b^{n) = \n/2\ + 1).
The Stern sequence satisfies the relation
( \ _ / * ([cc/2j), if cc is even;
S[X' ~ \ s{[x/2\) + s{[x/2\ + 1), if x is odd;
with the initial values s@) = 0, s(l) = 1. Other sequences in the family satisfy
similar but more complicated relations.

154 9. APPLICATIONS TO OTHER. SEQUENCES
The Euler binary partition sequence b^ is denned by
boo(z) = lim bd{x).
d—>oo
An alternative definition uses the power series expansions
fc=0 h=0 fc=0 h=Q
Reznick [1064] gives an extended account of these sequences. In particular, it has
been shown that the theory of linear recurrence sequences is useful in studying the
growth of such sequences as well. In 1940, Mahler demonstrated that
log2 a:
Reznick [1064] shows that if d is even then
(9.18) z10**-1 > bd(x) >
Next we present an elegant argument from [1064], showing that if d is odd then
lim sup log bd{x)/ log x > lim inf log bd(x)/ log x.
X-KX X—>OO
It makes use of two basic facts. The first is the identity
h=0
so the previous inequality ultimately implies that A — logo? — 1. If Bd(x) = bd{2x)
then log Bd{x) ~ Xx. We need to know that Bd satisfies a linear recurrence equation
with integer coefficients of order d, (the order is not important at the moment but
will become important later). The results of Section 1.1 show that logBd(x) ~
x log a infinitely often, where a is some algebraic integer. It follows that d/2 = a
is an algebraic integer, which is impossible. These arguments can be put in the
quantitative form
(9.19) lim sup i2iM^l _ liminf Iog6d(x)log.x > Bd)-d~2
x^oo log a: x—oo
for any odd d > 3. Assume now that fii(d) > /x2(of) are two functions such that
Then, as before, ni(d) - ^{d) > | log a - log(d/2)|, where a is a characteristic root
of some recurrence relation. It is enough to show that
<J=|a-d/2| >2~d{d + l)-d-1.
We can certainly assume that 6 < 1/2, otherwise there is nothing to prove. Reznick
shows that the characteristic polynomial of that relation,
f(X) = Xd- fd-iXd~l fiX-fo,
is the characteristic polynomial of some 0,1-matrix of order d with at most (d+ 1)
non-zero elements in each row. Thus each characteristic root is of absolute value
at most (d+ l)/2. Therefore, if
g{X) = Xk + g1Xk~1 + --- + gk-iX + gk

9.3. COMBINATORIAL SEQUENCES 155
is the minimal polynomial of a, then k < d and
Now g(a) = 0; on the other hand, g(d/2) ^ 0, so \g(d/2)\ > 2~k > 2~d. Hence,
since 8 < 1/2,
E (t ,) (^)
* ' E (t *,) (^J-w+1)- - «-'w+D*« E (t fc_;
Therefore
|loga-log(d/2)| = |logBa/d)|»|l-2a/d|>2<J/d
and (9.19) follows.
Although there is little hope of an asymptotic formula for bd(x) if d is odd,
quite tight upper and lower bounds can be obtained nevertheless.
where
M.(«0 = log BS + 1 + (f+ 1)'/2) nW = log
if d = 4s + 1, and
. /25 + l + D52 + 85 + 5I/2\ ... . / n ,2 u/2\
= log f i-^ '-—J, /x2(d) = log (s + 1 + {s2 + 5I/2J
if d = 4s + 3. Thus,
Iog6d(z) r . flog6d(x) !
hm sup —-—1-i - lim mf ——-— < a
log x x^oo log a:
X—»OO
It is also shown that for the Stern sequence s(x) = 63 (x) both bounds
are attained: see [1064].
Some results and conjectures about the distribution of such sequences modulo
m are known as well, see [1064]. For integers m, d, a define the set
A{d,m,a) — {x : bd(x) = a (mod m)}.
Reznick [1064] conjectures that for any m, d, a, A{d,m,a) has a well-defined
density. This holds for d — 2k, and any m, a, for m = 2 and any a and d and a few

156 9. APPLICATIONS TO OTHER SEQUENCES
other known cases. There is one more result (taken from [1064]),
Kiss and Zay [607] consider the number Fk(x) of 0,1-sequences of length x having at
least k - 1 zeros between any two ones, and the total number Wk(x) of ones in these
sequences. It turns out that the sequence Fk is a linear recurrence sequence with
characteristic polynomial fk{X) = Xk, - Xk~l - 1, while Wk is a linear recurrence
sequence with characteristic polynomial f%. The initial values are found as well.
As an application, the asymptotic formula
)
is given for the average density
Fk(x)
Gk(x) =
xwk(x)
of ones in such sequences, where a.k is the unique dominating zero of fk.
Grady and Newman [471] discover very similar congruences for coefficients of
the generating functions
h=0
where M(h) is the numberof subgroups of index h of the group G.
Another possible generalization is to consider the behaviour of Bell numbers
modulo a composite m. An analogue of (9.14) exists [765], but the details are
messy. The technique above is not applicable to sequences over rings with zero
divisors; nonetheless, some non-trivial facts can be found in this way.
There are other natural combinatorial sequences to which the theory of lin-
linear recurrence sequences can be applied. The majority of such sequences come
from group theory, where the general philosophy is as follows: For many para-
parametric families of groups, the'corresponding generating function is rational. The
same is also true for many other generating functions, including zeta-functions of
algebraic varieties over finite fields [725], zeta-functions of iterations of polynomial
mappings [537], Poincare series [131], [287], [1110], and many others. An imme-
immediate consequence is that the coefficients of such functions are either of polynomial
or exponential growth. Such results are similar to the famous Gromov Theorem
(see [484], [746], [900], [1287] and references). In particular, it follows that the
generating functions corresponding to the groups studied by Lubotzky [746] cannot
be rational.
Du Sautoy [1111], [1112] discovers another quite different connection between
the generating functions of some groups and linear recurrence sequences, and the
Mersenne numbers in particular. The question of rationality of such a generating
function depends on how the number of solutions to the equation
9-1
varies in (q,n.k), where p is a fixed prime number, q G P, n,k G N. This is a
particular case of the equation (9.25) below. Accordingly, it follows from Theo-
Theorem 9.15 that there are only finitely many such solutions with n > 3. The case

9.4. SOLUTIONS OF DIOPHANTINE EQUATIONS 157
n = 2 and p > 3 is obvious: q + 1 = pk implies that q = 2e, giving a particular case
of the Catalan equation (see below) with fixed bases, pk — 2l = 1. There are very
general statements about the finiteness of solutions of general Catalan equation as
well as results about the growth of the distance between two powers. All of them
ultimately lead to an effective upper bound for such k and L It is possible that in
this case some elementary considerations would suffice to show that the equation
is solvable for p = 3 only, where there is the unique solution ? = 3, k = 2 (this
certainly follows from the old conjecture about the Catalan equation, see [1066],
[1181, Chap. 12] and [1285]). The only non-trivial case is n = 2 and p = 2. In
this case the equation has infinitely many solutions if and only if there are infinitely
many Mersenne primes q = 2k — 1.
Primitive prime divisors of qh — 1 play a role in several group theory algorithms;
more details can be found in the exhaustive survey by Praeger [1050], see also [495].
Nabney [900] applies results of Evertse [376] and van der Poorten and Schlick-
ewei [1037] to derive a new result about equations with recurrence sequences, and
applies it to a problem in group theory. Schmidt and Ward [1141] apply results
about S-unit equations to study mixing properties of Zd-actions by compact group
automorphisms. The paper [546] applies 5-unit equations to the problem of powers
in finitely-generated groups. Lichtman's papers [723], [724] address the problem
of extending the Tits alternative to linear groups over division rings, and exhibit a
connection with Artin's conjecture. Some of the questions raised by Lichtman are
successfully resolved by Murty [890]. Finally, [9] makes use of Fibonacci and other
binary linear recurrence sequences to get new results on the structure of the units
in certain integral group rings.
9.4. Solutions of Diophantine Equations
There are two major types of Diophantine equations related to linear recurrence
sequence. The first class is the Norm-form equations, the second is the class of
exponential equations. Both are discussed in great detail in the monograph [1181]
by Shorey and Tijdeman; see also [1175], [1285], [1286]. Here we present a brief
overview, and give some results which are not included in that book.
The first connections between Diophantine equations and linear recurrence se-
sequences go back to -Skolem's classical result concerning finiteness of the number
of solution of the Thue equation F(x,y) = 0 for a binary form F G Z[X,Y] such
that F(x, 1) = 0 has at least one complex root, see [1233]. It is possible that this
work motivated Skolem to study linear recurrence sequences themselves, and led to
the first really non-trivial result in the theory of linear recurrence sequences, the
Skolem-Mahler-Lech Theorem 2.1 on page 25. This work can be described in a
more general setting. Let K denote an algebraic number field of degree n over Q.
For an integer A, consider the Norm-form equation
(9.20) N(tf) =A, tf € ZK.
Sometimes it is convenient to write this in an equivalent form: Let {u>i,... ,uin)
denote an integral basis for ZK over Z. Then (9.20) can be re-written as the equation
(9.21) N(tiUi + --- + tnu)n) = A, tu...,tneZ.
If (fix,... , nn) is the dual basis to (u;x,... , uin) — the unique basis with
Sitj — then U =

158 9. APPLICATIONS TO OTHER SEQUENCES
To see the relationship between such equations and linear recurrence sequences,
exponential polynomials, and finitely generated groups it is enough to notice that
if -^ is a solution of (9.20) and ? is a positive unit (that is, a unit of norm 1) of Zk,
then tie is another solution. Calling such solutions equivalent, the set of solutions
can be separated into classes of equivalent solutions. The main result of the theory
claims that there are only finitely many equivalence classes of solutions [131].
This result can be re-formulated as follows. Let (e\,... ,er) be a multiplicative
basis of the group of positive fundamental units of Zk. Then there is a finite number
of solutions ^i,... , tffc such that any other solution i9 = (t\,... ,tn) of (9.20), (9.21)
has a unique representation in the form
-d = -dmeXl ...eXr, l<m<k, xu ... ,xr G Z.
relating the theory to finitely generated groups. On the other hand.
ti = T(^mexl1...,ex'~), l<m<k, Xl,...,xreZ.
for all i = 1,... , n,. If du and r — 1 variables (say X2,... , xr) are fixed, then each
U is a linear recurrence sequence in x\.
Notice that the Thue equation is a particular Norm-form equation with the
additional condition that d has only two non-zero components, so ?3 = • • • = tn = 0.
Thus the Thue equation is related to a question about zeros of linear recurrence
sequences, or more generally about zeros of multi-variate exponential polynomials.
Moreover, if r = 1 — the interesting case of binary quadratic forms — then
there are no variables to fix, so the set of solutions comprises several binary recur-
recurrences.
Denote by T(N) the set of solutions of (9.21) with \ti\ < N, i - 1,... , n. It is
observed in [1195] that Theorem 6.2 yields the following.
Theorem 9.13. Let f G Z[t\,... ,tn] denote a polynomial such that for any
a € Z the equation f(t\,...,tn) = a and (9.21) have only finitely many common
integer solutions. Then
ul Yl max {1, !/(*!,... ,tn)\} > log N/Log log N.
tll...,tn€T(N) j
This bound is of the correct logarithmic order: We should expect that
logriV«|T(iV)|«logriV,
and indeed there are many classes of equations for which this is true (cf. the known
asymptotic for a related function Sa(Q) given in Section 2.1). For such an equation
we easily obtain the upper bound O (logr+1 N/ Log log N) for the number of prime
divisors of the product appearing in Theorem 9.13.
In the same spirit, results about powers in linear recurrence sequences can be
applied to the study of the Diophantine equation
(9.22) " au2k + bukv + cv2 = d
in integer variables k,u,v. This is equivalent to studying fc-th powers among the
sequence of values of first coordinates of solutions of the binary quadratic equation
ax2 + bxy + cy2 = d (which may have infinitely many solutions if b2 > 4ac). This
sequence is a binary linear recurrence sequence, and an approach using this was
developed by Shorey and Stewart [1179], [1180]. The most general result is the
following [1180, Theorem 2].

9.4. SOLUTIONS OF DIOPHANTINE EQUATIONS 159
Theorem 9.14. Let G(U, V) = aU2 + bUV + cV2 + dU + eV + f e Z[U, V]
denote a quadratic polynomial such that
{b2 - 4ac){4acf + bde - ae2 - cd2 - fb2)f ^ 0.
Let F(U, V) € Z(?/, V) denote a binary form of positive degree such that
(aa2 + ba + c) Df(aa2 + ba + c)- (da + eJ) ^ 0
for at least one root a of F(w, 1) = 0. Then for any integer Q there is an effective
constant C(G, F, P) such that for any solution of the system of equations
G{u,v) = 0, F(u,v) = swk,
k.s,u,v,w eZ, k > 1, |iy| > 1, P(s) < P,
max{fc, s, u, v. w) < C(G, F, P).
Another class of Diophantine equation to which the theory of recurrence se-
sequences can be successfully applied is the class of exponential equations. For equa-
equations with fixed bases of exponents this is clear, but it is less evident for equations
where the exponents as well as their bases.are variables. To deal with such equa-
equations 'uniform' results about recurrence sequences are needed; these are results
with absolute constants which do not depend on the sequence. Examples of such
results are the multiplicity bounds B.2), B.3) and the estimate F.4) giving a lower
bound for the greatest prime divisor of Lucas and Lehmer numbers with absolute
constants. For a systematic account of this idea see Shorey and Tijdeman [1181]
and also [1175]. [1285], [1286]. It is important to emphasize that there is still no
general theory for such equations, and it is almost impossible to recognize if such
an equation can be treated successfully or not at a glance.
To illustrate the difficulties, consider the innocuous exponential equation
(9.23) ux + vx + wx = 0, u, v, u\ x E Z, uvw ^ 0, x > 3,
a Diophantine problem whose lengthy history inspired a great deal of mathematical
developments and ended in a highly non-trivial denouement (see [1034]. [1076],
[1275], [1352]). Frey's idea of reducing the Fermat equation (9.23) to a question
about elliptic curves works in another situation also: Adachi [1] uses this approach
to show that if .4. B, C, a, b, c are relatively prime natural numbers then the equation
Aax + Bby = Ccz has finitely many solutions, and all of them can be effectively
determined.
For the famous Catalan equation
ux-vy = l, u,v,x,y E Z, u,v,x,y > 2,
Tijdeman shows that there are only finitely many solutions, and for many years
it was conjectured that 32 - 23 = 1 is the only solution: The gap between the
two statements is a matter of checking a (very) large number of cases, see [1066],
[1181], [1175], [1285], [1286]. That this is the only solution has recently been
shown by Preda Mihailescu — see [115] and [826].
Van der Poorten [1016] shows that the same approach works for the equation
ux -vy = (pi. ..pr)m(x-y), u,v,x,y E Z, u,v,x,y > 2.
where p\,... ,pr are fixed primes, and [1181, Theorem 12.4] extends this even
further. These results generalize to algebraic number fields [162] and function

160 9. APPLICATIONS TO OTHER SEQUENCES
fields; good lower bounds are also known for the difference ux - vy, see [1181,
Notes to Ch. 12]. On the other hand, the Pillai equation
aux — bvy = c, u, v, x, y € Z, u, v, x, y > 2.
cannot be treated by this method.
Using the lower bound mentioned above for the greatest prime divisor of Lucas
numbers, Gyory [500] shows that for any P and u, any solution of the equation
= s, s, u, v, x e N, u > v, x > 3, P(w) < P, u(s) < u.
ux — vx
u — v
satisfies
x < P, max{s, u, v} < exp
We may assume that s < tt(P), giving an estimate in terms of P only.
Denote by s(N) the number of solutions of the equation
(9.24) ~ = N, u, x e Z, u > 2, x > 3.
u ~ ¦"¦
An arithmetic interpretation of s(N) is that it is the number of bases with respect
to which N has the representation 1... 1. There is a conjecture (supported by
computations) that s(N) < 1 for any N ^ 31,8191. This is verified for all N up
to 104 (this material is taken from [1173]). Shorey shows that if N ^ 31,8191 and
u(N-l) < 5, then there is at most one solution of (9.24) with x odd. In particular,
this is the case for any solution if N is prime. Thus if p ^ 31,8191 is prime and
v(p — 1) < 5 then s(p) < 1. He also observes that the number of such primes p < L
is at least of order L/ log2 L, and proves that
/ max{0, 2^(iV-l)-3}, if u(N - 1) < 3;
S[ )-\2u{N-l)-A, if u(N - 1) > 4,
which in many cases is better than the estimate s(N) = O ((logiVI/2"*) due to
Loxton (recall that u(k) ~ log log A; for almost all fceN, but u{k) can reach the
order log kj log log k for some k)..
For special values of N it is known that s(N) = 0. For instance, s(N) = 0
for N = Mp + 1 with M E N, p E P, see [693] (in [1173] this result is stated for
sufficiently large values of N).
Another important equation for many applications (see Section 9.3, for exam-
example) is
(9.25) ——- = vy, u,v.y>2,x>3.
u — 1
Shorey and Tijdeman conjecture that this equation has only finitely many solu-
solutions. The following statement, [1181, Theorem 12.5], provides background for
this conjecture.
Theorem 9.15. The equation (9.25) has only finitely many solutions, which
can be effectively bounded if at least one of the conditions is satisfied:
• u is fixed;
• x has a fixed prime divisor;
• v has a fixed prime divisor.

9.4. SOLUTIONS OF DIOPHANTINE EQUATIONS 161
This equation was also studied by Bugeaud [174], [177], by Bugeaud, Hanrot
and Mignotte [181], by Bugeaud and Mignotte [182], [183], [184], by Bugeaud,
Mignotte and Roy [185], by Le and Yu [1370], by Saradha and Shorey [1103] and
by Shorey [1174], [1176]. In particular, it is shown in [1370] that the equation has
no solutions with gcd(u<f(u), y) = 1, and that for x = 1 (mod y) the only solution
is u = 3, v = 11, x = 5, y = 2.
Nesterenko and Shorey [921] study the equation
xm — 1 yn — 1
— ~, •*-,(/ c. Li x r y-i ''<¦¦> n ^ &•
x — 1 y — 1
Applications of linear recurrence sequence to Diophantine equations are not
limited to the two large classes above. There axe many other particular equations
whose solutions are related to some recurrence sequences (linear or non-linear).
They are hard to describe systematically, so just one example will be discussed.
The Egyptian fraction equation is
N N
(9.26) En
in Uh € N. The sequence a(x + \) = a(xJ — a(x) + l, a(l) = 2 satisfies this equation
(where ux = a(x)). This sequence appeared in Section 6.3, where it was noted that
a(h + 1) = a(l). ..a[h) + 1. Let E{N) denote the number of solutions of (9.26).
From [158, Lem 2]
E{N) > \t (a(N - IJ + 2a(N - 1) + 2),
which can be used to get a lower bound for E(N).
Bugeaud [176] gives an application of the results of [116] to certain Diophantine
equations.

CHAPTER 10
Elliptic Divisibility Sequences
In this chapter we expand on Section 1.1.17, and show how elliptic divisibility
sequences and their growth rates relate to the geometry and arithmetic of the under-
underlying curve. The question of periodicity and prime appearance in these sequences
is discussed, both from a heuristic and rigorous viewpoint.
10.1. Elliptic Divisibility Sequences
An integral divisibility sequence u is an elliptic divisibility sequence if for all
m > n > 1 it satisfies the recurrence relation
A0.1) u(rn + n)u(m- n) = u(m+ l)u(m - l)u(nJ - u(n + l)u(n - l)u{mJ.
Taking n = 2 shows that an elliptic divisibility sequence is a binary bilinear re-
recurrence sequence (see page 11). The definition A0.1) was first coined by Morgan
Ward in his paper [1330]. The way he came upon this definition is interesting. Ap-
Apparently Lucas emphasised the connection between the sequences which now bear
his name and the circular functions, and claimed to have found a generalization
involving elliptic functions. Unfortunately, he published almost nothing on this
apart from a few scattered hints. For an interesting overview of Morgan Ward's
work, see the survey paper [696].
Some sequences satisfy the recurrence relation A0.1) trivially: For example,
the sequence of integers u(n) = n for all n satisfies A0.1), as does the sequence
0,1,-1,0,1,-1,....
Less obviously, the linear recurrence sequence
0,1,4,15,56,209,780...,
whose recurrence relation is u(n + 2) = Au(n + 1) —u(n), also satisfies A0.1). Mor-
Morgan Ward was aware of these degenerate examples and called them singular. In
[1330, Lem. 22.2] he shows that the only singular sequences u which satisfy A0.1),
besides the integers, must be Lucas sequences of the form
nn — bn
A0.2) u{n) = -,
a — o
where a+b is an integer and ab = 1. For example, taking a = 2+\/3,6 = 2 — \/3 gives
the sequence 0.1.4,15,... above. Thus the singular sequences are all of the form
u(n) = sin(n#)/ sin@) for some 8. Knowing that the relation A0.1) is satisfied by
Tn(z) = cr(nz)/cr(z)n , where a is the Weierstrass cr-function, Morgan Ward began
an abstract study of sequences which satisfy the relation A0.1). Some of his results
are recalled below.
163

164 10. ELLIPTIC DIVISIBILITY SEQUENCES
The recurrence relation A0.1) is less straightforward than a linear recurrence.
In order to calculate terms, notice firstly that the single relation A0.1) gives rise
to two relations
A0.3) uBn + 1) = u(n + 2)u(nJ -u(n- l)u(n+ IK, and
A0.4) txBn)txB) = u(n + 2)u(n)u{n - IJ - u{n)u{n - 2)u{n + IJ.
The relation A0.3) comes about by setting m = n + 1 while A0.4) comes about by
setting m = n + 2 then replacing n by n - 1. The relations A0.3) and A0.4) can
then be subsumed into the single relation
u(L(n+l)/2j)u(L(n-3)/2JHL(n
where [-J denotes, as usual, the integer part. Following Morgan Ward, a solution
of A0.1) is called.proper if tx(O) = 0, tx(l) = 1, and txB)txC) ^ 0. The justification
for this term is worked out in the paper; non-proper sequences are degenerate in one
way or another. Such a proper solution will be an elliptic divisibility sequence if and
only if uB), uC), uD) are integers with uB)|uD) and relations A0.3) and A0.4) are
satisfied for all n. Hence the terms u(i), 0 < i < 4 uniquely determine an elliptic
divisibility sequence. For example, there is an elliptic divisibility sequence starting
0,1,1,-1,1. The formulae above show the sequence continues
2, -1, -3, -5,7, -4, -23,29,59,129, -314, -65,1529, -3689, -8209,
-16264,833313,113689, -620297,2382785, 7869898, 7001471,
-126742987, -398035821,168705471, -7911171597,...
This sequence may be viewed as the simplest non-trivial elliptic divisibility se-
sequence, analogous to the Mersenne sequence, and will be used below. For brevity,
call this sequence S for future reference. Notice that the odd terms of S, in absolute
value, agree with the Somos-4 sequence A.12).
Recently, Shipsey [1166] has used elliptic divisibility sequences to study the
discrete logarithm problem for elliptic curves over finite fields, and has found an
elegant algorithm for computing high order values, using a kind of repeated dou-
doubling. Swart [1268] has continued this development, and this thesis solves some of
the problems raised in [1166].
10.2. Periodicity
Suppose p is a prime and u is a proper elliptic divisibility sequence. The index
of entry for linear recurrence sequences in Section 6.3 is called rank of apparition
by Morgan Ward. Thus, the rank of apparition for p is r if r is the smallest positive
integer for which u(r) = 0 mod p. In his paper, Morgan Ward proves that every
prime has a rank of apparition, and this rank is bounded by 2p + 2. The theory of
division polynomials (see below) explains this result in a simple way. He went on to
prove beautiful congruences about the periodicity of elliptic divisibility sequences
modulo p. Once again, we introduce an assumption to avoid many special cases
having to be explained.

10.3. ELLIPTIC CURVES 165
Theorem 10.1. Let p denote an odd prime and suppose gcd(p,uB)uC)) = 1.
Let r denote the rank of apparition for p. Then there are integers a, b, c with ac= I
mod p, such that for every n > 0,
A0.5) u(r — n) = banu(n) (mod p) and u(r + n) = —bcnu(n) (mod p).
The integers can be computed explicitly from the congruences
u{r-2) u{r-lJu{2)
a = ——-———-.- (modp), 6=-i—t—- ,¦ (modp).
tx(r-l)txB) V ; ti(r-2) v y>
Theorem 10.1 gives the periodic behaviour of elliptic divisibility sequences.
They are always purely periodic, meaning that for all n, u(n + p) = u(n) mod p for
some p which is a multiple of r, the rank of apparition. For example, take p = 5 for
the sequence S. The rank of apparition is 8 and the period is 32. Morgan Ward's
formulae give a = 2,6 = 1, c = 3.
Theorem 10.1 is actually a consequence of the periodicity of the Weierstrass
cr-function, and it does not seem to be readily provable any other way. We now
give the definition of this function and use it to give a sketch proof of A0.5). Let L
denote a lattice in C — a discrete subgroup of rank 2 over E. Write L =< Wi, w? >,
where w\ and w? are complex numbers with w\ /u>2 ^ M. These numbers are usually
called periods. For z G C, define the Weierstrass a-function &l{z) — u(z) by
<*)=* n
By taking logarithms, the convergence of the product follows from the convergence
of the series Ylo^eeL K1~3- Thus a defines an analytic function which has simple
zeros at the lattice points and nowhere else. A fundamental property of the cr-
function is the following periodicity relation. Let w denote either of the periods for
L. Then there is an E-linear form 77 such that for all z € C,
A0.6) a{z+w) = -eri
PROOF, (of Theorem 10.1) The proof uses the basic relation in some suitably large
number field,
u{n) = rn{w/r) (mod p),
where p is any prime ideal dividing p. Now, for 0 < n < r, consider rr_n(xy/r).
This is
a(w -nw/r)
a\w/r)(r-^ = flBMWr),
using A0.6) and the fact that a(-z) = -<r(z), where a = e2^w/r)a{w/r)r and
b = ev^ /a(w/r)r . Letting n = 0,1 shows that a and b are congruent to rational
integers mod p. This shows the congruence holds not just for the prime ideal
divisors of p, but also for p itself. ?
10.3. Elliptic Curves
All the examples of elliptic divisibility sequences which are non-linear arise from
elliptic division polynomials, analogues of the classical cyclotomic polynomials from
arithmetic. All of the theory of elliptic curves needed can be found in Silverman's
volumes [1214] and [1217].

166 10. ELLIPTIC DIVISIBILITY SEQUENCES
Consider an elliptic curve defined over the rational numbers, determined by a
generalized Weierstrass equation
A0.7) y2 + aYxy + a3y = x3 + a2x2 + a4x + a^
with coefficients a±,..., a$ in Z. Define associated constants by
b2 = a
64 = 204 + 0103,
h = al + 4a6.
o 00
Oe + 4g2^ aa^4 + ^2^ ^
Define a sequence of polynomials in Z[x,y] as follows: Vo = 0, V'i = 1> and
¦02 = 2y + aix + a3,
ipz = 3a;4 + b2x3 + 3b4x2 + 3b6x + b8,
ij)A = ip2Bx6 + b2x5 + Sb4x4 + 1066a;3 + 1068a;2 + (b2b8 - b4b6)x + b4b8
Now define inductively for n > 2
It is straightforward to check that each ipn G Z[x, y\. Write ¦0n(C) f°r V'n evaluated
at the point Q = (x,y). The basic properties of elliptic division polynomials can
be found in [1214], [1217] and [1330].
Proposition 10.2. The sequence (VvO satisfies the recurrence A0.1). Also,
V4(.Q) = nV2-1 + • • • € Z[x]
is a primitive integral polynomial in x alone whose roots are the x-coordinates of
the finite torsion points on the curve whose order divides n.
More is true. Suppose the point (x, y) is viewed as generic, that is, x and y are
variables. Then the point Q can be added to itself using the addition on the elliptic
curve. Repeating this gives a point nQ = Q + ¦ ¦ ¦ + Q (n times) whose coordinates
are rational functions in x and y. The denominator of the ^-coordinate is V'n- F°r
example, if E is the curve with equation
E : y2 + y = xz - x
and Q = @,0), then the sequence sn(Q) of square roots of denominators of x(nQ) is
precisely the sequence S obtained earlier. In [1167], it is proved that this construc-
construction always gives an elliptic divisibility sequence if Q = @,0) on the curve A0.7)
with ae = 0, under the additional assumption gcd(a3,<24) = 1. When this condi-
condition is violated, the construction does not necessarily give an elliptic divisibility
sequence. The following example appears in [1167]: Consider the elliptic curve E
given by the equation
y2 + 27y = x3 + 28a;2 + 27a;.
The point Q = @,0) is a non-torsion point on E, but it does not give rise to an
elliptic divisibility sequence. Notice that in this example the point Q reduces to a
singular point mod 3.
Proposition 10.2 guarantees that the evaluated sequence V(Q) — (V'n(Q)) sat-
satisfies A0.1) for any integral point Q. It is readily checked that if u is any rational

10.4. GROWTH RATES 167
¦2
sequence which satisfies A0.1) and c is a non-zero rational, then v(n), = cn 1u(n)
also satisfies A0.1). Given any rational point Q, the shape of the equation A0.7)
guarantees that the denominator of the ^-coordinate is a square, say x{Q) = a/b2.
Thus, from the point Q and the curve we can produce the terms of an elliptic di-
divisibility sequence bn ~1^n{Q) by clearing the denominator. Define the sequence
E = E(Q) by
A0.8) E{n) = bn2~ Vn(Q) ? Z.
The process outlined here is invertible. That is, given an elliptic divisibility sequence
E, one may find a rational point on an elliptic curve whose division sequence is E. In
fact Morgan Ward calculates the transformation explicitly: If the sequence begins
0,1, a, b, c..., then the point has ^-coordinate
x = (c2 + 2abc + 4a2b3 + ax0) / (I2a462)
on the elliptic curve y2 — x3 + Ax + B, where
A = _ (a20 + 4a15c 123 l02 73 ^3 46
and
B = (a30 + 6a25c - 24a2263 + 15a20c2 - 60a1763c + 20o15c3
+ 120a1466 - 36a1263c2 + 15a10c4 - 48a966c + 12a W
+64a669 + 6a5/+ 48a466c2 + 12a263c4 + c6) / (864a1266).
Lucas defined an elliptic divisibility sequence to be singular if the corresponding
cubic curve is not elliptic (that is. the discriminant vanishes). For example, the
sequence u(n) = n gives rise to the point A.1) on the singular curve y2 = x3. The
principle underlying Morgan Ward's ancilysis is that non-singular sequences u are
all of the form u(n) = a(nz)/a(z)n for some z, whereas singular sequences are of
the form u(n) = sin(n#)/sin(#) for some 9.
10.4. Growth Rates
Finding growth rates for integral linear recurrence sequences is not trivial,
requiring machinery from Diophantine approximation. A similar story is true in
the case of elliptic divisibility sequences. Write
A0.9) A = -blb8 - Sbl - Tib\ + %2bAbQ
for the discriminant of the curve A0.7). Primes p which divide A are precisely the
primes for which the elliptic curve reduces to a singular curve mod p. The theorem
that follows was proved in [333]; it shows that the growth rate for elliptic divisibility
sequences exists, and is quadratic exponential in n. Moreover the p-adic growth
rate exists for primes of singular reduction. A more general version, together with
numerical examples, appears in [374].
THEOREM 10.3. Let Q denote a non-torsion rational point on the curve. Then
for p = oo or a finite prime of singular reduction, there are positive constants A, B,
with B < 2, for which
fimm * Wh/; (D)\ -\ (<!) + ! °((l°Sn)/n2) ifp = oc,
A0.10) ^logWn(Q)\p-MQ) + { O(l/nB) ifp<oc.

168 10. ELLIPTIC DIVISIBILITY SEQUENCES
Here p = oo denotes as usual the Archimedean norm. The expressions Ap(Q)
are called iocai heights in the literature; for every prime p < oo. there is a local
height XP(Q). The constant A depends on the curve and the point Q only, whilst
B depends upon the curve, the point Q and the prime p. The method of proof uses
elliptic transcendence theory. It is a surprising feature of the underlying bounds in
elliptic transcendence theory that the bound for the finite primes is inferior to that
for the infinite prime.
Theorem 10.3 explains a phenomenon which the Chudnovskys discovered in
their papers [238] and [239]. There they reported having found elliptic divisibility
sequences in which all the terms are divisible by high powers of certain primes.
For a prime of singular reduction (or for p = oo), the canonical local height of
a rational point can be negative. It follows from A0.10) that if p is a prime of
singular reduction for the curve and the canonical local height of Q at that prime
is negative, then E{n) = En(Q) must ultimately be divisible by very high powers
of p.
The relationship between local heights and elliptic divisibility sequences is ex-
explained in [374]. Any rational point has a canonical global height h(Q): This
global height is non-negative and vanishes if and only if Q is a torsion point. It is
the exact analogue of (the logarithm of) Mahler's measure of an algebraic number,
discussed in Section 2.2.4. It has the functoriality property that h(kQ) = k2h(Q)
for every rational point Q and every k G Z. The global height can be defined
quite concretely. For each k > 0, x(kQ) is a rational number a^/bk so define
h(kQ) = logmax{|afc|, |6fc|}. Then
h(Q) = lim -U(/cQ).
fc-»oc LK*
It is not trivial to prove that this limit exists. The global height is a sum of local
heights, one for each prime,
A0.11) h{Q) =
p<oo
The canonical local heights can be given by explicit formulae. For finite primes, these
involve only the discriminant A of the curve (see A0.9) above), the coordinates of
'Q, and V>2(Q) or ifa{Q) (see Exercises 6.7 and 6.8 in [1217]).
The singular primes can be divided out from each term of E by writing
A0.12) F{n) = \E{n)\]\\E{n)\p.
The sequence F is still a divisibility sequence, although it might not satisfy A0.1).
The next result also comes from [333].
Theorem 10.4. If Q is a rational point with x(Q) = a/62, and F is defined as
in A0.12), then
A0.13) F(n) = /i(Q)n2+o(n2~C),
where 0 < C < 2 is a constant.
Akiyama uses the strong divisibility and growth rate results to show the follow-
following analogue of F.16). Let E denote an elliptic divisibility sequence corresponding

10.5. PRIMES IN ELLIPTIC DIVISIBILITY SEQUENCES 169
to a non-torsion point, then
lim log )E(l)... ?(n)|loglcm(?(l),... , E(n)) = CC)
n —*oo
n —*oo
10.5. Primes in Elliptic Divisibility Sequences
The question of prime divisors is less studied than for the corresponding linear
case. The elliptic analogue of Zsigmondy's Theorem was proved in [1215] using
Siegel's Theorem, then generalized in [229]. Using elliptic transcendence methods
it is surely possible to prove good effective results. For example, we suspect the
sequence S introduced in Section 10.1 always has primitive divisors for n > 10. The
answer to this question might now be within reach given the advances in elliptic
transcendence theory and computational number theory see [371]. By analogy with
the Lucas and Lehmer numbers, it seems likely that a uniform bound should exist
over all elliptic curves in global minimal form. However, a proof of that result is
probably a long way off. One might expect that questions about prime appearance
itself are harder for elliptic divisibility sequences, but a real surprise lies in store.
10.5.1. Prime terms. The question of prime appearance in divisibility se-
sequences has received much attention when the sequence satisfies a linear recurrence
relation. Little has been achieved by way of proof (see the comments on page 95).
The situation is better for elliptic divisibility sequences. Generic divisibility also
occurs in the elliptic setting, as detailed in Proposition 10.8. Although Morgan
Ward wrote many papers about elliptic divisibility sequences, including one on
repetition of prime factors [1329], he did not touch on the question of prime ap-
appearance. In [238] and [239], the Chudnovskys consider this question, and suggest
that elliptic divisibility sequences should contain very large prime terms. The table
below shows prime appearance (that is, values of n for which u(n) is a prime) in
sequences specified by the first 5 terms, which the Chudnovskys calculated. They
Initial terms Growth rate h(Q) Prime incidence up to n = 500
0,1,1,1,-2
0,1,1,1,6
0,1,2,1,4
0,1,1,2,7
0,1,1,1,-9
0,1.1,1,10
0,1,1,4,1
0,1,1,4,3
0,1,1,5,2
0.0560
0.1107
0.1262
0.1311
0.1383
0.1432
0.1730
0.1737
0.2010
5,7,11,13,23,61,71
5,7,13,23,43,47
5,7,71
11,17,73
7,47,79
7,13,41,61
71,79
5,7,13,53,71
7,43
Table 1. Primes in elliptic divisibility sequences from the paper
[238] of Chudnovsky k Chudnovsky
did indeed exhibit some large primes. The largest prime found has 469 decimal
digits: It appears in the third sequence from the end in Table 1. In [238], they also
considered the likelihood that denominators of multiples of rational points might
be a source of large primes. Write
A0.14) *(«P) = 4.

170 10. ELLIPTIC DIVISIBILITY SEQUENCES
in lowest terms, with An and Bn in Z. The following examples are taken from their
paper; in both, the index n was allowed to run out to n = 100.
Example 10.5. For the point P = [-1,5] on the curve y2 = xz + 26, B2g is a
prime with 285 decimal digits. For the point P = [1,4] on y2 = x3 + 15, B41 is a
prime with 509 decimal digits.
Impressive as these calculations might seem, the heuristics in [334] predict that
any given elliptic divisibility sequence should only contain finitely many primes.
The Chudnovskys' sequences were run to the first 500 terms and in every case
no new primes emerged. In [372] a proof is given that only finitely many terms
Bn are prime powers assuming P is the image of a rational point under a non-
trivial isogeny. A discussion about the function field case suggests the uniformity
result might not be far off, using Lang's conjecture. This conjecture, which is also
discussed in Section 10.6, is known to be true for elliptic curves over function fields.
Lang's conjecture implies the elliptic Lehmer problem, lending a kind of post hoc
credence to the heuristic argument in [334]. It seems amazing that such a loose
heuristic argument should have predictive power.
If one is willing to consider other models for the elliptic curve then it is some-
sometimes possible to prove finiteness with no additional assumptions. For example, let
E denote an elliptic curve defined by the equation
A0.15) x3 + y3 = c,
where c is a non-zero rational number. Let P denote a non-torsion rational point
and write
Note the differing shape of the generic point P. In [372] a general proof is given
that only finitely many terms Bp are prime.
Example 10.6. As Ramanujan famously pointed out, the taxi-cab equation
A0.16) xz + yz = 1729,
has two distinct integral solutions. These give rise to points P = [1,12] and Q =
[9,10] on the elliptic curve. The only rational points on this curve which yield prime
denominators seem to be Q and P + Q (and their inverses).
Alternatively, one can search for primes in the sequence defined by F(n) =
Fn(Q). The asymptotic formula A0.13) is important because it can be used to
restrict the search for primes. A prime of the form F(n) = Fn(Q) is an anomalous
prime if the index n is not a prime.
Proposition 10.7. There can only be finitely many anomalous -primes in the
sequence F.
Proof. Since F is a divisibility sequence with F(n) > 1 for all large n, the only
way large anomalous primes can appear is if they are of the form F(mn) = F(n)
with 1 < m,n. If there are infinitely many anomalous primes, then this relation
will hold with ran —> 00. In this case A0.13) implies that
n2 = (mnJ + o{{mnJ),
which is clearly impossible. ?

10.5. PRIMES IN ELLIPTIC DIVISIBILITY SEQUENCES 171
Another important application of A0.13) is the following. For a non-torsion
rational point Q, compare Fn(Q) with Fn(kQ) when 1 < k e N. Since h(kQ) =
k2h(Q), it follows from A0.13) that the terms of the sequence (Fn(kQ)) are all
larger than those in the sequence (Fn(Q)) from some point on. Proposition 10.8
shows that for prime n > k, Fn(Q)\Fn(kQ). Since only finitely many terms of
Fn(Q) are equal to 1, this means that from some point, every term Fn(kQ) has
a non-trivial factor, and therefore that only finitely many terms of Fn(kQ) are
primes. This is an elliptic analogue of the generic divisibility discussed above.
Proposition 10.8. Suppose Q is a non-torsion rational point and 1 < k G N
is fixed. Then for all primes n > k.
Fn{Q)\Fn{kQ).
10.5.2. Primes terms in the CM and higher rank cases. Joe Silverman
has asked what the possibilities might be for curves of higher rank or with complex
multiplication. Heuristic arguments suggest that a sequence arising from an elliptic
curve with complex multiplication will contain infinitely many prime terms.
Example 10.9. The curve
y2 = x3 - 2x
has complex multiplication by the Gaussian integers Z[?']. The point Q = B,2)
gives rise to an integer divisibility sequence B indexed by a G Z[i] where
x(aQ) = Aa/Bl, Ba e Z.
The growth rate of Ba is given by
B(a) ~ cN{a)
for some c > 0, where N(a) denotes the field norm N(a = m + ni) = m2 + n2.
Heuristically, the only way Ba can be prime for large N(a) is when a is a factor of
an integral prime p = 1 mod 4. For primes p up to 10000, 12 prime values of Ba
appear.
The example that follows shows this phenomenon is more subtle than it first
appears.
Example 10.10. The curve
y2 = x3 + 3x
also has complex multiplication by the Gaussian integers Z[i\. The point Q = A, 2)
gives rise to an integer divisibility sequence Ba G Z as before. This time, after
a = 2 + i, no prime terms Ba seem to appear in the sequence. However, one still
obtains an integral sequence Ba beginning with the Q(i)-integral point Q = (i, 1+i).
This time, many more prime terms appear. For primes p = 1 mod 4, up to 10000,
24 prime values of Ba appear. The largest comes from (95 + ii)Q — it has 984
decimal digits.
These phenomena are easier to understand alongside the higher rank cases.
Some discussion follows about this then we return to the examples above and at-
attempt to explain them. If the elliptic curve has rank greater than 1, under the
same assumption about images under isogenies, it is possible to prove finiteness —
see [372] for details. In [368] and [1087], a heuristic argument together with results

172 10. ELLIPTIC DIVISIBILITY SEQUENCES
from some numerical experiments indicate a surprising phenomenon. For certain
curves in Weierstrass form A0.7), if P and Q denote independent non-torsion ra-
rational points, and
mQ)=-Anv{/B2nm
in lowest terms then the terms Bnm can be prime infinitely often. Indeed, there
seem to be asymptotically clogX such primes with \m\, \n\ < X.
Example 10.11. The curve
y2 + y = x3 - 199a; + 1092
has rank 2 with independent points [-13,38] and [-6,45]. The curve
y2 + y = x3 - 29a; + 52
has rank 2 with independent points [-4,10] and [-2,10]. In both, there appear
to be approximately clogX prime terms Bnm with \m\, \n\ < X, for a constant c
which depends upon the curve. The dependence of c upon the curve is difficult to
understand. The heuristic argument in the next section suggests there should be
some dependence upon the elliptic regulator but there are clearly other quite subtle
dependencies going on. Both of these examples are discussed in [368].
10.5.3. Heuristics on prime appearance. In Section 6.1.1 we outlined
heuristic arguments due to Wagstaff for the shape of Pa{N) when a is the Mersenne
sequence. Although this falls a long way short of a proof, it suggests an estimate
which is well supported by the known data. A similar approach will now be adopted
when a is an elliptic divisibility sequence.
Using Hasse's Theorem, one can give an elliptic analogue of the approach of
Wagstaff. If q is a non-singular prime which divides Fn, then nQ must reduce to
the point at infinity on the reduced curve mod q. If n is prime, it follows that the
order of the group of Fg-points on this curve must be bounded below by n. By
Hasse's Theorem, the order of this group is q + O{^/q) uniformly. Inverting this
inequality gives an upper bound for q of the form n + O(y/n) uniformly. Thus, in
the elliptic analogue of F.1), the Euler factors are adjusted for non-singular primes
q bounded by n + O(*/n). The Euler factors for the singular primes should also be
included, but for a different reason. The construction of F(n) guarantees each term
is free of singular primes, so the probability that F(n) is prime must be adjusted
by these Euler factors, just as it is for each of the non-singular primes. This gives
the following estimate for the number of prime values of F(n) with prime n < x:
prime n<x q<n+O(\/n)
Merten's Theorem and the quadratic growth rate of log F(n) shows that the ex-
expression in A0.17) converges. This suggests that, for any large x, the number of
prime indices n < x for which F(n) is prime is constant. In other words, there
should be a finite number of non-anomalous primes. Proposition 10.7 shows that
there can only be a finite number of anomalous primes also. This argument may
be slightly refined using the known uniform constant in Hasse's Theorem (see [217,
Theorem 8.3]). This changes A0.17) to the following: The expected number of

10.5. PRIMES IN ELLIPTIC DIVISIBILITY SEQUENCES 173
non-anomalous primes in the sequence F is bounded above by
l/logF(n)
prime n<oo q<n+l+2y/n
Note that an exact calculation was made to avoid using Merten's Theorem in this
context, since the error term in estimating the product would swamp the other
terms. There does not seem to be a reasonable heuristic for a lower bound, since
the early terms (small values of the prime n) dominate the sum, so asymptotic
estimates are inappropriate.
The elliptic analogue of the Lehmer problem (see Section 10.6 below) sug-
suggests that the canonical height of a non-torsion rational point should be uniformly
bounded below. Combining this with the heuristics above suggests that the number
of primes appearing should be uniformly bounded above. Once again, a heuristic
argument seems to have predictive power - calculations tend to suggest that only
very few primes do ever appear.
As mentioned above, when working with the Weierstrass equation A0.7) in
higher rank, there do seem to be situations where infinitely many primes can occur.
A similar kind of heuristic argument suggests the expected number of prime terms
Bnrn with \n\ and \m\ bounded by X is approximately
\m\,\n\<X
for some positive definite quadratic form Q. Comparing this sum with the obvi-
obvious integral supports the observation that approximately clogX terms should be
prime. See [368] and [1087] for details of the heuristic arguments and examples of
calculations. The proof that certain curves yield infinitely many primes looks hard
— this seems to be the correct elliptic analogue of the Mersenne prime conjecture
— and we present this as an open problem. Other open problems follow in the next
section.
Finally, we return to examples 10.9 and 10.10 to give an explanation in the
light of the heuristic arguments for rank-2 curves. Given an elliptic curve with
complex multiplication by Q(i) and a point Q, multiplication by i essentially pro-
produces another independent point R = iQ. Thus multiplying Q by the complex
number a = m + ni is the same as adding mQ to nR. Thus the CM case resembles
the rank-2 examples we discussed. The failure of Q = A,2) to produce infinitely
many primes is provable because both Q and R are images of QB)-points under an
isogeny. When this does not happen, should we expect approximately a constant
multiple of logX primes Ba for a 6 Z[i] with iV(a) < XI The answer appears to
be yes and can be approached using a meld of the arguments for the rank-l and
rank-2 cases. Briefly, the expected number of prime terms with N(a) < X, at first
approximation, ought to be a constant multiple of
N{a)<X
However this sum is only approximately 1/2 log log X. The proper growth rate can
be recovered using a variant of the Merten's-type correction. If q is any divisor
of Ba then, for large N(a), q < N(a). Correcting the probability as before by
introducing the Euler factors for primes < N(a) gives a revised estimate for the

174 10. ELLIPTIC DIVISIBILITY SEQUENCES
expected number of primes to be a constant multiple of
p<x
summed over integral primes congruent to 1 mod 4. This is known to be ~
1/2 log X.
10.6. Open Problems
There are many fascinating parallels between linear recurrence sequences and
elliptic divisibility sequences. In both cases, vanishing terms of the sequence imply
a torsion statement in the appropriate underlying group: For a linear recurrence
sequence, vanishing infinitely often means two roots have a quotient which is a
torsiori'point of the circle (a root of unity) while for an elliptic divisibility sequence,
one vanishing term implies infinitely many vanishing terms and the underlying point
is a torsion point on the elliptic curve.
The Lehmer problem, which was mentioned in Section 2.2.4, suggests that the
growth rate of an integer linear recurrence sequence is uniformly bounded below.
There is an elliptic analogue of this statement — the so-called Elliptic Lehmer
' Problem. This says that the global canonical height of a non-torsion rational point
on an elliptic curve is uniformly bounded below by a positive constant. Note this
immediately implies that the growth rate of an elliptic divisibility sequence is simi-
similarly uniformly bounded below. The following example found by Noam Elkies shows
just how small the canonical height can be and how large the coefficients may be
to produce a point with small height. On the elliptic curve
y2 + 253xy + 1197000y = z3 + 5320z2
the point Q = @, 0) has h{Q) = .00445716.... Elkies keeps a web site [339] on
computational number theory with a page on small heights; at the time of writing
he has found 54 examples of rational points with height below 0.01.
More generally, given an algebraic point Q on an elliptic curve defined over Q
which generates a number field of degree d, the global height h(Q) is conjectured
to be bounded below by c/d, where c > 0 is a uniform constant. There is a related
conjecture due to Lang which says that if the underlying number field K is fixed
then, as the elliptic curve varies, the canonical heights for all the non-torsion Ir-
Irrational points are bounded below by clog|NK|Q(A#)|, where c > 0 is a uniform
constant, A# is the discriminant of the curve E and N#-|q : K —* Q denotes the
usual field norm. Matthew Baker has proved that for elliptic curves defined over
a number field K, with complex multiplication, the canonical height is bounded
uniformly below for points defined over the maximal abelian extension of K [57].
The best general result on the elliptic Lehmer problem was obtained in [782],
improving the result, in [31]. This gives a lower bound h(Q) > c/d3(logdJ. In
the abelian case, this is improved to h(Q) > c/d(logdJ and the reviewer notes
that only the assumption that K/Q is Galois is actually needed for this bound (see
also [57]). In the case when E has non-integral j-invariant, the bound in [534]
is h(Q) > c/d2 (log dJ. In the complex multiplication case, the result in [685] is
the exact analogue of Dobrowolski's bound, namely, h(Q) > c/d(logdloglogdK.
It is proved in [1213] that Lang's conjecture is true for all points Q for which the
number of primes at which Q has singular reduction is uniformly bounded. This

10.6. OPEN PROBLEMS 175
was improved and generalized in [533]. The analogy between linear recurrence and
elliptic divisibility sequences is strong and can be used to suggest problems hitherto
unconsidered. For example, what should the elliptic analogue of the Hadamard
Quotient Theorem say? The following is a possible interpretation. Let E denote
an elliptic curve defined over Q, with rational points P and Q. The points define
integral sequences P and Q, the sequences of square roots of the denominators of
nP and nQ respectively. If P is actually a multiple of Q, that is, P = kQ for
some integer k, then the sequence Q divides P term-wise. The question we pose
is whether the converse is true: If Q(n) divides P(n) for all n > 1, then is it true
that P — kQ for some integer k? One could ask the same question of two elliptic
divisibility sequences, one dividing the other term-wise; what would this imply
about the underlying curves and points? If the rank of the underlying elliptic curve
is 1, these questions are easy to answer.

CHAPTER 11
Sequences Arising in Graph Theory and Dynamics
Many of the sequences from earlier chapters arise in combinatorial problems.
One particular family of such problems is described in Section 11.1, where sev-
several examples of sequences of graphs with the property that the number of per-
perfect matchings on the graphs forms a recurrence sequence are described. In Sec-
Section 11.1.1 a combinatorial interpretation of the classical Fibonnaci sequence is
described.
Many linear recurrence sequences are also well-known in dynamical systems,
partly because they arise naturally as sequences counting periodic points. A dy-
dynamical system is a continuous map T : X —* X, where X is a compact space. The
space X may carry additional structure: For example, it could be a manifold or
a compact group, in which case it would be natural to study diffeomorphisms or
group endomorphisms respectively. The subject of complex dynamics — where X
is the Riemann sphere and T is a rational map — has received a great deal of atten-
attention, and motivates some of the definitions below; see [75], [293]. In Section 11.2
the property of having a combinatorial realization as a periodic point sequence is
described, and some finer properties of such sequences are discussed. Most of this
section is taken from [367] and [1054].
11.1. Perfect Matchings and Recurrence Sequences
In this section some recent work relating perfect matchings on sequences of
graphs to recurrence sequences is presented.
11.1.1. The Fibonacci sequence. It may be true that Leonardo of Pisa
(now known as Fibonacci) first discovered the eponymous sequence in a model
for growth of rabbit populations. Combinatorial number theorists generally try
to do the reverse and identify sequences of non-negative integers by enumerating
combinatorial structures. On the Sonios site [1052], Propp remarks upon this as an
irresistible urge. Recurrence sequences generally lend themselves to combinatorial
interpretation for obvious reasons: Here is a non-cunicular interpretation of the
Fibonacci sequence. Consider the sequence of graphs Gn shown in Figure 1; the
nth graph has 2n vertices. A perfect matching is a way of selecting some of the
Figure 1. Graphs whose matchings form the Fibonacci sequence
edges so that every vertex belongs to exactly one of the selected edges. It is easy to
177

178
11. SEQUENCES ARISING IN GRAPH THEORY AND DYNAMICS
prove by induction that the sequence of numbers of matchings of Gn is the sequence
1, 2.3, 5,... of Fibonacci numbers. For example, the 5 matchings on G4 are shown
in Figure 2. Similar results hold for related graphs. For example, Helen King has
Figure 2. The five.perfect matchings on G4
shown that the number of matchings on the nth graph in Figure 3 is 2/(n)/(n — 1),
where / is the sequence of Fibonacci numbers.
Figure 3. Graphs with 2/(n)/(n - 1) perfect matchings
11.1.2. Aztec diamonds. A similar example in which the number of match-
matchings grows like Cn is shown in Figure 4. These graphs are called Aztec diamonds,
and there are 2n(-n+1^2 perfect matchings on the nth graph. For proofs see [341].
[342], [651]. Writing T(n) for the number of perfect matchings on the nth graph,
the approach in [651] uses graphical condensation to show that
r(n)r(n-2)=2T(n-lJ.
The 8 = 22'3/2 perfect matchings on the second graph are shown in Figure 5.
Figure 4. Aztec diamonds

11.2. SEQUENCES ARISING IN DYNAMICAL SYSTEMS
179
J L
Figure 5. The 8 perfect matchings on the second Aztec diamond
11.1.3. A Somos-4 sequence. In a recent striking development, certain
Somos-4 and Somos-5 sequences, for example, the one in A.12), have been shown
to enumerate the matchings of a nested sequence of graphs. The example A.12)
is available in the form of a tee shirt designed by Trevor Bass, see [69]. Recall
that the sequence A.12) starts 1,1,1,1,2,3,7,23,... and satisfies the recurrence
relation
a(n)a(n - 4) = a(n - l)a(n - 3) + a(n - 2J.
The sequence of graphs shown in Figure 6 have the property that there are exactly
a(n + 3) perfect matchings on the nth graph. For example, Figure 7 shows the seven
Figure 6. Graphs whose matchings form a Somos-4 sequence
matchings on the third graph. This connection between the Somos-4 sequence and
graph matchings is described on the web site [69]. The result was proved indepen-
independently by two groups, both following a plan of attack proposed by James Propp:
in France, Mireille Bousquet-Melou and Julian West; and in the U.S., a group of
undergraduates working with Propp as part of an NSF-supported program called
Research Experiences in Algebraic Combinatorics at Harvard (REACH): Daniel
Abramson, Trevor Bass, Gabriel Carroll, Seth Kleinerman, Lionel Levine, Roberto
Martinez, Gregg Musiker, and David Speyer, along with graduate student Jason
Burns. This is an exciting area of research where much awaits discovery.
11.2. Sequences arising in Dynamical Systems
11.2.1. Periodic points and realizability. Let T : X —» X be a map on an
arbitrary set X. A point x 6 X is a point of period n under T if Tn(x) = x; that

180
11. SEQUENCES ARISING IN GRAPH THEORY AND DYNAMICS
/\
Figure 7. The seven perfect matchings on the third graph
is x is fixed by the n-th iterate of T under composition of functions. The number
of points of period n > 1 under T is
= \{x E X : Tn(x) = x}\
if this quantity is finite.
Example 11.1. A) Let X = C and T(x) = x2. Clearly x has period n if
and only if it is solution of x2" = x; thus Fixn(r) = 2n. If X = S1 then
there is one fewer point of period n, so the sequence of periodic points is
counted by the Mersenne sequence.
k
B)
C)
The map T : z h-v zk on C gives Fixn(T) = kn for all n > 1.
Let X = S1 and T(x) = x~2. The periodic points are counted by the
Jacobsthal-Lucas sequence 1,5,7,17,..., since Fixn(T) = |1 + (—2)n|.
D) More generally, if F e Z[x] is a monic polynomial with associated compan-
companion matrix Ap 6 M^(Z), then Ap defines an endomorphism of the d-torus
Td, and Fixn(^F) = An(F) = Uti \K ~ 1| where F(x) = YlUx ~ A,-)-
This is the Lehmer-Pierce sequence associated to F (see [695], [1000]).
E) As a further generalization, let A denote an integral d x d matrix with
no eigenvalues which are roots of unity. Then A acts on Td by multipli-
multiplication mod 1 to define a map T(x) = Ax mod 1. As above, Fixn(T) =
| det(An—I<i)\, the Lehmer-Pierce sequence associated to the characteristic
polynomial of A. Simple proofs of this are in [346] and [373].
F) Let X denote the compact subset of {0,1}Z comprising all doubly-infinite
sequences in which every 0 is followed by a 1, and let T denote the left
shift map; then it is easy to show that the sequence of periodic points
agrees with the Lucas sequence 1,3,4,7,11
G) Another way the Lucas sequence can be recognized as counting periodic
points is to notice that it agrees with the sequence of traces of powers of
a non-negative integer matrix. Let A denote the matrix
A =
0 1
1 1

11.2. SEQUENCES ARISING IN DYNAMICAL SYSTEMS 181
Let trace denote the usual trace of a matrix; trace(a;./) = Ya=i aa- ^ is
easily checked that the sequence trace(^4n) agrees with the Lucas sequence.
Now let G denote the graph on two vertices with incidence matrix A. It
is clear that the left shift on the space of all paths has periodic points
counted by this sequence — see Section 11.2.5 for an account of this
. material. In general, if A 6 Md(Z+) then A can be used as the incidence
matrix for a graph G with d vertices. If T denotes the edge shift on G
then Fixn(r) = trace(^n).
A reasonable type of question in view of these examples is the following. Is
there a map T on a set X for which (Fixn(T)) coincides with the sequence of
Fibonacci numbers? The number of points of least period n > 1 under T is
Ln(T) = \{xeX : Tn(x) = x and \{Tk(x)}keN\ = n}\.
The number of orbits of length n under T is
Thus, a point x has period n if and only if it is fixed by the nth iterate of T, and
has least period n if there are exactly n points on the orbit x,T(x),T2(x),... of
the point.
These notions make it easy to settle the question about the Fibonacci sequence
and whether it counts the periodic points for a map (see [1055]).
Lemma 11.2. There is no map T : X —» X for which Fixn(T) is the nth
Fibonacci number.
Proof. Assume there is such a map T; then T must have one fixed point. The
points fixed by T3 come in two forms: One of them must be the fixed point, and
the others (if there are any) come from orbits of length three. Since Fixi(T) = 1,
it follows that Fix3(r) = 1 mod 3. ?
Call a sequence a of non-negative integers realizable if there is a map T : X —» X
with the property that Fixn(T) = a(n) for all n > 1. No assumption is made about
the topological nature of the set X: A map which is realizable in this sense is always
realizable by a continuous map on a compact space X — see the comment after
the proof of Lemma 11.3. This area of enquiry hinges upon a simple combinatorial
device characterizing realizable sequences. The constraint seen in the proof of
Lemma 11.2 takes the following general form. If T : X —* X is any map with
finitely many points of each period n > 1, then the set of points with period n is
the disjoint union of the orbits of length d, as d runs through the divisors of n. It
follows that
A1.1) Fixn(r) = ? Ld(T) for all n > 1.
d\n
On the other hand, the set of points with least period d comprises a certain number
of orbits of length d, so
A1.2) Ld{T) = 0 (mod d) for all d > 0.
It turns out that the equations A1.1) and A1.2) express exactly that property of
a sequence that makes it arise as a periodic-point sequence. The equation A1.1)

182 11. SEQUENCES ARISING IN GRAPH THEORY AND DYNAMICS
may be inverted to give
A1.3) Ln(T) = J^v(n/d)Fixd(T).
d\n
Lemma 11.3. The sequence a is realizable if and only if
A1.4) 0 < ^2 Kn/d)a(d) = 0 (mod n) for all n > 1.
d\n
Proof. That A1.4) is necessary follows from the discussion above. To see that
it is sufficient, assume that a is a sequence with A1.4). Then for each n > 1,
r(n) = n Sdln lJ'{n/d)a(d) is a non-negative integer. If r(n) > 0 for arbitrarily large
values of n, then let X = N, and define T to be a permutation with r(n) cycles of
length n for each n > 1. If r(n) is eventually zero but not always zero, let X denote
a set with cardinality Sn>inr(n)' all(^ again let T denote the permutation with
r(n) cycles of length n for each n > 1. Finally, if a is identically zero, take X = Z
' and T : i h+ i + 1. ' ?
Using a suitable compactification, any realizable map has- a realization as a
homeomorphism on a compact space. Finer questions can be asked of course.
Some of the realizable sequences are realized by automorphisms of compact groups
(examples include the Lehmer-Pierce sequences), and any such sequence must of
necessity be a divisibility sequence. It is more delicate to decide which realizable
divisibility sequences are realizable by group automorphisms — see Section 11.2.4.
An analogous question may be asked for realizability by edge shifts, and this has
been solved bj' Kim, Ormes and Roush [585]. To explain their result, we first
describe the Spectral Conjecture of Boyle and Handelman [151], [152] which may
be viewed as a characterization of a certain class of recurrence sequences. A matrix
is primitive if all entries are non-negative, and for some n > 1 all entries of the nth
power are positive.
Conjecture 11.4. Let A = (Ai, A2,. •. , A^) denote a k-tuple of non-zero com-
complex numbers, and let S denote a unital subring of E. Then there is a primitive
matrix over S with characteristic polynomial ?mIL=i(^ ~ A») for some m > 0 if
and only if
(i) Uli(t-^)es[t),
B) there is a root Xj with Xj > |A;| for all i ^ j,
C) i/S = Z, then ?d|n ^(n/d) ?ti A? > 0, and
D) ifS^Z, then jjf=1 X? > 0 for alln>l, and ?*=i A? > ° implies that
Ej=iArm >0forallm>l.
Boyle and Handelman proved this for the case S = E, and Kim, Ormes and
Roush proved it for S = Z (and hence for Q). Their deep result then says that
the sequence fet=i K) IS realized by an edge shift if it satisfies the first three
conditions of the theorem.
If a and b are realizable, then so are the product (a(nN(n)) and the sum
(a(n) + b(n)). To see this, let T : X -> X and S : Y -» Y be maps that realize a
and b respectively. Then the Cartesian product TxS: XxY-^XxY realizes
the product, and the map U : X UY -> X UY defined on the disjoint union of X
and Y by U{x) = T(x) if x e X and U(x) = S(x) if x e Y realizes the sum.

11.2. SEQUENCES ARISING IN DYNAMICAL SYSTEMS 183
Lemma 11.3 can be used to show that some natural families of sequences are
not realizable.
Theorem 11.5. No elliptic divisibility sequence is realizable in absolute value.
The proof (unpublished) by Nelson Stephens uses a 2-adic argument alongside
Lemma 11.3.
Theorem 11.6. No non-constant polynomial sequence is realizable.
Proof. Let P{n) = co+cxn-i \-cknk with ck ^ 0, k > 1 and assume that (P(n))
is realizable. Multiply the divisibility condition A1.4) by the least common multiple
of the denominators of the (rational) coefficients of P, to produce a polynomial
with integer coefficients satisfying A1.4). It is enough therefore to assume that the
coefficients C; are all integers. Let (Fixn) and (Ln) denote the periodic points and
least periodic points in the corresponding system T : X —* X, and let p be any
prime. By A1.3),
Lp2 =Fixp2 -Fixp,
so
Lp2
(J 2 = —^
2
p2 pl
2 (ciP + c2p4 + ¦¦¦ + ckp2k - (cip + c2p2 + ¦¦¦ + ckpk))
e -c-± + z
p
and hence p divides C\ for all primes p, so C\ = 0.
Now let q denote another prime, and recall that
//(I) = l,fjL(p) = -1,M<?) = -1>Mp2) = 0,M/<?) = 0,/i(p9) = 1.
Since C\ = 0,
A1.5) Fixn = Co + n2{c2 + c3n + ¦¦¦ + cknk~2),
and by A1.4)
p2q\
so
2\ Fi Fi - Fixp2 + Fixp =
by A1.5). It follows that
co(l - 1) + c2(p4 - p2) + c3(/ -/) + ••• + ck(p2k - pk) E ql
for all primes q and p (since Fixp2 - Fixp is certainly divisible by p2). So
co(l - 1) + c2(p4 - p2) + c3(/ - p3) + • • • + ck(p2k - pk) = 0;
taking the limit as p -» oo of ^-(Fixp2 -Fixp) shows that ck = 0, which is a
contradiction. D

184 11. SEQUENCES ARISING IN GRAPH THEORY AND DYNAMICS
11.2.2. Realization of linear recurrence sequences. The Lucas sequence
L+ : 1, 3,4,... is realizable, while the Fibonacci sequence 1,1, 2,... is not. Puri
[1053] showed that if u = (a, 6, a+ 6,...) satisfies u(n + 2) = u(n + l) + u(n), then
u is realizable if and only if b = 3a. This gives a stronger form of Lemma 11.2.
For any k > 1, there is no map T : X -> X for which Fixn(T) = F(n + &),
where F : 1,1,2,3,... is the Fibonacci sequence. For, if F(k + 1), F(k + 2),... is
realizable, then F(k + 2) = 3F(k + 1), which is impossible.
These arguments generalize to give a precise characterization of all realizable
sequences which satisfy a given binary recurrence relation. Notice that any such
sequence could be signed, so it makes sense to ask whether the sequence of abso-
absolute values is realizable or not. An example is the sequence —1,3,—4,7... which
satisfies u(n + 2) = — u(n +1) -f u[n) and is realizable in absolute value. Given a
binary recurrence relation with integer coefficients, the C-space of all solutions has
dimension 2. The reaiizabie subspace is the subspace generated by the realizable
solutions. For the Fibonacci recurrence, the realizable subspace has dimension 1
and is spanned by the Lucas sequence.
Theorem 11.7. Let u denote an integer sequence satisfying a non-degenerate
binary recurrence relation. Let A denote the discriminant of the characteristic
polynomial associated to the recurrence relation. Then the realizable subspace has
A) dimension 0 if A < 0,
B) dimension 1 if A = 0 or A > 0 is non-square, and
C) dimension 2 if A > 0 is a square.
Example 11.8. A) If the recurrence relation is u(n + 2) = u(n + l) —
2u(n) then A = —7. Theorem 11.7 says no solution, besides the trivial
solution, is realizable in absolute value.
B) For the Fibonacci recurrence. A = 5 is non-square. Theorem 11.7 explains
why the realizable subspace has dimension 1. The proof is constructive
and yields the Lucas sequence as a generator for the realizable sequences.
C) For the recurrence relation u{n + 2) = 4u(n + 1) — 4u(n), the solutions
u(n) = A2n, for A > 1 are all realizable. Since A = 0, these are the only
ones.
D) For the Mersenne recurrence u(n + 2) = 3u(n + 1) — 2u(n), there are
realizable solutions u{n) = A2n + B for all A,B > 1. Here A = 1 is a
square.
Before the proof of Theorem 11.7, we begin with some notation. Suppose we
are given a binary recurrence sequence u. This means that u(l) and uB) are given
as initial values with subsequent terms defined' by a recurrence relation
A1.6) u{n + 2) = Bu{n + l)-Cu(n).
The polynomial f(x) = x2-Bx+C is the characteristic polynomial of the recurrence
relation. Write
A'=(-C
for the companion matrix of /. The zeros a.\ and a-2 of /, are the characteristic roots
of the recurrence relation. The assumption on non-degeneracy means that a\/a2
is not a root of unity. The discriminant of the recurrence relation is A = B2 - AC.
The general solution of the recurrence relation in these cases is as follows:

11.2. SEQUENCES ARISING IN DYNAMICAL SYSTEMS 185
A = 0: u{n) = G1 + 72n)a" (here ax = 0:2).
A =^ 0: u(n) = 710^ + 72«2 •
Proof, (of Theorem 11.7) Assume first that A = 0, and let p denote any prime
which does not divide 72. Then the congruence in Lemma 11.3 is plainly violated at
n = p unless 72 = 0. In that case, 171a" | is realizable and the space this generates
is 1-dimensional.
If A > 0 is a square, then the roots are rationals and plainly, must be integers.
We claim that for any integers 71 and 72, the sequence ^a™ +720:2! *s realizable.
In fact (up to multiplying by a full shift) this sequence counts the periodic points
for an automorphism on a one-dimensional solenoid, see [373] or [732].
The two cases where A ^ 0 is not a square are similar. Write a = e + /\/A for
one of the roots of / and let K = Q(a) denote the quadratic number field generated
by a. Write Tk|q : K —> Q for the usual field trace. The general integral solution
to the recurrence is u(n) = TK\q{{a + b\/A)an), where a and b are both integers or
both half-odd integers. Write v(n) = TK\q(aan) and w{n) = TK\q{b\fKan). Now
v(n) = atrace(^), so v(p) = v(l) mod p for all primes p.
Let p denote any inert prime for K. The residue field is isomorphic to Fp2.
Moreover, the non-trivial field isomorphism restricts to the Probenius at the finite
field level. Reducing mod p gives the congruence
\TKap - \fKa = \fKa - \fKap (mod p).
Thus w(p) = —w(l) mod p for all inert primes p. On the other hand, v(p) = v(l)
mod p for all inert primes p.
If \u(n)\ is realizable then \u(p)\ = |u(l)| mod p by Lemma 11.3. If u(p) = —u(l)
mod p for infinitely many primes p then v(p) + w(p) = v(l) —w(l) = —v(l) — w(l)
mod p. We deduce that p|u(l) for infinitely many primes and hence v(l) = 2ae = 0.
We cannot have e = 0 by the non-degeneracy, so a = 0. If u(p) = u(l) mod p then,
by a similar argument, we deduce that bf = 0. We cannot have / = 0 again, by
the non-degeneracy so b = 0. This proves that when A ^ 0 is not a square, the
realizable subspace must have rank less than 2.
Suppose firstly that A > 0. We will prove that the rank is precisely 1. In
this case, there is a dominant zero. If this root is positive then all the terms of
u are positive. If the dominant term is negative then the sequence of absolute
values agrees with the sequence obtained by replacing a by —a and the dominant
zero is now positive. In the recurrence relation A1.6) C = Nk|q(o;), the field
norm, and B = Tk|q(o;). We are assuming B > 0. If C < 0 then the sequence
u(n) = trace(A^) is realizable because the matrix A/ has non-negative entries. If
C > 0 then we may conjugate A/ to such a matrix (this leaves the sequence of
traces invariant). To see this, let E denote the matrix
Then
k
E-1AfE=yBk_k2_c
If B is even, take k = B/2. Then the lower entries in E~lAfE are {B2 - AC)/A =
A/4 > 0 and B/2 > 0. If 5 is odd, take k = (B + l)/2. Then the lower entries
are (B2 - 1 - 4C)/4 = (A - l)/4 > 0 and {B - l)/2 > 0. In both cases we

186 11. SEQUENCES ARISING IN GRAPH THEORY AND DYNAMICS
have conjugated Aj to a matrix with non-negative entries. Since we know that
the sequence of traces of a matrix with non-negative entries is realizable, we have
completed this part of the proof.
Finally, we must show that when A < 0, both sequences v(n) and w{n) are
not realizable in absolute value. Assume a ^ 0, and note that v(l) = 2ae ^ 0
by the non-degeneracy assumption. For all primes p we have v(p) = v(l) by the
remark above. Since the roots a\ and a.2 are complex conjugates, \a.\\ = \a^\.
Let P = ^ arg(ai/a2); ft is irrational by the non-degeneracy assumption. The
sequence of fractional parts of pfi, with p running through the primes, is dense in
@,1) (this was proved by Vinogradov [1303]; see [1297] for a modern treatment).
It follows that there are infinitely many primes p for which v(p)v(l) < 0. Therefore,
if \v(n)\ is realizable then it satisfies v(p) = v(l) mod p and —v(p) = u(l) mod p
for infinitely many primes. We deduce that v(l) = 0, which is a contradiction.
With w(n) we may argue in a similar way to obtain a contradiction to w(l) ^ 0. If
|u>(n)| is realizable then Lemma 11.3 says |u>(p2)| = |w(p)I = \w(l)\ for all primes
p. Arguing as before, w(p2) = w(l) for both split and inert primes. However,
the sequence {p2f3}, p running over the primes, is dense in @,1). (Again, this is
due to Vinogradov in [1303] or see [433] for a modern treatment. The general
case of {F(p)}, where F is a polynomial can be found in [518].) We deduce that
w(p2)w(l) < 0 for infinitely many primes. This means w(p2) = w(l) mod p and
w{p2) = —w{\) mod p infinitely often. This forces w(l) = 0 - a contradiction. ?
Theorem 11.9. Let f denote the characteristic polynomial of a non-degenerate
linear recurrence sequence with integer coefficients. If f is separable and has ?
irreducible factors and a dominant zero then the dimension of the realizable subspace
is <L
If the dominant root itself is sufficiently large, then more can be said.
Theorem 11.10. Suppose f is a polynomial with ? irreducible factors. If f
has a dominant zero that is greater than or equal to the sum of the moduli of its
conjugates, then the realizable rank for the recurrence sequences associated to f is
exactly ?.
Example 11.11. Consider the sequences which satisfy the Tribonacci relation
A1.7) "" u{n + 3) = u{n + 2) + u(n + l) + u(n).
The sequence 1,3,7,11,21,... satisfies A1.7) and is realizable. This is the
sequence of traces trace(^4n), where A is the companion matrix to f(x) = x3 — x2 —
x- 1,
/0 1
A=\0 0 1
V 1 h
Theorem 11.9 says that any realizable sequence which satisfies A1.7) is a multiple
of this one. The proof of Theorem 11.9 uses the methods introduced in the proof
of Theorem 11.7.
11.2.3. Local realizability. This section explores the idea that some real-
realizable sequences are realizable everywhere locally as well. For any integer n, and
any prime p, let [n]p = pordp(n) > 1 denote the p-part of n (the p-part of zero is
defined to be zero). A sequence u is locally realizable at p if the sequence ((un]p)

11.2. SEQUENCES ARISING IN DYNAMICAL SYSTEMS 187
is realizable. A sequence is everywhere locally realizable if it is locally realizable
at every prime p. Notice that the p-part of a sequence is always non-negative. To
stress the comparison, we will sometimes refer to a realizable sequence as globally
realizable. A non-negative sequence is globally realizable if it is everywhere locally
realizable.
Example 11.12. The following examples illustrate how local readability may
arise (and how its failure may indicate subtle arithmetic properties of the sequence).
A) Any Lehmer-Pierce sequence is everywhere locally, and hence globally,
realizable. For the Mersenne case, this may be seen as follows: For each
prime p, the map Tp : x \—> x2 on the group of pth power roots of unity
has Fixn(Tp) = [2n — l]p. The general case is similar, but a convenient ap-
approach uses character theory: To see this at work, first re-do the Mersenne
case in these terms. Let Z(p) denote the localization of Z at p. Then the
map T dual to x h->¦ 2x on Z(p) is an 5-integer dynamical system in the
language of [231], so Fixn(T) = riP^<oo I2" - 1|, = [2n - 1]P. The prod-
uct runs over all primes, including the infinite prime, corresponding to the
usual absolute value. The general case follows exactly the same lines.
B) The sequence (b(n)), where b(n) is the denominator of B2n is everywhere
locally, and hence globally, realizable. Here Bn are the Bernoulli numbers
defined by the formula
i oc in
et_1 n\
n=0
(see Section 9.3). Then Bn e Q for all n, and Bn - 0 for all odd n > 1.
To show the local readability, let
{{p — l)/2 if p is an odd prime,
Z II p = Z.
Define Xp = Z/qpZ. Now define Tp : Xp -+ Xp by the map Tp{x) = x + 1
mod qp. Plainly Fixn(Tp) = q if and only if q\n. The Clausen von Staudt
Theorem [516], [620] states that
" € Z,
so'Fixn(Tp) = max{l, |B2n|p} as required.
C) The numerators of the even Bernoulli numbers are realizable globally, but
are locally realizable only at the regular primes (see [867]).
D) The Fibonacci sequence is not everywhere locally realizable (because it is
not globally realizable), it is locally realizable at primes p = 1 or 4 modulo
5. This is an easy generalization of the argument realizing the p-parts of
the Mersenne sequence given above.
The Bernoulli denominator and numerator examples suggest a dynamical inter-
interpretation of the Kummer congruences (for a proof of these see [620]). If p denotes
a prime and p — l does not divide n then n = n' mod (p - l)pr implies
n nf
by A1.4)

188 11. SEQUENCES ARISING IN GRAPH THEORY AND DYNAMICS
11.2.4. Algebraic realizability. The maps constructed in Example 11.12.1,2
have additional structure — they are actually group automorphisms. A sequence
of non-negative integers is algebraically realizable if it counts the periodic points of
a group endomorphism. A sequence that is locally realizable everywhere is globally
realizable; the Bernoulli numerators show the converse does not hold. It is easy to
see that the sequence of periodic points of an automorphism of an abelian group
will be locally realizable: Moss [867] extended this by proving that the periodic
point sequence for any endomorphism of a locally nilpotent group is everywhere
locally realizable.
A natural problem for algebraically realizable sequences concerns prime appear-
appearance. Suppose u is a sequence realized by a group endomorphism that does not
split as a product of two non-trivial endomorphisms. Then u must be a divisibility
sequence with u(l) =? 0. How often is u(n)/u(l) prime?
Example 11.13. The conjectured answer 'infinitely often' relates to existing
conjectures as follows.
A) For the map x t-> 2x mod 1 on the compact group T, this question is the
same as the classical Mersenne prime problem (see page 93).
B) For Example 11.12.2, the sequence of even Bernoulli denominators, bn/b\
is prime if and only if n is a prime for which 2n + 1 is a prime. Such a
prime is known as a Sophie Germain prime. It is conjectured that there
are infinitely many Sophie Germain primes.
C) A remark of McLaren suggests the following example: There is a group
automorphism T : X —> X such that Fixn(T) takes on infinitely many
distinct prime values. To see this, construct a set 5 of prime numbers
recursively as follows: 2 e S, and p e S if and only if. p — 1 is divisible
by a prime q = qp which does not divide p' — 1 for all p' € 5 with
p' < p. Clearly 5 is infinite (if not, all sufficiently large primes could be
written as 1 + pj1 .. . p?r for some fixed set of primes {pi,... ,pr}, where
e\...., er lie in N; the number of such primes bounded by X is clearly
O((logX)r) which contradicts the Prime Number Theorem). For each
prime p e S, let hp denote an element of order q = qp in Xp = ?p and
define the automorphism Tp : Xp —> Xp by Tp(x) = hpx. Then define the
automorphism T on X by
X =JJXP and T=]JTP
pes pes
Clearly T(q) = p, where q = qp, showing that Fixn(T) takes infinitely
many distinct prime values.
11.2.5. Group Automorphisms and Subshifts. Example 11.1 included a
map constructed on the set of all infinite paths on a labelled graph. It will be
useful to record here the periodic point'sequence associated to this construction in
general, and to a simple class of algebraic examples.
Example 11.14. Given a matrix A € Mfc(Z+), there is an associated subshift
of finite type Ta ¦ XA —> Xa, with trace(^4n) points of period n. The set Xa is the
set of labels of infinite paths on the graph with adjacency matrix A, and the map
TA is the left shift on this set. The defining matrix A (or the shift XA) is called
irreducible if for each pair i,j there is some power of A for which the (i,j)th entry

11.2. SEQUENCES ARISING IN DYNAMICAL SYSTEMS 189
is positive. Two special c&ses are worth mentioning. If A = (ay) € Mjt({0,1}),
then XA = {x € {1,,., ,k}z : aXjXj+l = 1 for all jf} and TA is the left shift on the
closed subset XA of the compact space {1,... , k}z. If A = (ay) has ay = 1 for all
i and j, then the full shift on k symbols is obtained, with kn points of period n.
Example 11.15. Recall Example 11.1D): Let Af denote the automorphism
of the d-torus defined by the companion matrix of the monic polynomial F e Z[x].
Then Fixn(,4F) = An{F) = Jlti \K ~ 1| where F{x) = YlUx ~ <M- By analogy
with the dynamical properties of the map Ap, call F ergodic if no Aj is a root of
unity, expansive if no Aj has unit modulus, and quasihyperbolic if it is ergodic but
not expansive (see Lind [728]).
Example 11.16. Let R denote Z[—-—], the smallest subring of the rationals
in which the primes qx,... ,qs are invertible. Then, for each ? e Rx, the auto-
automorphism T:X = R-+X = R dual to the automorphism x i—> ?x of R is a
homeomorphism of a compact space with |?n — 1| x Y\l=i l?n ~ 1|<?« points of pe-
period n. The sequence of periodic points for this example is in general not a linear
recurrence sequence, but is the image of one under the map n i—> n x J*| \n\Qi.
The number of periodic points in an irreducible subshift of finite type or an
ergodic toral automorphism always has a specific logarithmic growth rate, related
to a global invariant of the dynamical system. The existence of this growth rate
may be seen using Baker's Theorem, but is less subtle than Theorem 2.3.
Theorem 11.17. IfT is an irreducible subshift of finite type or an ergodic toral
endomorphism. then
-logFixn(T)-+/i(T),
n
where h(T) (the topological entropy of T) is given by logA^ if T is the subshift
of finite type corresponding to the matrix A with Perron-Frobenius eigenvalue \A,
and Yli=i 1°S+ \^i\ tfT is the toral endomorphism corresponding to the matrix with
eigenvalues {Ai,... , A^}.
For sequences of the form given in Example 11.1.4, Lehmer [695] used the more
delicate measure Fix.n{Ap)/Fixn^i(Ap); this converges in the expansive case but
never converges in the quasihyperbolic case. A similar result holds in the multi-
parameter setting of Zd-actions by [731].
Example 11.16 is rather different: The sequence of periodic points is not in
general a linear recurrence sequence, and the growth rate may be extremely com-
complicated (see [231] for some examples, and [1336] for conjectures and results about
'typical' examples, where the Artin conjecture and the problem of the infinity of
Mersenne primes appear yet again). It should be noted that the examples of exotic
sequences of periodic points constructed for group automorphisms in [347] are not
correct; indeed they violate Lemma 11.3.
11.2.6. Realization in Rate. The sharp property of readability has a softer
counterpart expressing the property of being approximated by the sequence of pe-
periodic points for some map. Write [x\ for the greatest integer less than or equal to
x and far] for the smallest integer greater than or equal to x. A sequence @n)n>i
is realizable in rate if there is a map T : X -> X for which Fix^"r) -> 1 as n -> oc.
Theorem 11.18. Let a, ft be positive constants.

190 11. SEQUENCES ARISING IN GRAPH THEORY AND DYNAMICS
A) If 4>n —> oc with ^ —> 0, then (ft is not realizable in rate.
B) The sequence {[na\) is realizable in rate if and only ifa>l.
C) The sequence ([/3nJ) is realizable in rate if and only if j3 > 1.
Proof. 1. Assume that 4> is realizable in rate; let (Fixn) be the corresponding
sequence of periodic points. Then ^^ —> 1, so {^f^} is bounded. It follows that
{^ = ^;On} is bounded, and hence Ln = n On = 0 for all large n. This implies
that Fixn is bounded, and so Fj^IL —> 0, which contradicts the assumption.
2. For a e @,1) this follows from the previous part. Suppose therefore that (n) is
realizable. Then there is a sequence of periodic points (Fixn) with Fixn jn —> 1, so
for p a prime, p Op = Lp = Fixp — Li, and therefore Op —> 1 as p —> oo. Since Op is
an integer, it follows that Op = 1 for all large p. Now let q be another large prime.
Then
Fixp(? _ Lpq + Lp + Lq + Li _ Lpq 11 Li
pq pq pq p q pq'
so
l l L
p q pq pq
Fix p large and let q tend to infinity to deduce that
- €Z,
P
which is impossible. The same argument shows that Fixn jn cannot have any
positive limit as n —» oo.
For a > 1, let On = \na~1 Ylpufi ~P~a)}> where the product runs over prime
divisors. Then
d\n p\d d\n d\ii
so 0 < Fixn -<pn< o(na).
3. This is clear: For C < 1 the sequence is eventually 0; for j3 > 1 the construction
used in part 2. works. ?
There are sequences growing more slowly than na, a > 1 that are realizable in
rate: In [1053, Chap. 5] it is shown that ([Cns(logn)rJ) is realizable in rate for
any r > 1,C > 0, s > 1. Much of this section is motivated by the thesis of Yash
Puri [1053]. Most of the results appeared in [367] and [1054]. Background on
Example 11.14 may be found in the book of Lind and Marcus [730]; the periodic-
point formula in terms of traces is in [730, Prop. 2.2.12]. Example 11.16 comes
from [231].

CHAPTER 12
Finite Fields and Algebraic Number Fields
The ability to construct a normal basis for a field extension is important for
many reasons. In Section 12.1 effective results for normal bases are discussed,
both in positive characteristic and in number fields. Section 12.2 discusses the
(near-) Euclidean property of number fields and the connection to finitely-generated
multiplicative groups. The last two sections are concerned with Gaussian periods
and a problem due to Kodama.
12.1. Bases and other Special Elements of Fields
As mentioned in Section 9.2, the Shanks sequence (9.8) on page 147 and its gen-
generalizations are used in computational number theory because they provide explicit
formulae for fundamental units of the corresponding quadratic number fields [1031],
[1353]. For example,
ex = 4~XBX + 1-|
is a fundamental unit of Q{y/S^). Let L denote a field and K a normal extension
of degree n. Any normal extension has a normal basis, that is a basis of the form
A2.1) oro(a),ori(a),... ;orn_i(a), a e K,
where {<7j} is the Galois group Gal(K/h). Although the approach described here
works in many other situations we concentrate on the cases L = Q and L = ?q. -In
the latter case A2.1) takes the form
A2.2) a,aq,... ,aqn~\ a e ?q*.
A survey of methods to construct normal bases (with an emphasis on the case
L = Fq) is given in [1202, Chap. 4]. Here we present only certain relevant results
which heavily rely on the theory of linear recurrence sequences.
Historically, the first connection between normal bases and linear recurrence
sequences was discovered in [1237], [1238]. In those papers the problem of finding
a primitive normal basis over ?q is considered. That is, a normal basis of the
form A2.2) for which a is a primitive root of ?qn. The question about the existence
of such bases was raised by Davenport [281] in 1952. In full generality, the existence
result, as well as a brief outline of previous results are presented by Lenstra and
Schoof [701].
Theorem 12.1. Let a denote a primitive root of?qn. Then there is an absolute
constant c > 0 such that for some h < N(n, q) where
N(n,g) = max {en logg, expexp(clog2 n)} ,
ah generates a primitive normal basis of?qn over?q.
191

192 12. FINITE FIELDS AND ALGEBRAIC NUMBER FIELDS
Proof. The elements
form a primitive normal basis if and only if {x, qn - 1) = 1 and if they are linearly
independent over ?q. Fix a normal basis
of F9" over ?q. Denote the coordinates of the elements ax in this basis by
so that
n-l
axq" _ ^ ai-j{x)LUi 0 < j < n - 1,
where ae(x) = a.c+n{x) f°r ^ < 0.
Denote by A(x) the circulant matrix
A(x) = (a---(x))n<- ¦<
It is clear that ax generates a normal basis if and only if det A(x) ^ 0. On the
other hand, ax is primitive if and only if {x, qn - 1) = 1.
Let
be the minimal polynomial of a over ?q. Then, for each i = 0,... ,n — 1, the
sequences Oj satisfy the recurrence relation
Let pi,... , pn be distinct nth roots of unity in ?q. Then
detA(x) = bi(x)...bn{x), ar = 1,2,... ,
where
bi(x) = ao{x) + Pia^x)-] h p^~lan^i{x), 1 < i < n.
Since ?q» has a normal basis over ?q, each sequence bi, 1 < i < n, is non-zero.
It is easy to see that aTqt ^ aTgJ if 0 < i < j < n - 1 and 0 < T < q. Hence,
applying Theorem 5.9 to each sequence 6X,... ,6n (with r > q) we find that the
number of integers x < N with det A{x) = 0 is
On the other hand, the number of x < N with {x,qn - 1) = 1 is
T2(A^) > 7r(JV) - u{qn - 1). "
Noticing that Tx (Ar(n, ?)) < T2 {N(n, q)) we obtain the assertion. ?
This statement is non-trivial in the sense that N(n,q) < qn for
n<expfc(LogloggI/2N
with some absolute constant C > 0.
Schlickewei and Stepanov [1136] noticed that the same method can be trans-
transferred directly to the study of normal bases of algebraic number fields K whose
Galois group is cyclic. More precisely, they deal with normal bases generated by
powers of a fixed element a € K. Multiplicity bounds presented in Section 1.1
play the role of Theorem 5.9 in the considerations above. Later, in [1135], [1239],

12.1. BASES AND OTHER SPECIAL ELEMENTS OF FIELDS 193
the results of that paper were transferred to arbitrary algebraic number fields and
drastically improved by using better estimates from [1133] for the number of zeros
of linear recurrence sequences. The result of [1133] is supplemented by that of [6].
The next result is one of the results from [1135] relying on the bound B.3)
from page 27 from [1133]. Other bounds imply other versions of this assertion.
Theorem 12.2. Let K denote a Galois extension of Q of degree n. Suppose
that a € K generates a normal basis of K over Q. Then there exists an effectively
computable subset R(a) cQ of cardinality
such that, for each r € <Q\R(a), all powers (a + r)x, x € Z, with possibly 22 "
exceptions, generate a normal basis ofK.
Over number fields some complications arise which do not occur in the case of
finite fields. First, the exceptional set R(a) must be introduced to guarantee that
the corresponding linear recurrence sequence is non-degenerate. The characteristic
roots of that sequence are all possible products of the form
{ai{a) + r)Sl ... {an{a) + r)Sn , s{ > 0, Si + • • • + sn = n.
Thus the sequence itself is of order
Indeed, the analogue of the matrix A in the proof of Theorem 12.1 is not circulant,
so its determinant is still a linear recurrence sequence but cannot be split into a
product of n linear recurrence sequences of order n. To exclude degeneracy, we
have to exclude the set R(a) of solutions r 6 Q of the equations
(a,(a) + r)Sl ... (an(a) + rM" - p (ax(a) + r)h ... (an(a) + r)<" = 0,
where p runs through the roots of unity in K, and where (si,... , sn) ^ (ti,... ,tn)
satisfy Si > 0. si + • • • + sn = n; tt > 0, tx + • • • + tn = n. Therefore |i?(a}| <
nmL where m is the number of roots of unity of K. We have p(m) < n, thus
m = O(n Log log n).
In the same paper, the considerations used in the proof of Theorem 7.4 are
applied to derive the following statement [1135].
Theorem 12.3. Let K denote an abelian extension o/Q of degree n. Suppose
the Galois group Gal(h/Q) is a product of s cyclic groups of orders ni,... ,ns
respectively. Suppose moreover that a is an element in L such that for some integer
k, ak generates a normal basis ofK over Q. Let
Then, for each M € Z, at least one of the powers
aM+x, l<x< JV(K),
generates a normal basis ofK over Q.

194 12. FINITE FIELDS AND ALGEBRAIC NUMBER FIELDS
In particular, this implies that for s fixed (indeed for s = o(logn)),
logiV(K) = O(n?).
Moreover, for cyclic extensions of degree n one can take
fn + t{ti) -
N(K) =
These questions concerning normal bases of algebraic number fields generated
by powers might seem unnatural, but they are related to a very classical question
about normal bases generated by a unit. For example, let ?1,... ,eT denote a
multiplicative basis of the group of fundamental units K and put Nn = Bn~1)- If
K has a normal basis over F generated by a unit then there exists a root of unity
p € R(K) such that, for any integers Mi,... , Mr, at least one unit
-Mr+Xr 1 < T, T < N
generates a normal basis of K.
Lorenz [739] proves that any finite normal extension K of an algebraic number
field F has a normal basis which consists of units if and only if K is not one of the
following exceptional types:
• K is imaginary;
• F is real;
• every unit of K is either real or pure imaginary.
Several other results can be found in [553] as well.
All the results above about the distribution of normal bases can be translated
into efficient algorithms to construct such bases.
Some interesting equations involving linear recurrence sequences are in the
paper [958] addressing so-called exceptional units. These are units s of an algebraic
number field K for which 1 — ? is also a unit.
Primitive roots of finite fields are another type of special element for which
the theory of linear recurrence sequences can be useful. For example, it is not
fully known if there are any approaches to the construction of primitive roots via
linear recurrence sequences (or via any other technique; a survey of this problem is
in [1202]). On the other hand, one can consider approximate constructions which
are important from the point of view of practical computation and are theoretically
attractive as well.
• Given an integer T, construct a field Fg and an element a G F, of period
at least T.
• Given a prime p and an integer T, construct a field Fg of characteristic p
and an element a € Fg of period at least T.
Of course 'construct' should be understood as 'efficiently construct', preferably in
polynomial time. Also, it is desirable to have q as small as possible.
Surprisingly, there is a very nice answer to the first problem and a satisfactory
answer to the second one. Let p denote the smallest prime with
-T
.P-l
so p ~ | logT. The bound (9.16) says that the roots of the Artin-Schreier poly-
polynomial Xp — X — 1 are of period at least T. Thus we obtain a very simple and
efficient construction of a finite field ?q with q = To(LoglogT) elements, and an

12.1. BASES AND OTHER SPECIAL ELEMENTS OF FIELDS 195
element a € ?q of period at least T. In the language of complexity theory, this is
a polynomial (indeed, quasi-linear) time construction.
For the second problem, when the characteristic is fixed, the situation is more
complicated and a more ingenious approach is needed. To explain this construction,
we introduce Gaussian periods over a field ?q. Let n and k denote positive integers
such that r = nk + 1 is prime with gcd(r, q) = 1, and let C denote a primitive rth
root of. unity in Fgr-i. A Gaussian period of type (n,k) is defined as
fc-i
i=0
where g is a primitive root of F,.. Gaussian periods can also be defined for algebraic
number fields, and there is a similar construction for composite r.
Gaussian periods are of great interest, but — unfortunately — there are two
obstacles on the path to finding good complexity estimates for their construction.
The first is, given n we need to find or at least to estimate the smallest k satisfying
the conditions above. The second is finding C, which is equivalent to factoring cy-
clotomic polynomials. Nevertheless, as Bach and Shallit demonstrate in [49], both
problems can be satisfactory solved under the Generalized Riemann Hypothesis.
They provide the conditional bound /;«n4 log2 (np) for the smallest acceptable
k, and design a polynomial-time algorithin for factoring cyclotomic polynomials.
Moreover, if the characteristic of ?q if fixed, then Berlekamp's algorithin factors
any polynomial over Fg in polynomial time and does not rely on any unproven
hypothesis. A survey of various improvements to Berlekamp's basic scheme is pre-
presented in [1202. Sect. 1.1].
Gao, von zur Gathen and Panario [423] show that if r = nk + 1 is prime and
gcd(nk/t,n) = 1. where t is the period q modulo r, then any Gaussian period a
of type (n, k) generates a normal basis of ?q« over ?q. They also present many
computational results showing that very often a Gaussian period is of large mul-
multiplicative order or even is a primitive root of Fg» (thus generating a primitive
normal basis of Fgn over ?q): The paper [427], although having a classical number-
theoretic flavour, has been motivated by applications to Gaussian periods. The
papers [428], [430], [429] have been motivated by that computation. Below we
present two results obtained there, in slightly simplified forms.
Let A denote the set of all Artin integers a E N. Those are integers for which
Artin's conjecture holds in the following quantitative form: a € A if and only if a is
a primitive root for ira(N) S> iV/log2 N primes less than or equal to N. As shown
in Chapter 3, it is known that A contains the odd powers of all but at most three
prime numbers, and contains all prime numbers under the Generalized Riemann
Hypothesis.
Theorem 12.4. For any fixed prime power q ? A there is a constant c(q) > 0
such that for any N > 2, there is an integer n with N <n < c(q)N\ogN such that
for C a primitive Bn + \)th root of unity in ?q?n, a = ft + C~l generates a normal
basis of?qn over ?q, and has period T > 2B'^ ~2. The numbers n and a can be
found in time polynomial in N.
The following result holds for all primes, not only Artin primes, and produces
a denser sequence of allowed n. In compensation, the property of a being normal
is lost, and a weaker and less explicit bound is found.

19G 12. FINITE FIELDS AND ALGEBRAIC NUMBER FIELDS
Theorem 12.5. There is an absolute constant C > 0 such that for any fixed
prime power q there is a constant c(q) > 0 such that for any N > 2 there is an
integer n with
N <m = <pBn + 1)<N + O(N/ logc N)
such that for C a primitive Bn + l)th root of unity in ?qm, a = C + f3~l generates
a basis of ?qm over ?q and has period
T > exp (c(q)m1/2) .
The numbers n, m and a can be found in time polynomial in N.
The main ingredients of the proof are a result of Tijdeman [1283] and the
bound G.9). All the constants above can be evaluated in terms of q, so the condition
that q is fixed can be dropped by doing everything explicitly; see [428] for the
details. It is plausible that the sub-exponential lower bound above can be essentially
improved (perhaps to exp(cn)). Several more results of this kind have also been
given in [429] and [430].
Returning to the original question about approximate constructions, notice
that for any prime p and integer T, Theorem 12.5 provides a polynomial time
construction of a field ?pn with n ~ log2 T and an element a ? ?pn of period at
least T.
12.2. Euclidean Algebraic Number Fields
The Euclidean property and 'near-Euclidean property' (see below) of algebraic
number fields (with respect to the field norm) is related to certain properties of
finitely generated groups. It is also interesting to note that Lenstra [700] demon-
demonstrates that the Euclidean property with respect to some other function (a certain
modification of the norm) is related to Artin's conjecture and its modifications.
Let K denote an algebraic number field of degree n over Q, and let Zk denote
its ring of integers. For an integer ideal q, denote by Aq the residue ring modulo
q, and by Aq. the multiplicative group of units of this ring. It is well-known that
|Aq| = N(q) and |Aq-| = <y?(q), where <p is the Euler function in Zk.
For a residue class a ? Aq denote by Nq(a) the minimal norm of all elements
of a,
iVq(a) = min | N(a) |,
and let L(K, q) and A(K, q) denote the largest and average values of Nq(a) over all
residue classes of Aq«. That is,
L(K.q) = jnax Nq(a), A(K,q) = ~-^ ? Nq(a).
Clearly A(K,q) < L(K,q) = O(N(q)). Upper bounds for the implied constant in
this estimate are obtained by Davenport in [282], where some connections between
this problem and the theory of Diophantine approximation are found.
Notice that the inequality
L(K,q)<N(q)
(even for principal ideals) would mean that K is Euclidean with respect to its norm
(so far very few examples of such fields are known, see [699], [700], [703], [909],
[959]; a complete catalogue of known Euclidean number fields is given in [698]).

12.2. EUCLIDEAN ALGEBRAIC NUMBER FIELDS 197
On the other hand, upper bounds on L(K, q) and A(K, q) show that in some sense
any algebraic number field is nearly Euclidean, or is at least Euclidean on average.
Now suppose that K has r > 1 fundamental units; that is, that K is neither
Q nor an imaginary quadratic extension of Q. Egami [322] was the first to notice
that non-trivial estimates for A(K, q) are possible, and proved that A(K,p) = o(pn)
for almost all p € P. From now on it will be convenient to identify integer algebraic
numbers with the corresponding principal ideals. Thus,
A2.3) - A(Krq) = o(N(q))
for some infinite sequence of integer ideals q. In fact, Egami formulates this result
in a slightly different but equivalent form. Thus in fields with r > 1 the behaviour
of A(K, q) differs from that of A(Q, q) with integers q > 2, for there one has
|a|=<?/4
-q/2<a<q/2
The result of [322] is improved in [1193]. There it is shown that A(K,p) =
O(pn(logp)/3), and that A(K,p) = O(pn-l/6(\ogpI/3) for all and almost all
rational prime numbers p, respectively. Thus in place of A2.3), we see that there
is an infinite sequence of integer ideals q with
A2.4)
Konyagin and Shparlinski [629] consider prime ideals p and their powers pk in-
instead of just principal ideals (p). This leads to much stronger bounds than A2.3)
and A2.4). First of all, they show that A(K, p) can be non-trivially estimated for
all prime ideals (rather than for almost all).
Theorem 12.6. Let K have r > 1 multiplicatively independent fundamental
units, and let p denote a prime ideal. Then
= O(N(p)(logN(p))-r/2\
Moreover, for almost all prime ideals p a much stronger estimate for A(K, p)
and a non-trivial upper bound for L(K,p) can be obtained.
Theorem 12.7. Let K have r > 1 multiplicatively independent fundamental
units. Then for any fixed r < A — log2)/2, the bounds
) t/r>2,
\O(N(pI5/i6exp(-§log'N(p))),
and
A(K, p) = O (NtpI/2*1/2^ exp (-i logT N(
hold for a sequence of prime ideals p of asymptotic density 1.
It is evident that r + 1 > n/2; see [909, Theorem 3.6]. Thus the estimates of
Theorem 12.7 can be re-written in the form
L(K,p) = o (N(pI/2+2/n), i4(K,p) = o
Finally, they show that Korobov's results [636], [637] imply the following theorem.
Theorem 12.8. Suppose K has r > 1 multiplicatively independent fundamental
units, and that p is an unramified prime ideal of first degree. Then L(K, pfc) = 0A).

198 12. FINITE FIELDS AND ALGEBRAIC NUMBER FIELDS
In fact, the bound G.12) implies that L(K,pk) = O(N(pfcI-1/d+?) for any
unramified fixed prime ideal p of degree d.
Generally, the proofs are based on the following isomorphisms. If p is an un-
unramified prime ideal of first degree then Apfc ~ Z/pkZ, where p = N(p). If p is a
prime ideal of degree d then Ap ~ ?pd, a finite fields of pd = N(p) elements. It is
also useful to observe that in an algebraic number field almost all prime ideals are
of first degree.
Let U denote the multiplicative group of fundamental units of K and let Uq
denote its reduction modulo an integer ideal q. Using the isomorphisms, one can
derive the estimates
A2.5) A{K,p) = O(N(p)|?7p|-1/2) and L(K,p) = O(N(pK/2| t/p]),
which hold for any prime ideal p,
A2.6) L(K.p) = O (min{N(pM/4|?/pr5/8, N(p)9/8|?/pr3/8}),
which holds for any prime ideal p of first degree, and
A2.7) k k1
which holds for any fixed prime ideal p of first degree. Combining them with the
lower bounds C.1). C.2), C.3) gives Theorems 12.6-12.8.
Next we explain how multiplicative groups show up in this question. Begin by
fixing an integral basis lu\,... ,uin of ZK over Z (see [909, Theorem 2.5]), and for
h > 0 let 23/j. denote the box
= {z = zibJi ^ + znuin G ZK; \zi\ < h, i = 1,... , n}.
Denote by R(U,q,h) the set of a € Aq such that the congruence au = x — y
(mod q), u € Uq. x,y ? 23^, has no solution. Let H(U,q) denote the minimal h
for which R(U..q.h) =0. Further, let H($) denote the height of $ G ZK, that is,
the maximal absolute value of coordinates in the representation of i) with respect
to the basis u)\.... ,u;n. Then |N($)| < {nuiH{d))n, where ui is the maximum
of the absolute values of ui^,... l uin and of their conjugates over Q. So, for a €
AqVR(?/,q,/7,),iVq (a)<(nwh)n:
Denote by ?P(N) and LP(N) the number of classes a G Ap with Np(a) = N
and Np(a) > N. respectively. The considerations above show that
On the other hand.
L(K,p) = max{L : LP(N) = 0, N > L}.
and
] LP(N).
N=l ^=0
Thus, in order to get an upper bound for L(K, q), it is enough to find a non-trivial
upper bound for H(U, q), just as an upper bound for \R(U, q, h)\ is needed to esti-
estimate j4(K, q). This reduces the original problem to a question on the distribution
of elements of Uq.
To treat this problem, estimates for character sums on elements of finitely
generated groups, in particular the estimates presented in Section 5.1 ('individual'

12.2. EUCLIDEAN ALGEBRAIC NUMBER FIELDS 199
as well as 'on average') could be used. After a standard technical argument, one
can derive from E.2) that for any prime ideal p
and
This implies A2.5). Also, for a prime ideal of first degree, A2.6) can be derived
from E.4) and E.4). For a prime ideal p of first degree one can get the estimate
\R{U,p,h)\ = 0 (N(p)|C/pr3/2 A +N(pLA4n)),
which improves the previous one for some values of parameters but unfortunately
does not improve A2.6).
Finally, for a sufficiently large power pk of an unramified fixed prime ideal p of
first degree, G.9) implies
and A2.7) follows.
Some comments on these bounds are in order. First, there are links between the
problems considered and an appropriate version of Artin's conjecture for algebraic
number fields. Indeed, if Up = Ap« for an infinite sequence of prime ideals p (this
can be viewed as a modification of Artin's conjecture) then L(K,p) = 1 for this
sequence.
Note that elementary considerations give the lower bound
A2.8) L(K,q) > A(K,q) » N(q)/|tfq| (log log N^))", .
revealing (together with A2.5) - A2.7)) that the behaviour of L(K, q) and A(K, q)
depends on the size of Uq. To show A2.8), denote by rn(N) the number of repre-
representations of integer N > 0 as a product of n different positive integers. It follows
from [909. Lem. 4.2] that there exist at most Tn(N) integer ideals q with N(q) = R.
Thus ?q(N) = O (\Uq\dn(N)). The well-known estimates
Q
]T dn(N) =O(Q(loglogQ)"-1), <p(q) »N(g)/loglogN(g)
N=l
and the equality
lq{N) = <p(q) -
give
i4(K,q) = ^(q)-1 ? lq(N)R
N(q)-1 / Q-l
E k(q)-l-E
=l V N=l
q)-1
1 E min{0, ^(q)
<p(q)/\Uq\ (loglog^q))"-1 » N(q)/|^q| (loglogN(q))n

200 12. FINITE FIELDS AND ALGEBRAIC NUMBER FIELDS
In particular, one can derive from this bound that, for r = 1 (that is, n < 4),
A(K,q) can be large. Indeed, consider the sequence of principal ideals
where e is a fundamental unit of K. It is easy to prove that \Uqk\ = O(k) =
O(logN(q/c)) for such ideals, so
" logN(q)(loglogN(q))n
for an infinite sequence of integer ideals.
We are not aware of other non-trivial general lower bounds for L(K, q) and
A(K, q) (in terms of N(q) only). Any such bounds would be very interesting. Of
course there is a gap between A2.8) and the upper bounds above, but A2.8) seems
to be more precise.
As the next step, one could try to extend A2.5) to an arbitrary integer ideal
q. An appropriate version of A2.5) (and therefore of Theorem 12.6) may per-
perhaps be valid for arbitrary integer ideals q. Difficulties arise from zero-divisors
in Aq; nonetheless it is believed possible to obtain such a generalization. If the
bound A2.5) were generalized in this way one would get an estimates for |[/q| for
almost all integer ideals, and the estimate of A(K, q) would be better than that
which follows from C.1). It is also possible that the bound
holds for an arbitrary integer ideal q and any e > 0.
It may be too much to expect the weak estimate L(K,q) = o(N(q)) for all
integer ideals. However, it is believed that
L(K,q) = o(N(q))
for almost all integer ideals q.
It would "be very useful to study the statistical distribution of A(K,q) and
L(K,q) on the sets of integer ideals, prime ideals and principal ideals, but this
seems to be a difficult problem.
If one could prove that L(K, q) = o(N(q)) (or at least A(K,q) = o(N(q))) for
almost all principal ideals, this would mean that any algebraic number field is nearly
Euclidean, and moreover that the analogue of the Euclidean algorithm would work
and would run in a sub-logarithmic number of steps, for the majority of inputs.
This is quite different to the Euclidean algorithm on the integers, where it runs
in a logarithmic number of steps in both the worst and average cases (see [621,
Sect. 1.2]).
Finally, for applications to the Euclidean algorithm an important problem is
to decide how fast one can find a ? a with |N(a)| = Nq(a) for all (or 'almost all')
integer ideal q and all (or 'almost all') a ? Aq».
Relations between a generalization of Artin's conjecture and Euclidean number
fields are discussed by Lenstra in [700]. In another paper [699], Lenstra develops
a different approach to rinding Euclidean number fields; many new results and
references can be found in [703], [909], [959]. This approach is also related to
studying finitely generated groups, and unit groups in particular.

12.2. EUCLIDEAN ALGEBRAIC NUMBER FIELDS 201
Lenstra [699] considers the largest integer M(K) with the property that there
exists a set Q = {wi,... ojm(K)} C Zk with
Ui-ujZU, l<i<j< M (K),
where U is the unit group of K. If M(K) is large enough, then K is Euclidean.
Lenstra also obtains some upper and lower bounds for M(K).
The same quantity M(K, V) can be defined with respect to any finitely gener-
generated multiplicative group V of K, but in this more general setting it is not clear
how to apply the methods of [699], [703], [909], [959] to obtain upper and lower
bounds for M(K,V). These functions Af(K, V") are related to a question about
cycles in polynomial mappings over algebraic number fields — a problem briefly
considered in Cha'pter 3 (for more details see [910, Chap. 12]).
In [629], Konyagin and Shparlinski consider an analogue of these functions
modulo an integer ideal q.
Define A/(K, V, q) to be the largest integer M such that there exists a set
fi = {wi,... ,u;a/} C Aq
with
A2.9) Ui-uij eVq, 1 < i,j < M, i ^ j.
We present an upper bound for M(K, V, p) for prime ideals p. Using this bound
and the trivial inequality A/(K, V) < M(K, V, p), for an appropriate prime ideal p,
one may get an upper bound for M(K, V). In the case K = Q, q = p a rational
prime number and Vp the set of quadratic residues modulo q, this function has been
considered by Fabrykowski [384]..
Theorem 12.9. Let K have r > 1 multiplicatively independent fundamental
units. IfVp = Ap- then M(K, V",p) = N(p). Otherwise
Fp)<|2N(PI/2 + 2' for any p,
' ~ |4|Fp|2/3 + 2, ifp is of first degree.
In the particular case considered in [384], when q =p is prime, a lower bound
of order logp holds (see [384, Theorem 3]). For groups with |Vj,| large — of order
N(p), say — this can be extended to the case of M(K, V, p). However, for smaller
| VJ, | — of order N(pI~?, say — the approach of that paper does not work, and this
question about lower bounds is still open. It is possible that M(K, V,p) is bounded
for |Vp| = O (N(pI~?). In support of this conjecture, it is shown in [629] that for
K = Q, p = p, M(Q, V,p) =2 infinitely often for |FP| > cp1/3, where c > 0 is an
absolute constant.
More generally, for a set Q = {wi,... ,u>m} C Zk, consider the directed graphs
Q(Q, V) and Q(Q, V, q) with vertices labelled by wi,... , ujm, and an edge from Ui
to u)j if and only if u>i — u)j € V and Ui — Uj G V"q, respectively. Now M(K,V)
and M(K, V, q) are the maximal values of M such that there exist sets Q for which
the graphs ?(Q, V") and (?(fi, V, q) are each A/-vertex complete graphs, respectively.
Gyory [501], [502] deals with various other problems concerning the graph ?(fi, V").
One might try to obtain analogues of those results for the graphs ?(fi, V, q). The
question about the diameter of the graph Q(Ap,V,p) can be reformulated as a
variant of the Waring problem for ?pd, where N(p) = pd, for the power

202
12. FINITE FIELDS AND ALGEBRAIC NUMBER FIELDS
A survey of known results can be found in [627] and in [1202]. The majority of these
results deal with the particular case of a prime field (that is, when p is an unramified
prime ideal of first degree). For example, Konyagin's [627] estimate E.6) implies
that for any e > 0 and any prime ideal p of first degree with sufficiently large norm,
the graph G(AP\ V.p) is connected, and has diameter
Indeed, C.1) implies that
* = (N(p)-l)/|Vp|«p/logp,
and that bound is applicable. The rest goes along the standard lines of using bounds
on exponential sums to derive bounds for the number of solutions of congruences
and equations over finite fields.
12.3. Cyclotomic Fields and Gaussian Periods
Let p denote a prime, and g a fixed primitive root modulo p. In the papers [434],
[435], Girstmair demonstrates relations between the distribution of the g-ary digits
of 1/p (and thus the residues of gx) and some properties of the minus part h~ (p. s)
of the class numbers of the subfield Ks C Q (expB7n/p)) of degree [Ks : Q] = s,
where s is an even divisor of p — 1, but 2s is not.
Denote by 6X, 0 < 6X < g — 1 the #-ary digits of 1/p,
1
x=0
As g is a primitive root modulo p, the sequence 61,62,..- is periodic with least
period p — 1. For a divisor s|p — 1 and j = 0,1,... , s — 1, write
The relation between Tj(p, s,g) and h (p, s) is given by a result from [435, Theo-
Theorem 1]. Let s be even and p = s + 1 (mod 2s). Then
A2.10)
where r = 5/2, and
Put
=max_i
p, ifp = s +
I, otherwise.
1
r(p,s,g) = -
1
1/2
In [629], results about the distribution of residues of exponential functions modulo
p are used to derive the following bounds.
Theorem 12.10. A) T(p,s,g) < minjp1/2, p5/8s~3/8:
B) r(p,s,5)<sp1/2«r1/2

12.3. CYCLOTOMIC FIELDS AND GAUSSIAN PERIODS 203
Since Tj(p,s,g) =—Tj+n(p,s,g), j = 1... , r, A2,10) implies that
Substituting the second estimate of Theorem 12,10 into this inequality gives
Similar questions are studied in [436] for arbitrary integers rather than for primes.
For example, expansions of 1/m and mth cyclotomic fields are dealt with for m ? N.
A relation between another classical question of algebraic number theory —
that of Gaussian periods — and residues of exponential functions has been found
by Myerson [896], [897]. Let p denote a prime again. For a divisor t of p — 1,
denote by Gt the subgroup of sth powers of Fp«, where s = (p — l)/t, so \Gt\ =?= t.
Let R(t,p, a) denote the number of representations a = go -\ f- gs~\ of a ? Fp as
a sum of elements go,... ,gs-i chosen from each coset of Gt, that is, the number
of solutions of the equation
s-l
a = ^Tgj+XjS, o<xly---<t-i,
j=o - ¦ ¦
where g is a primitive root of Fp. Myerson studies this function in the papers [896],
[897]; it turns out that it has many relations to a number of quite different deep
problems in number theory, It is shown in these "papers that R(t.p,a) takes only
two different values: R(t,p,0), and the same value for all non-zero a ? FP. Thus
R(t,p,0) + (p - l)R(t,p, 1) = ts. Also, there is the non-trivial relation
s-l
where
t-i
j=0,... ,3-1,
x=0
are Gaussian periods, [896], [897]. It is knowu that rjj, j = 0 , s — 1, are
conjugate algebraic integers. Therefore, it is enough to concentrate on the norm
7o). It is more convenient to work with
To emphasize the link to cyclotomic fields, notice that it can also be written in the
form
AT/+ n\ I 1\T , T1 , ,,„ , ovnMT,-/»,\|l/s
i^yu.p) — | 1>Q(t7o)|Q-J-Q(expB7ri/p)|QG7o)) c-\r\^n<>/P)|
In [896], Myerson proposes the following approach to estimating N(t,p). The
geometric mean-arithmetic mean inequality implies that
1/2
N{t,P)< (
and the last sum is equal to p — t. Indeed,
s p—1
2 S
P~ltl
t-1
exp {2madxs/p)
x=0
S
p-1
{pt-ti)=p-t

204 12. FINITE FIELDS AN"D ALGEBRAIC NUMBER FIELDS
(this is a version of E.8) with n = 1). Hence,
A2.11) N{t,p)<t1'2.
A very interesting asymptotic formula is conjectured in [896]. We present it for
the case of prime t: for composite t some technical adjustments are needed. Let
F(xi,... ,xt-i) = yjexpB7ria;j) + exp I —2th
2=1 V 2=1 /
The conjecture is that if t is a fixed prime number, then
A2.12) logiV(*,p)~ / ... / log|F(x1,...,xt_i)|dxi...dxt_1.
Jo Jo
There are natural reasons for suspecting this might be true. Put g = ¦ds; since
g*~l = -\-g- ... gl~2 (mod p),
Also,
A2.13)
A2.14) " = MQ F(a/p,ag/p,... M~2Iv)
\a=l /
It follows from [897, Theorem 12] that, for t prime, the sequence of points
(a/p,ag/p,... ,agt~2/p), a = l,...p-l,
is uniformly distributed modulo 1 in the (t — l)-dimensional unit cube. So, for any
continuous function /,
p~l t-2 ^ r1 r1
.. ,ag jp) ~ / • • • / f(xii ¦ ¦ ¦ >xt-\) da?i •..dxt—\
Jo Jo
1
and the error term can be estimated (if the considerations of that theorem are
put in the quantitative form A2.16) and one uses the Erdos-Turan inequality for
discrepancy, see [647]). Unfortunately the function log |F| is not continuous. This is
the main obstacle to proving A2.12). Nevertheless, in [897], this is proved for t = 3
(that is, s = (p — l)/3). In this case the set of singular points of log |F(xi,X2)| is
finite, while for t > 5 it is not. This problem is analogous to the difficulties involved
in proving convergence results for Mahler measure (see [140], [687]).
It is shown in [629] that in any case, the integral in A2.12) can be used as an
upper bound for logN(t,p). That is, for any prime t
lim sup log N(t,p) < / ... / log|F(xi,... ,xt_i)|dxi ...dxt_i.
p—»oo Jo Jo
The cases t = 2 and t = 4 are simpler: NB,p) = ND,p) = 1. An improvement
of A2.11) is given in [629].
Theorem 12.11. N(t,p) < (t-S/4I/2.

12.4. QUESTIONS OF KODAMA AND ROBINSON 205
Although for large t, Theorem 12.11 is not much stronger than A2.11), for
small t it produces better estimates. Nevertheless, it shows that A2.11) can be
improved. For example, NC,p) < 1.5, which is better than the 1.732 ... provided
by the estimate A2.11), but of course is worse than the precise value 1.381...
given by A2.12). For t = 5, NE,p) < 2.061... while the bound A2.11) gives
NE,p) < 2.236....
It is observed in [629] that the integral (and its modification for composite t)
on the right-hand side of A2.12) really gives an asymptotic upper bound for N(t,p).
This integral has been estimated for large t, giving
,• ,- N(t>P) / f e~l/2, if Us odd;
lira sup lim sup—-—-<< . 1/2 /2
t^oo p-,00 t1/2 \ 2 l'2e T/f-, .if t is even
where 7 is the Euler constant. Of course e~7/2 < 0.75 and 2~1/2e~7/2 < 0.53.
On the other hand, at the moment we do not know any approach to prov-
proving A2.12) iii full generality. We do not even know any non-trivial lower bounds
for N(t,p).
The original question about the number of representations can be asked for
subgroups of the unit group modulo an integer M, and of the multiplicative group
of a finite field. Although there is a real difference between the basic case of
prime finite fields and these two, similar results can be obtained here as well. In
particular, to estimate N(t,pr), the analogue of N(t,p) over Fpr-, exponential sum
with Tfj>r/fp(a/d:i+xs) (that is, with linear recurrence sequences of order r) are
needed. In particular, E.8) in full generality is needed.
So far only the constant term of the minimal polynomial
= fl U - Y, )
(the Gaussian period polynomial of type (t,s)) has been considered. The other
coefficients are just as important. The behaviour of the coefficients of period poly-
polynomials and other related problems — their irreducible factors, for example — are
dealt with in the paper of Gupta and Zagier [490] and in a series of papers of
Gurak; see [493] and [494] for his recent results and references to earlier papers.
Analogous questions are also considered with respect to an arbitrary finite field
?q, where a crucial role is played by the quantity Tn(t,q), which is the number of
solutions of the equation (considered over the ground prime field Fp C Fq)
Tf,|fp(^Xi) + • • • + TF,|FpG?aiB») = 0, 0 < xu ... , xn < t - 1,
where -d is a primitive root of ?q. As usual Tn(t,q) can be expressed and studied
via exponential sums with linear recurrence sequences.
12.4. Questions of Kodama and Robinson
This section begins with a question attributed to Kodama by Niederreiter [927].
Let I denote an odd prime, and denote by T(i) the largest t for which there exists
some integer g with gcd(#, ?) = 1, of period t modulo ?, and such that for some a,
gcd(a,^) = 1, and all the smallest positive residues of agx (mod ?), x = 1,... ,t,
belong to the interval [1, {? - l)/2].

206 12. FINITE FIELDS AND ALGEBRAIC NUMBER FIELDS
The problem is related to a question considered in [1338], [1339] (and several
other papers) on super-singular hyperelliptic curves over Fp of the form
y2 = xe + A, A € F;.
It follows from [1339, Lem. 2] that if this curve is not super-singular and
then the period p modulo ? does not exceed T(?). This was the primary motivation
for the problem. Another reason is that this problem can be viewed as a discrete
version of Mahler's still unsolved 3/2-problem, considered in Section 8.3.
The first upper bound of T(?) of the form
is stated in [927]. Moreover, [1339, Theorem 1] essentially claims that T{?) is
odd. In [1198], [1202], the bound T{?) < 100/3/7 is obtained. Finally, it is shown
in [629] that E.5) implies a better estimate.
Theorem 12.12. T{?) -c^1/3.
Using Theorem 12.12, it may be shown (see [629], [1202]) that, for a given ?,
the density 6(?) of primes p for which the corresponding curve is not super-singular
over Fp is quite small,
ft(?\ = D(fi~2/3+e)
In fact 6(?) = O (T(?)?~1+e), so the bound for T{?) from [927] implies a non-trivial
upper bound for 5{?) as well.
On the other hand, for the following dual question it cannot imply anything
because an estimate below the square-root bound for T(?)' is needed. Given a
prime p and integer L < 2p + 1, let Np(L) denote the number of primes ? < L
which correspond to non-super-singular curves. Then
w « ^
log(Llogp)
In particular, the curve y2 = xe + A, A € F* is super-singular over ?p for almost all
prime numbers ? of the segment [1, L] with
L > log3 p log log p. -
This follows from the fact that NP(L) = o(tt(L)) for such values of L.
The question of lower bounds for T{?) is also important. Nakahara [902] shows
that T(?) > 3 infinitely often. Moreover, he proposes a construction showing that
T(?) > r whenever ? is a prime of the form ? = (ar — I) I {a — 1) for an integer a > 2
and odd r > 1, thus T(?) > log^ for such ?. Of course it has not been proved that
there are infinitely many primes of this form. Nonetheless, it is shown in [629] that
A2.15) limsupT(^)/log^> l
rr/2)
This follows from known results about the distribution of prime numbers in arith-
arithmetic progressions, and the following statement.
Theorem 12.13. Let r denote a sufficiently large prime. Then, for all but
ODrrlogr)
primes ? = 1 (mod r), T{?) > r.

12.4. QUESTIONS OF KODAMA AND ROBINSON 207
It is also shown in [629] that selecting ? slightly greater (of the order r2r+o^)
eliminates the set of exceptional primes.
Theorem 12.14. Let r > 7 and ? be prime numbers such that ? = 1 (mod r)
and ? > B00000r + 2)r~M2r-3)/2. Then T{?) > r.
Both results are based on the following observation. Let g be of period r modulo
?, where r is prime. Then solutions of the congruence
mo 4- m\g 4- 1- mr-.2gr~2 = 0 (mod ?)
cannot be too small in the following sense:
A2.16) max \mk\ > r-B-3)/2(r-l)^l/(r-l)_
k=0....r-2 ' ~
Indeed, the resultant R of the polynomials
F(X) =mo + miX -\ + mr_2Ir
and
is divisible by ?. Therefore, since r is prime, G is irreducible over Z so R ^ 0, and
therefore \R\ > (:. On the other hand, by the Hadamard inequality,
\R\ < ( max \mk\)
~ \k02
and A2.16) follows.
If ? — 1 = 2qiq2, where qi,q2 > 100/3/8 are primes (or if ? — 1 = 2q, where
q is prime, which is widely believed to be true for infinitely many prime ?), then
T{?) = 1. Unfortunately, at the moment one cannot hope to prove that either
of these representations holds infinitely often. The best results of [521] give the
representation I = 2qiq2 + 1 with q\,q2 > ta for some a > 1/4 (one can take
a = 0.276...; see the proof of [521, Lem. 1]). Nevertheless, it is shown in [629]
that this weaker result together with Theorems 5.8 and 12.12 produces the following
result.
Theorem 12.15. liminf T{?) = 1.
i—»oo
Certainly, Theorems 12.13 and 12.14 lead to a non-trivial lower bound for T(?)
for almost all primes L On the other hand, Theorem 5.8 readily produces an upper
bound. More precisely, it can be shown that for any function xjj{?) —> 0 and any
e > 0,
log*(') ? < T{?) < ?e
for almost all primes L It is possible that these bounds can be tightened to
\ogAl~e? <T(l) <\ogA2+e?,
for almost all primes i, with some absolute constants Ao > Ai > 0. It is also
possible that .4i = A2 = 1 will suffice. Moreover, it is also quite possible that
T{1) < log1+? ?
for all primes ?. The bound A2.15) shows that this would be the best possible
result.
Another question about fitting the values of a single exponential function on
an interval is raised by Robinson [1085]. Let p be an odd prime, and let m > 1

208 12. FINITE FIELDS AND ALGEBRAIC NUMBER FIELDS
denote a divisor of p — 1. For each mth power residue a modulo p. define HmiP(a)
to be the largest absolute value of all m solutions of the congruence
xm = a (modp), -(p- l)/2 < x < (p - l)/2.
Clearly, HmtP(a) can take at most (p — l)/m distinct values (as there are (p —
l)/m distinct rath power residues modulo p), which can be enumerated in the
non-decreasing order
Mx[m,p) < ¦ ¦ ¦ < M(p_1)/m(m,p).
Finding lower bounds for M\(m,p) is in some sense dual to the problem considered
above concerning T(?). First notice that the estimates
A2.17) mj/2 < Mj(m,p) < (p+l)/2- (p - jm - l)/2m
follow from elementary counting arguments (as there are exactly m different val-
values x, \x\ < Mj(m,p) corresponding to each Mj(m,p), 2M,-(m,p) > mj; similar
considerations imply the upper" bound too).
Robinson [1085], among many other interesting results, shows that
A2.18) Mi(m,p) < 2".Mpi-Vv(«»)
where v*(m) is the number of distinct odd prime divisors of m. Powell [1048]
obtains the better bound
A2.19) M1(m,p)<minip1-1/m,
[" e\m, 3<
Clearly
TT ( ^ )
so A2.19) is of the same order as A2.18) with respect to p, but improves it dramat-
dramatically with respect to the factor depending on m. For m with special arithmetic
structure, better bounds are obtained. For example, for m = 2S3*,
Mxim^p) < 2 x 3-Vy-iMm).
Powell [1048] also proves a lower bound of the same order (at least for fixed or
small m). Roughly speaking, this can be written in the form
M1(m,p)>mmlp/m,if(mI/2m
-1
\ i\m, 3<e
Clearly,
VimI/2™-1 Y[ ^-U > Bm)-V2 J]
e\m, 3<i€? e\m, 3<^
Several other lower bounds for Mi(m,p) are presented in [629]. These are ob-
obtained using a quite different method, and are mainly useful for larger values of m.
Powell [1048] studies the problem of when Mi(m,p) is about of its expected order
pi-<p(m)^ whiie the authors of [629] concentrate on the case when Mi(m,p) reaches
its trivial upper bound (p— l)/2. The method of [1048] uses geometry of numbers,
while results of [629] are based on bounds for exponential sums. For m of order
logp, both approaches give vety similar results.

12.4. QUESTIONS OF KODAMA AND ROBINSON 209
Another result of [629] gives a lower bound for Mj(m,p) for any j.
Theorem 12.16. For all j = 1,... ,(p- l)/m,
Mj(m,p) > (p -
Notice that A2.17) implies that Mj(m,p) ~ (p - l)/2 if j ~ (p - l)/m, while
Theorem 12.15 does the same for jfm2^ —> oo. For Mi(m,p) several more bounds
are available.
Theorem 12.17. M^m^) > (p - l)/2 + O (min {m~5/V/4, m~3/V/8})-
In particular,
Mi(m,p) > (p - l)/4 if m > 1728p3/8, and
Mj(m,p) ~ (p - l)/2 if mp~3/8 -> oo
for j = 1,... , (p — l)/m. A slightly weaker estimate, which holds for m of much
lower order, follows from [627, Lem. 6].
Theorem 12.18. For m > logp(Loglogp)~1+e,
The bound of Theorem 12.18 is very precise as it follows from A2.19) that for
any S > 0 the bound Mi(m,p) ^> p/(hgp)s implies that m -C logp(loglogp)"-1.
On the other hand, knowledge about values of m for which Mi(m,p) is of the order
p is poor.
Denote by /x(p) the smallest /x such that Mi(m,p) > (p — l)/4 if m > /x, p = 1
(mod m). The bound A2.19) and Theorem 12.17 imply that
limsup/x(p)/logp > 0 and limsup n(p)/p3^B < oo,
p—»oo., , - p—»c»
respectively. A tighter bound for /x(p) would be of much interest.

CHAPTER 13
Pseudo-Random Number Generators
Linear and non-linear recurrence sequences may be used to generate pseudo-
pseudorandom numbers, and in this chapter the effectiveness of this approach is discussed.
Applications to cryptography are described, relating randomness to Kolmogorov
complexity.
13.1. Uniformly Distributed Pseudo-Random Numbers
The most direct way to get pseudo-random numbers 71,72 • • • • from linear
recurrence sequences is the following. Let M > 1 denote an integer, and let a
denote a linear recurrence sequence taking values in the residue ring modulo M,
identified as usual with the set {0,1,... , M - 1}. Finally, use elements of the
sequence a as A/-ary digits of some other sequence. This can be done in several
ways; the most popular are to fix some integer m > 1 and to define yx to be
m-l , .v
A3-1) Yl Mi ' x€N'
i=0
or
a(x + 0
2 = 0
or
m-l
?
Ml '
i-0
for integers h\,... ,hm. Elements of the first sequence look more independent, so
that construction is more common (without any particular theoretical justification,
it must be admitted). The integer M is called the modulus of the pseudo-random
number generator.
In order to use these numbers as pseudo-random numbers, which should as a
minimal requirement be uniformly distributed on the unit interval, information on
their period and their distribution on [0,1] (more generally, about the distribution
of the vectors G^ , 7x+s-i) m the s-dimensional unit cube) is needed. That is,
estimates are needed on their discrepancy. These questions have been addressed
in Chapter 3 and Section 7.2, respectively. Indeed, many of those results can be
directly applied to such pseudo-random number generators, although for m > 1
some adjustments are needed. On the other hand, there are some new aspects to
the problem of pseudo-random numbers generators. Previously the interest was in
general results which hold for all sequences from some wide class. As a result, these
estimates are not very strong. For pseudo-random numbers it would be enough to
prove stronger results for special sequences. Alternatively, it is sometimes useful to
211

212 13. PSEUDO-RANDOM NUMBER GENERATORS
show that for 'almost all' members of some class of sequences (rather than for all)
some refinements can be obtained. Both kind of results will be discussed below.
Typically, the modulus M is chosen as a prime power pk with a special emphasis
on the case M = 2k (because of the connection with computing). The two extreme
cases of M a large prime and M = 2 are of great interest as well, and deserve
special treatment.
For the parameter m, a reasonable choice is m = 1, so 7X = a(x)/M. This
generator is the T&usworthe generator; it has the important advantage that all
the results about periods of (see Chapter 3) and distribution for (see Section 7.2)
linear recurrence sequences may be applied without any of the adjustments needed
for A3.1) with m > 2.
In any case, m should usually not exceed the order of a, in order to have some
hope of independent digits of 7X (at least independent in the weakest sense of not
being obviously dependent). Clearly, if t is the period of a, then the period of the"
sequence 7 given by A3.1) is at least r = t/gcd(m,t).
In a series of papers by Niederreiter the discrepancy of such sequences has been
estimated. His results are given below in a simplified form which can be extracted
from [930, Theorem 3.1, 3.2]. More explicit information about the constants may
be found in [930].
Theorem 13.1. Let M = p denote a prime, and let a denote a linear recurrence
sequence of order n and period t over Fp with characteristic polynomial irreducible
over Fp. If gcd(m.t) = 1 and sm < n, then for any 1 < iV < t, the s-dimensional
discrepancy of the sequence G^,... , 7X+S_i). x = 1,... , N is
U2/nrmpthgp + sp-m, forN = t,
|B/7r)smspn/2*~1log?log> + Sp-m, for I < N <t,
¦™, forN = t,
-s2~m, forl<N<t,
ifp = 2.
The general case of gcd(?, m) > 1 can be considered as well (with slightly worse
constants). Notice that if a is an M-sequence (that is, with period t = pn — 1) and
ms > n, then DS(N) = O(tl/2+eN~l), where the implied constant depends on n
only.
Several more results about the discrepancy of such sequences can be found
in [677].
The case of sm > n (that is the case of manifestly dependent digits) is more
complicated. It turns out that the discrepancy depends not only on the period, but
also on the number
s-l
rs(f,rn,p) = min ]T deg/^,
2 = 0
where the minimum is taken over all non-zero polynomial solutions of the congru-
congruence
s-l
Y deghi(X)Xim = 0 (mod f(X))
2 = 0

13.1. UNIFORMLY DISTRIBUTED PSEUDO-RANDOM NUMBERS 213
in polynomials ho,... hs-i over Fv. These numbers are called figures of merit of
/. Clearly rs(f,m,p) < n + 1, and it is known that the bigger rs(f.rn.p) is, the
smaller is the discrepancy DStTn(N). In fact, rs(f,m,p) appears in lower and upper
bounds for DS(N) as the term p-r»(f.m,p) ^^ p-r.(f,m,P) logs t respectively (th0
exact results may be found in [930, Sect. 4, 7] and [936, Chap. 9]).
It is also known that both requirements, a large period and a large figure of
merit, can be attained simultaneously. This result may be found in [930, Theo-
Theorem 5.4].
Theorem 13.2. For any positive integers n, m, s, t such that n is the period
of t modulo p, there exists an irreducible polynomial f over ?p of degree n and of
period t such that
- i){m+ i-m
To understand this result better, consider the case t = pn — 1. Then there
exists a primitive period / with
rs(f,m,p) > n-logpl6gnlogp-slogp(m + 1) 4- O(lj.
so choosing m = n gives a sequence having discrepancy DS(N) = 0(jt1/2+eiV~1)
for any fixed s.
As mentioned in Section 9.2, the problem is related to continued fraction ex-
expansions of rational fractions.
All the above estimates of discrepancy need the period to be large enough
to be non-trivial; it should certainly exceed pn/2, and the length N of sequence
considered should be at least of the same size. This second requirement is very
difficult to meet. Certainly if M = pk is a power of a fixed prime number, in — 1,
s — m then G.8) gives the bound 0(t^ -+c) for the full period discrepancy of
a(x)/pk. It is possible that a similar result can be obtained for any ms < n, but
for incomplete periods the corresponding result has not been worked out yet, and
one cannot expect particularly strong estimates here.
The situation is quite different if one agrees to consider 'almost all" sequences
from ?(/), rather then all of them. The following assertion is obtained in [1187] for
m = 1 (that is, for the sequence ~yx = a{x)/p). Levin [710] extends it to arbitrary
m < n.
Theorem 13.3. Let f denote an irreducible polynomial modulo p of period t.
Then for all but o(pn) sequences a ? ?(/) the following holds. For any 1 < N < t
the s-dimensional discrepancy of the sequence ~/x given by A3.1) is
where s < n/m and gcd(m, t) = 1.
The upshot is that the bound holds for all N for all sequences from the same
set of 'good' sequences. For every fixed N such a result is quite simply obtained.
In [710] (but not in [1187]) the result is formulated for primitive polynomials only,
but certainly holds in the form given above.
Ambrosimov [28] obtains results for sequences in residue rings modulo 2k.
These concern the distribution of tuples
(a(x),... ,a(x + s- 1))

214 13. PSEUDO-RANDOM NUMBER GENERATORS
(that is. the question discussed in Section 7.2) rather than the discrepancy of the
points
.Nevertheless, they are in the same spirit, and in particular provide good estimates
which hold for almost all initial values, and certainly could be useful for analysis of
pseudo-random number generators from linear recurrence sequences (see also [661]).
Apparently, these are the simplest in a series of results which can be obtained using
similar methods.
In [326], [327], [329], [679] more general non-linear pseudo-random number
generators are analyzed 'on average'.
Niederreiter, in [936, Sect. 10.1] and in more detail in [939], proposes a mul-
multidimensional matrix generalization of the pseudo-random number generators just
considered. That is, sequences of vectors satisfying linear recurrence equations
with matrix coefficients. He analyzes their periods, discrepancy, and other useful
properties. This work has been continued by Larcher [677].
Returning to the particular case of pseudo-random number generators discussed
above, the most popular, theoretically attractive and practically convenient are
the linear cohgruencial generators, also known as the Lehmer generators. Such a
generator is a sequence 7X = a(x)/M, where
A3.2) ¦ a(x) =.Xa{x - 1) + 77 (mod M), 0 < a{x) < M, xe N.
Here the initial value a@) = a and the multiplier X are integers co-prime to the
modulus M, and 77 is an arbitrary integer. These generators, and discussions of
their features and applications, can be met everywhere from mathematics books
through to computer science sources, to programming manuals; [936], [619], [584].
respectively, are representatives of the literature.
As discussed in Section 1.1, the parameter 77 in A3.2) is a little arbitrary. For
M = 2k, this parameter allows sequences of maximal period 2k to be constructed
(period 2k~2 is maximal for sequences with 77 = 0). From now on only the homo-
homogeneous linear congruencial generator
A3.3) a(x) = Xa(x~l) (mod M), 0 < a(x) < M, x € N,
will be considered. Thus a(x) = aXx, and
_ aX^
Generally speaking, the s-dimensional discrepancy DS(N) of G^,... ,7X+S_i) de-
depends on several characteristics. The first is the maximal value of the exponential
sums
JV
max
gcd(m,.A/) = l
which does not depend on s but does depend on all the other parameters. The
second depends on s, X and M, but does not depend on the initial value and the
length N of the interval considered:
Ps{X, M) = min (mo ... ms-i)>
where the minimum is taken over all non-trivial solutions of the congruence
A3.4) mo + miX-\ hms_1As~1 = 0 (mod M),

13.1. UNIFORMLY DISTRIBUTED PSEUDO-RANDOM NUMBERS 215
and m = max{l, \m\}. If M = p is a prime, then
. s n . s
A3.5) Da(N) <C——— max VexpB7rim7x) -I -; -;
N gcd(ra,p) = l *~J ps(X,p)
x—1
for other values of M some simple adjustments are necessary.
All these classical facts can be found in [925]; the bound A3.5) is a combination
of Theorem 13.3 and the bound [930, Eqn. E.11)].
There is also one more characteristic which is denned analogously to ps(X, A/),
ljs{X,M) = mm(ml + ¦ ¦ ¦ + m2^I'2,
where the minimum is taken over the same set of non-trivial solutions of A3.4).
This parameter is responsible for the lattice structure of points (-yx,... ,jx+s_i),
see [619, Sect. 3.3.4].
By employing standard techniques for the exponential sums in A3.5), a good
bound — close to the square-root — can be found for almost all initial values.
Moreover, in Section 5.4, it is shown that for many special moduli M and a wide
range of N, individual bounds are available.
The parameter ps(X,M) is less well understood. The simplest case is as usual
M = p prime. For such moduli, one can prove that there is a primitive root modulo
M, X (needed to provide the large period) such that
A3.6) ps(A,p) ^ P
In fact such an inequality holds for almost all A. The fact that almost all A are of
larger period modulo p gives the following statement (cf. [1194], [710]).
Theorem 13.4. Let p denote a prime and s > 1 an integer. Then for all but
o(p2) pairs (a, A), 1 < a, A < p—1 of initial values and multipliers, the s-dimensional
discrepancy of the sequence A3.1) is DS(N) = O(N~1^2pe).
From the computational point of view it would be very desirable to find a
similar result for arbitrary A/, especially for M = 2k and other prime powers (in
addition to the computational simplifications, in this case typically there are better
bounds for exponential sums, as shown in Section 5.4). Unfortunately, the proof
uses a bound on the number of solutions of polynomial congruences of degree n with
coefficients co-prime to M which can be as large as Ml~lln for highly composite
M: The simplest example is Xn = 0 (mod 2k) or (A - 1)" = 0 (mod 2k). As a
result, for arbitrary M all that can be said is that for almost all A,
A3.7) ps(X,M)>Mll{s-l)-s, s>2,
which is much worse than A3.6) for s > 3. In [629] an 'on-average' estimate
M
is found (notice that l/ps(A,A/) rather than ps(A,A/) appears in A3.5)). This
method, leading to the bound A3.6), which is almost as good as possible for M = p,
cannot produce anything better than A3.7) for arbitrary M. Of course, a weak
average bound does not preclude the possibility of there being a good multiplier for

216 13. PSEUDO-RANDOM NUMBER GENERATORS
such moduli, so it still makes sense to show that A3.7) can be refined for some A,
and even to try to describe such A.
The case s = 2 has been studied independently by many authors (in the differ-
different context of Korobov's optimal coefficients [634], [925], [936]). Notice that for
s = 2 A3.6) and A3.7) are not much different. The most convenient tool in this
case is the formula (9.9). In the Fibonacci case, (9.10) applies, but there is still
an open question about the period of f(h) modulo f(h + 1). Modulo an arbitrary
fixed M, a desirable choice for A has X/M ~ E1/2 - l)/2 = [1,1,1,...]. This is
quite a naive approach, and does not guarantee that all the partial quotients of
X/M will be small. Nevertheless, in practical computations this has been success-
successfully used, and this procedure is presented in many standard numerical analysis
recipes. See also [3] for explicit expressions for the 2-dimensional discrepancy of
linear congruencial generators.
For s = 3, Larcher and Niederreiter [678] prove that for M = pk, a power of a
fixed prime number, there is a A which is a primitive root modulo pk if p > 3 and
A = 5 (mod 8) if p = 2 (thus of period 2k~2 modulo 2k) with the property that
log M
The proof is based on a detailed study of the structure of solutions of quadratic
congruences. Although it is possible that the method can be extended to higher
dimensions, the technical complications will increase with each step, and it is not
clear how to carry ..out this approach for arbitrary s.
The following completely explicit construction of [1189] gives an estimate
weaker than A3.6) but stronger than A3.7); however it works for any M. If A
is defined by the congruence-At = d (mod M), where 1 < $ < r < M are arbi-
- trary integers with gcd(i9r, M) = 1 and $ ~ r ~ Ml^s+l\ then
A3.8) - ' ps(X,M) > min{tfr, Mt~s+v) ~ M2/(s+1). ..
If in the previous construction one takes $ ~ r ~ (M/2s)l*s then
ws(A, M) > min{(tf2 + t2I'2, s-^2Mt~s+1} ~ 2l'2{2s)-l/2aMl/a.
This bound is tight, as for any A of the same order (at least for s fixed) both
meet the upper bound ujs(X, M) < 7(s)M1/s. where 7(s) is the Hermite constant
(see [619, Sect. 3.3.4], [256]).
Similar problems arise in cryptography.., Let WSE,M) denote the size of the
set of A, 1 < A < M. with ws(X, M) < Ms. For s = 3, the bound
is given in [415]. For the special case of M = pk a further improvement to A3.8)
is possible. The following result is taken from [629].
Theorem 13.5. Let p denote a fixed prime and let ¦#, 1 < d < p2 denote a
primitive root modulo p2 ifp> 3, and $ = 3 if p = 2. Set
A^+^ + l)-1 (mod/),
where t — 2 [k/Bs + 1)J. Then, for sufficiently large M = pk,
and the period X modulo M is at least Af/4.

13.1. UNIFORMLY DISTRIBUTED PSEUDO-RANDOM NUMBERS 217
The proof is ad hoc in that it exploits several coincidences rather than general
principles.
Dynamical systems arising from, and motivated by, linear congruencial gen-
generators are studied in [39], [1305]. Marsaglia [778] uses 'add-with-carry' and
'subtract-with-borrow' sequences, discussed in Chapter 3, as pseudo-random num-
number generators of a new type. As shown in Chapter 3, their period structure is
reasonably well understood. Couture and L'Ecuyer [266] show how to combine
such generators with a linear congruencial generator and prove several geometric
results about the distribution of such combinations. The work of Tezuka [1276]
goes in the same direction, but with respect to combining several generators from
linear recurrence sequences. Roughly speaking, instead of the standard addition of
several such sequences a,i(x) + • • ¦ + am(x) (which is a linear recurrence sequence
again by Chapter 4) he uses bit-wise addition XOR without carry. That is, the
sequence
ai(x)XOR... XORam(i)
is studied, Further developments and applications to cryptography can be found
in [617], where p-adic analysis is used; see also [46] ,""[456], '[457], [458]," [618],
[1362] and [938, Sect. 2.2] for additional references.
'Multiplication-with-carry' sequences are also studied in the literature as useful
sources of pseudo-random numbers [266].
Non-linear recurrence sequences are also successfully used as pseudo-random
number generators. In Chapter 3 periods of quadratic C.7) and inversive C.8)
sequences are studied. Bounds for the discrepancy of pseudo-random number gen-
generators arising from such sequences (and more general sequences of types C.6)
and A3.11)) have been obtained by Eichenaurer-Herrmann, Emmerich. Niederre-
iter, Tezuka and others [324], [325], [328], [330], [344], [345], [580], [935], [936],
[938], [1260], [1277].
For example, the 2-dimensional discrepancy of the inversive generator C.8)
modulo a power of a fixed prime is O(i~1^2log2 t) over the complete period, but
increases at least to i/3 in the 3-dimensional case, see [324]. On the other hand,
generators modulo a square-free M have discrepancy of order M~ll2+e in any
dimension [325], [935].
The 2-dimensional discrepancy of a quadratic generator can be estimated as
well. Moreover,, if M = pk where k is of order pll2\og~l p then, over the com-
complete period, the discrepancy is O{t~ll2\ogt), which is \ogt better than the usual
estimate for similar sequences [330].
The papers mentioned above deal with the distribution of sequences over the
full period, and their methods cannot be used to study the distribution over parts
of the period. A new approach, and the first non-trivial results on the distribution
over parts of the period are given in [942], [945]. Several more applications of this
method are given in [478], [497], [944]. In particular, Theorems 7.7 and 7.8 are
proved. This method hag also been applied in [414] (together with some other new
ideas) to studying the power generator, see Section 13.2.
For non-linear generators arising from the congruence C.6) modulo a prime
M = p, a kind of lattice test can be denned. The corresponding sequence of
pseudo-random number numbers 7X = a{x)/p passes the s-dimensional lattice test
if the vectors
(a(x),... ,a(x + s- 1)). xeN

218 13. PSEUDO-RANDOM NUMBER GENERATORS
span the vector space Fp. As seen in Chapter 3, for several non-linear generators
the maximal period t = p can be guaranteed. Such a generator can be considered
as a map Fp —> Fp, so there is a unique polynomial G € FP[X] with degree
D = degG < p such that a(x) = G(x), x = 1,... ,p (G must be a permutation
polynomial over Fp. that is polynomial inducing a bijection). The parameter D is
an important characteristic of the sequence, see [935, Sect. 3] or [936, Sect. 8.1].
In particular, the sequence passes the s-dimensional lattice test for all s < D. A
lower bound on D is given in [942], which immediately yields the following result.
Theorem 13.6. Letp denote a prime. Then a non-linear generator of maximal
period t = p, given by C.6), with a polynomial F G FP(X) of degree d > 2, and
M = p, passes the s-dimensional lattice test for all s < \p/d\.
It is also known [237], [392] that an inversive generator C.8) (of maximal
period) passes the s-dimensional lattice test for all s < (p + l)/2. A close look at
Theorem 13.6 shows that this test is not very dependable. It seems plausible that
there are sequences which can only be represented by a polynomial of high degree
and which nonetheless have bad distribution properties. Such sequences do indeed
exist; see a discussion in [935, Sect. 3].
Motivated by applications to pseudo-random number generators, Anashin [30]
describes polynomials for which the sequences satisfying the congruence C.6) with
M = pk a prime power are uniformly distributed modulo pk (that is, they generate
a one-to-one mapping in the residue ring Z/phZ). Uniform distribution in the ring
of p-adic integers Zp is also considered.
So far the continuous aspect of the problem, dealing with numbers distributed
in [0,1], has been considered. The discrete aspect of the problem relates to binary
sequences, also known as sequences of pseudo-random bits. For an infinite sequence
EX) of ff-ary digits, 0 < 5X < g—1 and a finite <?-ary string S = (di... dk), denote by
F(S, N) the number of occurrences of this string in the initial segment of length N.
and by f(S,N) = F(S,N)/N the corresponding frequencies. The sequence EX) is
called a pseudo-random sequence of <?-ary digits if for any string 5, f(S. N) —> <?~'s'
as N —» oo, where |S| is the length of 5. As shown in Section 8.1, such sequences
correspond to g-ary expansions of numbers normal to base g, and such ff-ary se-
sequences are also known as normal sequences of signs. Postnikov [1045], [1046]
provides a good outline of early approaches to such sequences and their applica-
applications. He also discusses various generalizations of this notion of normality such
as Bernoulli normal sequences, Markov normal sequences and normal continued
fractions. A construction of a Markov normal sequence with a very small discrep-
discrepancy (appropriately defined) is due to Levin [712]. Such discrete pseudo-random
sequences (finite or infinite) are of great importance in theoretical computer sci-
science [1263]. They may also be used to rule out random walks on lattices, and
Postnikov [1044] notices that this leads to an algorithm for solving finite-difference
equations arising from the Dirichlet problem in the theory-of partial differential
equations.
There is, however, one minor logical irritation here. Theorem 8.5 says that
there are numbers which are normal to some base g but are not normal to some
other base /. If such g-ary sequences are identified with the corresponding number
oc
tf = Y5hg-h

13.1. UNIFORMLY DISTRIBUTED PSEUDO-RANDOM NUMBERS 219
which they represent, then the property of being pseudo-random is therefore not
invariant under change of base. On the other hand, it seems reasonable that being
pseudo-random should be an intrinsic property of fl. This question is discussed by
Calude and Jiivgensen [196], who show how to change the definition of pseudo-
pseudorandom sequence (random in their terminology) in order to make it invariant to
basis change. A dynamical overview of randomness for <?-ary sequences may be
found in [1340].
Certainly, the smaller the difference \f(S, N) — <?~'5' can be made, the better;
this size is related to the discrepancy of (ldgx). This relation is not very direct,
and the sequences having the best bounds for the frequencies do not necessarily
correspond to values of d with the best value of the discrepancy. Indeed, [1185]
gives a construction of a sequence with
for any finite string 5. The result of Levin [713] yields a slight improvement of this
asymptotic formula. On the other hand,,the long standing record of Korobov [635]
and Levin [706] giving explicit constructions of ¦# such that the discrepancy of (i9gx)
is O(iV~2/3+e), has recently been bettered: Levin [714] gives a construction which
leads to the b'ound OiN'1 log2 N).
Frequencies f(S, N) can also be considered for finite sequences, and here the
theory of linear recurrence sequences is of great use. For example, if g = q is a prime
power, Theorems 7.1 and 7.2 are nothing but bounds for f(N,S); see also [661],
[926].
Levin [712] also give a construction of a Markov normal number.
A different point of view on pseudo-random bits obtained from linear recurrence
sequences and their applications is pursued in [26]. Results of these papers are also
used later in [258] to study the statistical properties of shrinking two i\/-sequences
over F2, when the sequences a and s are selected at random from the sets of M-
sequences of orders n and m. The results of Section 7.1 can be used to obtain
some individual estimates as well. It is shown in [258] that if both a and s are
M-sequences over F2, and the characteristic polynomial of a is chosen with uniform
probability among all the tpBn — l)/n primitive polynomials of degree n over F2,
then the shrunken sequence (as(x)) has good statistical properties.
Another important question concerns the output rate of (as(x)), or equivalently
the upper bound for hx, the position of the xth 1 in s (see Chapter 4). It is shown
in [258] that if the characteristic polynomial of the selector sequence s is chosen
with uniform probability among all the ipBm - l)/n primitive polynomials of degree
m over F2, then hx = O(x). A very natural question is whether it is possible in these
two statement to get individual estimates (rather than estimates which hold with
high probability). An encouraging remark in this direction is that Theorem 14.8
below implies that hx = O(x) for any x > 2em. This and several similar results
about the output rate and the distribution of the shrinking generator from two
linear recurrence sequences are presented in [1205]. All these properties make such
sequences very attractive for applications. Moreover, D.1) shows the shrunken
sequence is of exponential linear complexity (see Section 13.2 for the definition),
which is especially important for applications in cryptography.
Finally, one of the closest relatives of pseudo-random numbers are so-called
quasi-random numbers or points. The main difference is: Instead of seeking for
1-dimensional sequences G^) for which the s-tuples G^,... , 7Z+S_i) admit a good

220 13. PSEUDO-RANDOM NUMBER GENERATORS
bound for the s-dimensional discrepancy, construct sequences of s-dimensional
points G1,x, ¦ ¦ ¦ . 7s,x) which are uniformly distributed (with respect to the discrep-
discrepancy and other criteria) in the s-dimensional unit cube. One of the most celebrated
applications of such points is the Monte Carlo Method, see [925], [936], [1277].
Some 30 years ago, Sobol [1226] found a construction of a family of quasi-
random points which he called I/IIT-nets; these still give the best known order for
the s-dimensional discrepancy, Da(N) <C A*" logs N. The construction is based
on properties of sequences of maximal period over F2. To construct such a net in
s-dimensional space, fix s — 1 distinct M-sequences over F2 of orders ni,... ,ns_1;
say (distinct means that they correspond to distinct primitive polynomials over
F2). The constant in the bound for the discrepancy as well as many other useful
features of these sequences depend on the parameter
A3.9) r = ni + --- + ns_i - s + 1;
the smaller r is, the better the sequence is. For. the minimal values rs of those r
"of the form A3.9), the explicit expression F.17) and the asymptotic formula F.18)
follow from the fact that there are ipBn — l)/n primitive polynomials of degree n
over F2. The I/IIT-nets of Sobol influenced much further research, and in particular
it appears that their analogues and generalizations with respect to ilf-sequences
over other fields produce better constants in the estimate of the discrepancy [935].
[936]. Moreover, the classical LTlT-nets have not lost their value as among many
other advantages they are directly related to binary representation of numbers —
the native language of modern computers.
It might seem that building a good pseudo-random number generator is just
a matter of mixing up several functions in an unexpected way. Unfortunately
this wide-spread belief has no real theoretical background: Knuth's example [619.
Algorithm K. Sect. 3.1] of an a priori exotic generator with very poor randomness
is instructive, and in some sense representative.
13.2. Pseudo-Random Number Generators in Cryptography
The previous section dealt with pseudo-random numbers from the point of view
of uniform distribution. Another view of pseudo-random numbers is related to Kol-
mogorov's complexity-theoretic approach to random numbers. Roughly speaking, if
7 is a sequence exhibiting almost random behaviour, then the next term 7X should
be hard to guess from knowledge of the previous ones 71,... , 7x-i without knowing
the algorithm that produces them. Constructing sequences that are unpredictable
in this sense is an important part of modern cryptography.
The predictability problem is the following. Assume that some segment
7/i)-¦¦ .7/H-fc-i
of the sequence 7 is known, as is some partial information about the nature of the
sequence (that is, the general, shape of formulae for the sequence, and some of the
parameters involved are known). The problem is to predict the sequence forward
(that is, to generate ih+k,lh+k+i, ¦ ¦ ¦) and backward (to recover jh-x,Jh-2, ¦.. )¦
These two aspects are closely related but for certain sequences can be problems
with essentially different complexities.
General approaches to this problem are beyond the scope of these notes; a
good introduction to the area is [666]. Instead, the predictability of the most
common pseudo-random number generators related to recurrence sequences will be

13.2. PSEUDO-RANDOM NUMBER GENERATORS IN CRYPTOGRAPHY 221
discussed. The majority of results obtained concern linear recurrence sequences,
and in particular sequences generated by a linear congruencial generator. Several
non-linear generators have been studied as well. Slightly changing the terminology
of [666] we obtain the following list of sequences.
A) The power generator
a(x + l) = a(x)k (mod M), 0 < a{x) < M - 1,
where k is some fixed integer.
B) The exponential generator
a(x +1) = ga{x) (mod M), 0 < a(x) < M - 1,
where g is some fixed integer.
C) The 1/M-generator, the sequence (dx) of g-ary digits of A/M (with some
integer 1 < A < M) in some fixed base g,
An important special case of the power generator is the Blum, Blum and Shub
generator, a(x + 1) = a(xJ (mod M) introduced in [127] and studied by several
other authors, see [155], [271], [407], [414], [406], [480] [666], [833], [1207] and
references therein.
Hallgren [508] has proposed using the elliptic curve analogue of the homoge-
homogeneous linear congruencial generator A3.3). This and similar generators have also
been studied in [337], [445], [448]. In particular, using the bound for exponen-
exponential sums from [623], El Mahassni and Shparlinski obtained an upper bound on the
one-dimensional discrepancy of such generators. The same method can probably be
used to estimate the discrepancy in any fixed small dimension s, say for s = 2, 3,4,
but it is not clear how to extend it to a general result which would apply to any
dimension. Many other natural questions about these constructions still remain
open, and they definitely deserve more attention. For example, it would be inter-
interesting to study the linear complexity of such generators (in some special cases this
is done in [445]).
We now describe the construction of a pseudo-random function given by Naor
and Reingold [905]. Let p denote a prime, and let ? denote a prime divisor of p — 1.
Select an element g e F* of multiplicative order ?. Then for each n-dimensional
vector a = {a1,... ,an) E (Z/?Z)n one can define the function
A3.10) U(x) = ga*1-<" e?p,
where x = x\ ... xn is the bit representation of an integer x,0<x<2n-l, with
some extra leading zeros if necessary. Naor and Reingold [905] have shown that
this function has some very desirable security property, provided certain standard
cryptographic assumptions hold. The results of [65], [479], [1204], [1208], [1210]
demonstrate that for almost all vectors a G (Z/?Z)n the function A3.10), as well as
its natural generalization to elliptic curves, poses very good linear complexity and
uniformity of distribution properties.
Several other generators are proposed in [666], including cellular automata
considered in Section 14.1 (see also [1358] and several other papers from [1359]).
Knowledge of M and k for the power generator, or of M and g for the exponen-
exponential generator, makes the forward prediction trivial. However, knowledge only of a

222 13. PSEUDO-RANDOM NUMBER GENERATORS
segment of the sequence, or trying to compute earlier values, involves computation-
computationally hard problems: Discrete root extraction and the discrete logarithm problems,
respectively. If gcd (fc, </?(M)) = 1 and g is a primitive root modulo p, then both
problems have unique solution but are computationally difficult (for a survey of
the current state of the art see [1202]). If M = p is a prime, or any other number
with known Euler function </?(M), then the backward computation for the power
generator can be done via the formula
a(x) = a(x + l)e (mod M),
where ? is denned from the congruence kl = 1 (mod </?(M)). In general nothing
better is known than to reduce the problem to computing <p(M), and thence to
the integer factorization of M. Thus if M = pip2 is a product of two large primes
then the problem is hard; such M are called Rabin primes after the person who
first understood their importance for cryptography. That this problem is difficult
of course provides the security of the celebrated RSA-cryptosystem [621]. In fact,
this idea cannot be used without due care and attention: For example, Wiener
[1342] shows that if M = p\Pi with pi ~ p2 ~ M1/2, and k has
kl2 <@.25-e)M3/2,
then the RSA scheme can be broken in polynomial time via continued fractions.
For a simple description of this see [1027]. In particular, this problem arises if
k < <p(M) < M and ? < (| - e)MJ/4. The most straightforward way to avoid the
problem is to choose k > M3^2; only the residue k modulo f{M) is important, and
this can be given by an artificially large value if desired.
Turning to the forward prediction problem, recall that the classical Berlekamp-
Massey algorithm to decode linear cyclic codes [85], [767], [767] efficiently solves
this problem if the field of definition is known. To find the characteristic polynomial
of a linear recurrence sequence a of order n, the algorithm takes 2n consecutive
terms and outputs the characteristic polynomial in O(n2) field operations. The
basic algorithm is a version of the continued fraction algorithm. A more efficient
version is given by Blahut [122]; this uses only O(n\og1+? n) field operations (see
the survey [796] and the recent papers [27], [117], [390], [391], [968], [969], [970],
[984] for details).
This leaves the case where the definition domain is not known: The observer
sees integers forming a linear recurrence sequence over some unknown residue ring.
Boyar [138] gives general results about the predictability of linear and non-linear
recurrence sequences. The model is as follows: To predict the sequence a from
several initial values, we are allowed to guess each value and if we make a mistake
the correct value, is revealed. The fewer mistakes made, the less secure is the
sequence.
The following results are obtained in [138]. Assume that a satisfies a linear
non-homogeneous recurrent congruence
a(x + n) = fn-\a{x + n - 1) -\ \- f-^a{x + 1) + foa(x) + e (mod M)
of order n, but neither the modulus M nor the coefficients e, /o, /i,... , /n_i are
known. It is important to remember that the objective is to predict the sequence
rather than to find its parameters. In particular, the parameters are not uniquely
denned by the sequence, as the following example shows: The two sequences
1{x) (mod 6), a2(x + 2) = 4a2(x + l) + a2(x) (mod 6)

13.2. PSEUDO-RANDOM NUMBER GENERATORS IN CRYPTOGRAPHY 223
with the initial values a\(l) = 02A) = 0, ai(l) = 02A) = 2, are identical. <Boyar
proves that there is a prediction procedure of polynomial complexity (n log M)°^
which makes at most
2n + 3 + log n + ^n log n + n log M
mistakes. Several related results have been obtained by Joux and Stern [565].
Clearly one cannot guarantee to do this with less than n — 1 mistakes.
For the quadratic generator
a{x + 1) = f2a(xJ + fia(x) + /o (mod M)
a similar result is obtained, with the number of mistakes at most 10 + 3 log M (see
the comment after [138, Theorem 11]).
Lagarias and Reeds [669] and, later, Krawczyk [641] combine these two results
in a general statement about the predictability of non-linear recurrence sequences
(including vector-valued sequences). The methods of [669] work for fc-dimensional
vector-polynomial sequences A(x + l) = F (A(x)) over a commutative ring 1Z where
A(x) G lZk, and the map F : TZk —> 1Zk is given by k polynomials in k variables.
This method relies on Hilbert's Basis Theorem and is therefore not computationally
effective. If 1Z is the residue ring modulo M, and all polynomials involved are of
total degree d. then the total number of mistakes is estimated as
1 + if(d, k) + ±N log N + dN log M,
where
N=i+ik+k
The function >p(d, k) is generally speaking not explicit, but for two important cases
it is known: <p(l, k) = k + 1 and ip(d, 1) = d+ 1. These two cases subsume the cases
considered by Boyar [138].
For the polynomial recurrence equation
A3.11)
a{x + n) = F(a{x + n-l),... ,a{x)) (mod M), 0 < a(x) < M - 1, x e N
in which neither the polynomial F G Z[X\,..., Xn] nor the modulus M are known
the following effective result holds [641].
Theorem 13.7. Each polynomial recurrence sequence is predictable in polyno-
polynomial time, with the number of mistakes at most O {k2 log(kMd)), where d is the
degree and k is the number of monomials in the polynomial F.
Clearly k < (nJd)> but many generators are based on sparse polynomials for
which k may be significantly smaller [641]. For vector-valued sequences similar
results have also been proved.
Blum, Blum and Shub [127] introduce and study the \/M generator. Let g > 2
denote a fixed integer, and M a positive integer that can be written with at most
L g-avy digits (that is, M < gL). They show that given k = 2L + 3 consecutive
digits dh+i,... , dh+k the denominator M (and hence the numerator) can be found
in polynomial time L°^K Indeed, the fraction
a = 0.(dh+1)... ,dh+k)g
is an approximation to the fractional part {Agh/M} with error at most
g~k < 1/2A/2.

224 13. PSEUDO-RANDOM NUMBER GENERATORS
So, ultimately, {Agh/M} is one of the convergents of the continued fraction ex-
expansion of a, and thus can be found effectively. On the other hand, it is observed
in [127] that, under Artin's conjecture, k = L — 1 digits are not enough to determine
M unambiguously.
In [629], similar results are shown for smaller segments of digits without reliance
on any standard conjectures. The first statement claims that a string of k =
[3I//37J consecutive digits provides no information about M. Roughly speaking,
we see without any unproven conjectures that M may take almost any value among
all the primes p < gL.
Theorem 13.8. Given any string of k = [3L/37J consecutive g-digits, there
are at least A + o(l))ir(gL) prime numbers p < gL such that the g-adic expansion
of 1/p contains that string.
Further, using results of [636], [637] -it-is shown that for an arbitrary e > 0,
any string of k < (l — e)L consecutive digits appears in the g-adic expansion of 1/M
for at least C(g)gsL^2 values of M < gL. Here C(g) is some constant depending on
9 only.
Theorem 13.9. There is a constant c(g) > 0, depending only on g, such that
for every element M of the set
'Wl = {M = pal± : 1 < n < Q, fa, g) = 1},
where
Q = [c(ML/2\,
p is the smallest odd prime number with gcd(p,g) = 1, and pa is the largest power
of p that is less than gL/Q, and any string of k = [(I — e)L\ consecutive g-digits,
the g-adic expansion of 1/M contains the string.
To make prediction harder several tricks can be used. One of them is to use
two or more generators in parallel (with different initial values, or even of differ-
different types) and to mix their results. For example, a power generator ap and an
exponential generator ae can be combined to form a(x) = ap(x) + ae(x) (mod M).
The shrinkage operation described in Chapter 4 can be also be used. There do not
seem to be significant results about the predictability of such combined sequences.
The only exception is the bound D.1) for the linear complexity of shrinking two
M-sequences. Another way to increase the security of a sequence is to use parts of
the elements. For example, given integers h, s, instead of a sequence a, consider
the truncation
aht9(x) = [2~ha(x)\ (mod 2s), 0 < aM(z) < 2s - 1.
Thus, ah,s is formed by the s bits of a(x) starting from the (/i+l)th lowest significant
bit. For several common pseudo-random generators, an extensive detailed study of
this and similar truncation procedures has been made in the papers [137], [415],
[666], [669] (and references therein). Some of these results follow. For integers
s,k > 1 denote by Bk,s(a@),X,M) the binary sfc-dimensional vector obtained by
adjoining s leading bits of the k first elements of the sequence a produced by the
homogeneous linear congruencial generator A3.3) with the initial value a@) (for
general generators A3.2) similar results can be obtained). All elements of the
sequence having L = [logM] bits are considered, so BfciS(a@), A, M) is obtained
from the bits of I a(j)/2L~s I, j = 0,... , k - 1. It is shown in [415, Theorem 3.1],

13.2. PSEUDO-RANDOM NUMBER GENERATORS IN CRYPTOGRAPHY 225
that for any k > 1, e > 0 and sufficiently large square-free M > c(k,e), there is an
exceptional set E(M, k,s) of multipliers A of cardinality
\E{M,k,e)\ <Ml~e
such that for any multiplier not in E(M, k, e) the following is true: If
s = f(i/fc + e) logM + fc(l/2 + log 3) + 3.5 log fc + 2 - log 3],
then the initial value of the sequence a can be uniquely determined in polyno-
polynomial time from knowledge of the multiplier A, the modulus M and. the vector
Bfc,a(a@),A,M).
It is also remarked in that paper that an exceptional set E(M, k, e) is necessary,
as A = 1 is always a bad multiplier. Also, by Dirichlet's principle, if
s<
then there is an initial value a$ such that ?fc)S(a@), A, M) = Bjt,s(ao, A, M) for at
least M? initial values of a@) = 0,... , M — 1. Such an initial value is secure in
the following sense: Knowledge of BktS(a@), A, M) is not enough to determine the
entire sequence.
In the opposite direction, it is shown in [629] that for infinitely many primes
M = p,
s = —-— logp - log logp + 0A)
and all but at most pl~? multipliers A, and any initial value a@) = 0,... ,p — 1,
the problem is secure: That is the knowledge of A, M and Bk,s(a@),X,M) for
such k and s is not enough to determine the initial value uniquely (regardless of
the complexity of the algorithm) and moreover, the number of candidates for the
initial value is exponentially large.
Theorem 13.10. Let p denote an L-bit prime with 2L - 23L/4 < p < 2L.
Then for any k > 5, e > 0 there is an exceptional set F(p,k,e) of multipliers A
of cardinality \F(p,k,e)\ < pl~e, such that for any multiplier A ^ F(p,k,e) the
following is true. If
s < —;—L - log L - c,
k
where c is an absolute constant, then for any binary sk-dimensional vector B there
exist at least ps initial values of a@) = 0,... p — 1 such that ?fc,s(a@), X,p) = B.
In the results above, only the initial value is unknown. Boyar [137] shows
that even if the multiplier A and the modulus M are unknown and only the
t < Clog log M lowest bits are available, then the sequence can be predicted in
polynomial time with at most B + log M) log4C M + 3 errors (provided that each
wrong prediction is corrected).
The results of [641], [669] are applicable to such truncated sequences as well
(see also [666]).
Finally, Kuzmin and Nechaev [662], [663] show that any linear recurrence
sequence a of order n over TLjpkTL can be recovered from its last coordinate a,k-i(x)
given by C.5) in time O(npk). (Unfortunately it is not clear in these papers exactly
what 'recovered' means — perhaps that the characteristic polynomials and initial
values can be found).

226 13. PSEUDO-RANDOM NUMBER GENERATORS
There are other approaches to predictability of sequences. For brevity, only
linear methods of prediction will be considered. This leads to the notion of linear
complexity and the linear complexity profile of a sequence. For a finite or infinite
sequence a of elements over a ring 1Z the linear complexity profile ?a is defined as
follows: Ca(h) is the least n such that a(l),... , a(h) form the first h terms of some
linear recurrence sequence of order n over 1Z. If 1Z = ? is a field, then this function
is well-defined and satisfies the inequalities
?a(h)<mm{h, Ca(h+1)}
(put Ca(h) = 0 for identically zero sequence). Also define the linear complexity
?* = limsup?a(h).
h—»oo
Clearly, ?* < oo if and only if the sequence a is a linear recurrence sequence beyond
some point. It is also clear that Ca(h) < ?* < n if a is a linear recurrence sequence
of order n (in particular, for a periodic sequence of period t, Ca(h) < ?* < t).
'¦'-¦ As mentioned above, the Berlekamp-Massey algorithm computes Ca(h) in
O(h2) field operations, and the Blahut algorithm improves this to O(hlog1+? n)
field operations.
Linear complexity is a widely accepted measure of randomness and unpre-
unpredictability of sequences, and has many applications to cryptography [272], [610],
[796], [929], [932], [933], [937], [934], [1027], [1095]. Many results giving bounds
for, and algorithms to compute, the linear complexity and even the linear complex-
complexity profile of various sequences (de Bruijn sequences, sequences generated by finite
automata, random sequences and others). In addition to the sources quoted above,
the papers [117], [118], [119], [120], [121], [220], [221], [222], [296], [420], [439],
[442], [443], [535], [536], [549], [611], [612], [784], [794], [950], [952], [953],
[966], [984], [1293] discuss this.
A surprising result is obtained in [1361], showing that algebraic curves could
be a source of sequences with very good linear complexity profile properties.
Many of the results of Chapter 4 can be considered as results on the linear com-
complexity of sums, products, convolution, shrinking, self-shrinking and other functions
of linear recurrence sequences, and several of them are obtained in that context.
Thus the works [120], [258], [275], [276], [277], [459], [531], [652], [653], [654],
[655], [656], [663], [680], [806], [1098], [1379] are relevant to this subject as well.
For example, it is shown in [806] that a self-shrunken M-sequence of order n has
linear complexity at least 2Ln/2-l.
The following interesting construction, combining linear recurrence sequences
with a knapsack-like construction, has been proposed by Massey and Rueppel [1097]
and studied in [1095, 1096], and [813]. Let a be a linear recurrence sequence of
order n over F2. For an integer modulus ra > 1 and an n-dimensional vector
z = (z\,... ,zn) G TLPm of weights, consider the following subset sum generator of
pseudo-random numbers:
n
) = ^P a(x + j - 1)zj (mod m), 0 < uz(x) < m - 1, x = 1, 2,...
of elements of Zm. For cryptographic applications, it is advisable to use a linear
recurrence sequence of maximal period r = 2n — 1 and the modulus m = 2n.
Relatively little is known about this sequence, although some results about its

13.2. PSEUDO-RANDOM NUMBER GENERATORS IN CRYPTOGRAPHY 227
multidimensional distribution (for general r and m) have recently been established
in [255].
The linear complexity of various non-linear generators, including power, inver-
sive and Naor-Reingold generators, has been estimated in [65], [479], [480], [498],
[805], [833], [957], [1207], [1210].
In the series of papers [220], [221], [222], [610], [611], [612] (and references
therein) the following construction is considered. Let p denote any mapping from
?q to F2 (whose elements are as usual called bits). Notice that ?q may or may not
be an extension of F2; odd q are of equal or even greater interest. For example, if
q = p is prime, and p(a) is the last bit of the least positive residue of its argument
a, then this is related to the truncation operation considered above. For a sequence
a taking values in ?q, the sequence of bits b with b{x) — p(a{x)) is an important
example. Sometimes it is convenient to view p as a function from ?q to {0, 1} C ?q;
examples here include polynomials. This is particularly convenient when q is even,
so ?q is an algebraic extension of F2 (recall that over a finite field any function
can be represented by a polynomial). If a is a linear recurrence sequence then
Theorems 4.1 and 4.2 apply. Certainly this construction is too complex to handle
in such generality but, for some specializations, it produces very interesting and
useful sequences. For example, the authors of [220], [221], [610], [611], [612]
concentrate on the case when a is an M-sequence.
For odd q, the following result appears in [610]. For an M-sequence a of order
n over ?q, define the subsequence aT(x) = a(rx) where r = (qn — l)/(q — 1) is its
restricted period (see Chapter 3 for the definition). Put bT(x) = p(atau(x)). Since
both b and bT are periodic,
A3.12)' CI<tCIt.
so it is of exponential linear complexity. If the mapping p is chosen so that C*} —
q — 1 (for small q this should not be difficult), then L\ attains its maximal possible
value qn — 1, which is the period of the sequence b.
Klapper [610] notices that since b and bT are 0,1-sequences they can be thought
of over any other finite field ?(. This potentially gives different linear complexity,
however the formula A3.12) holds for any field of characteristic different from the
characteristic of ?q, q — pr. He shows that over Fp the maximal value of the linear
complexity is essentially smaller, being at most
n + p
n
-For fixed p, this is of polynomial order nOA) rather than of exponential order as
over other fields.
The question about finding q from values of the bit sequence b is also considered
in [610], where some probabilistic algorithms are presented.
Statistical properties of Ca(h) for a random sequence a of elements of ?q are
summarized by Niederreiter [932], In particular, denote by Nh(L) the number of
different /i-term sequences a over ?q with Ca(h) = L. Then
for h > L > 0. This formula can be used to show that Ca(h) = h/2 + O(logh) for
an infinite uniformly distributed random sequence over ?q. More precisely, for such

228 13. PSEUDO-RANDOM NUMBER GENERATORS
a sequence
limsup
log h 2 log q
with probability 1, see [932], [937].
As seen above, for a random sequence Ca(h) is about h/2. A natural question is
how to construct a pseudo-random sequence having similar behaviour of the linear
complexity profile. The construction of such sequences uses the theory of continued
fractions in the field F<7((X~1)) of formal Laurent series over ?q. For a sequence a,
write
h=l
Let [Ci(X),C-2(X),...] denote the continued fraction expansion of A(X) in which
the partial quotients Cj(X), j — 1,2,..., are polynomials over ?q with positive
degree. Then the following remarkable statement holds [929], [937].
Theorem 13.11. Put dj =degCj. Then
3=0
where m is uniquely defined by the inequalities
ro —1 m
2 /L di + dm - h - 2 /L di +
3=0 j=0
If all the dj — 1 then the sequence a has a perfect linear complexity profile,
namely Ca(h) = [(h + 1)/2J. The reverse is also true: In particular, the sequence
fl, iix = 2k-l;
a(x) = <
10, otherwise;
corresponding to the continued fraction [x, x,... ] over F2 has perfect linear com-
complexity profile. On the other hand, the bit distribution of this sequence is very
poor, which shows some of the weaknesses of this measure of randomness for se-
sequences. Further discussion of the density of unit bits in such sequences can be
found in [853], [1364].
Niederreiter [934] demonstrates that a finite sequence of positive integers
Li,... ,Lh
can be realized as the initial segment of the linear complexity profile of some se-
sequence a over F^ if and only if the following conditions are satisfied: If Lk > fc/2
then Lfc+i = Lk , and if Lk < fc/2 then Lk+i = Lk or Lk+i = fc + 1 — Lk, k =
0,1,... , h — 1. Moreover, there are exactly qminiLh,h-Lh} SUqj[1 h-element sequences.
It is striking that this number depends on Lh only. The jump complexity profile of
a sequence a is defined as follows: Ja(h) is the number of positive integers among
the list ?a(l),?aB) —?a(l),... ,Ca(h)-Ca(h-l). Some combinatorial and statis-
statistical properties of linear complexity and jump complexity profiles were considered
in [212], [348]. [544], [1327] for the binary case and in [934] for sequences over

13.2. PSEUDO-RANDOM NUMBER GENERATORS IN CRYPTOGRAPHY 229
arbitrary finite fields. For example, it is shown in [934] that
N(L
\ ifj>min{L,/i-L
where Nh(L,r) is the number of different /i-term sequences a over ?q such that
Ca(h) = L and Ja(h) = j (trivially, ^@,0) = 1 and Nh(L,0) = 0 if L > 1).
The mean value and variance of Ja(h) for an infinite uniformly distributed random
sequence over ?q are evaluated in [934] as well. One of the results obtained asserts
that
limsup(/ilog/i)-1/2| Ja(h) -{q- l)h/2q\ < B/qI/2
h—»oo
with probability 1. For random binary sequences a the expected value E(Ja(h))
and the variance of V(Ja(/i)) of Ja(h) are explicitly evaluated by Wang [1327]. For
instance,
E(J (h)) = W4 + V3 " 2-h/3 if h is even;
1 a[ )] |V4 + 5/12-2-V3 if/?-is odd.
In [1203] a lower bound of order Hp~1/2 log p is obtained for the linear
complexity of a sequence of H consecutive values of the discrete logarithm modulo ¦
p modulo any divisor d of p— 1. Several other similar results can be found in [674],
[804].
The case d = 2 is of interest because it corresponds to the sequence of values
of the rightmost bit of the discrete logarithm, which determines whether a; is a
quadratic residue modulo p. In this case, the linear complexity of the infinite
sequence (which is periodic with period p) has been evaluated in [302]:
'(p-l)/2, ifp = l (mod 8),
p, if p = 3 (mod 8),
P~%-1, ifp = 5 (mod 8),
> + l)/2, Up = 7 (mod 8).
This result has been generalized in [300], see also [272], [297], [298], [299].
As mentioned above, many properties of the linear complexity can be expressed
in terms of properties of continued fractions related to the sequence. Links between
linear complexity profiles of sequences over F^ and g-adic expansions of real numbers
of the interval [0,1] have been discovered in [951]. Fix a bijection
Then each infinite sequence 5 over ?q can be mapped to the point
Now let d : N -> R be any non-negative function. If \Ln(s) - n/2\ < d(n) for all
n = 1, 2,... then the sequence s has d-almost perfect linear complexity profile. The
case of constant d has special interest.
The Hausdorff dimension D(d,q) and the Hausdorff measure M(d,q) of the
set of points corresponding to sequences with d-almost perfect linear complexity

230 13. PSEUDO-RANDOM NUMBER GENERATORS
profile is evaluated explicitly in [951]. In particular, if d(n) = d is constant then
M(d,q) = 0 and
D(d,q) = ^| —,
where #(d, q) is the largest root of the equation
d-l
dj = 0.
The case d(n) —> oo is considered as well. In this case (under some additional
natural assumptions) logq n is the threshold: The measure is zero if d(n) grows
slower than log^ n and is positive if d(n) grows faster than A + s) log^ n. On the
other hand, D(d, q) = 1 for any d(n) —» oo.
For example, the k-error linear complexity Ca(k,h), see [803], [802], [940],
[941], of a sequence a is defined as the smallest possible linear complexity ?b{h)
taken over all sequences-b which differ from a in at most k places. This is an
important characteristic of 'stability' of the linear complexity of the sequence. Ef-
Efficient algorithms to compute the fc-error linear complexity are discussed in [568],
[569]. Relations between the linear complexity and the fc-error linear complexity
have been studied in [659]; see also [570]. A very similar function is called sphere
complexity in [272]. Several results about the distribution of Ca(k, h) over the set
of all binary sequences are given in [941].

CHAPTER 14
Computer Science and Coding Theory
This chapter contains a short survey of some topics dealing with more general
classes of sequences that arise in computer science and complexity theory. Cellu-
Cellular automata, automatic sequences, and applications to cryptography and coding
theory are discussed.
14.1. Finite Automata and Power Series
Finite discrete automata are a very wide generalization of recurrence sequences.
The first case to consider is that of a classical finite rn-automata operating on finite
words formed from the alphabet Am = {0,1,... , m— 1}. Formally, an m-automaton
consists of a finite set S of states containing a distinguished initial state i. a subset
F of final states (the acceptance set) and a map
~T.:-:AmxS—*S.
Denote by Wm the set of all finite words in the alphabet Am,
oc
Wm = |J At-
h=0
From a finite word w = (ujq .. .uih-i) G Wm, form the sequence
s@) = i, s(x + 1) = t(u>x, s(x)), x = 0,... , h — 1.
Notice that if r depends on the second argument only, then it is a recurrence
sequence. A word is said to be accepted by the automaton if a(h) G F. The set of
all accepted words is called the language C generated by the automaton. If words
w of Wm and natural numbers represented in base m are identified, then there is
an associated generating power series
9c(X) =
In this definition, and to get rid of initial zeros, we always assume that r@,i) = i.
More generally, consider a function
$ : S —-> Z.
For each word w G Wm of length h, put fw = ib(s(h)) and consider the power series
fix) = f; fwx».
This power series — and the sequence (fw) — are called m-automatic. In particular,
defining -0(s) = 1 for s G F and ijj(s) = 0 otherwise gives the generating function
gc(X) °f accepted words.
231

232 14. COMPUTER SCIENCE AND CODING THEORY
As seen above, linear recurrence sequences are closely related to rational func-
functions. Similarly, m-automatic functions are related to many other interesting classes
of functions. In particular, every m-automatic power series satisfies a functional
equation of the form
A4.1)
i=0
with polynomial coefficients A0(X),... ,Am(X) G Z[X], see [11], [736], [740],
[745], [1024], [1030]. The study of various arithmetic and analytic properties of
such functions was initiated by Mahler and then continued in those papers, as well
as in [76], [105], [741], [743], [960], [1289] and many others. Several power series
from Chapter 4 arose in this very context. For example, Topfer [1289] studies
transcendence properties of solutions of such equations, which are called Mahler
m-functions after [745], proving the following.
Theorem 14.1. Let f denote a Mahler m-function which is not rational. Then:-
for any integer g > 1, f(l/g) is transcendental
In particular, the sequence of g-ary digits of an irrational algebraic number is
not m-automatic for any m.
Theorem 14.1 is a special case of the more general [745, Theorem 2]. Loxton
and van der Poorten conjecture [740] that the only analytic functions which are
Mahler mi-functions and m.2-functions for two multiplicatively independent integers
m\ and mi are rational functions. Some possible approaches to a proof of this (still
open) conjecture are discussed by Becker [76].
The papers [108] and [1042] demonstrate that the question about rationality of
a solution of a linear differential equation with polynomial coefficients is effectively
decidable. We are not aware of any similar result for functional equations of the
form A4.1), which certainly would be of interest.
The theory of m-automatic sequences becomes richer if the alphabet Am has
the structure of a finite field or a residue ring. For example, for p prime, if (fw) is
p-automatic then the subsequence (/p*) is periodic (this can be derived from the
more general Theorem 14.2 below). In the context of coefficients of power series
representing algebraic functions, this result is given in Chapter 3. However, it is
known that a power series is algebraic over ?P((X~1)) if and only if its coefficients
are generated by a finite automaton [288], [736]. There are several more relations
between automatic sequences and formal Laurent series, see [88], [89] for example.
Notice that (fw) is automatic if it is a function depending on finitely many
digits of the m-ary expansion of w\ thus it is not surprising that many sequences
related to m-ary expansions of real numbers are m-automatic. Many interesting
examples of such sequences are considered in [21], and some of these are described
below.
The m-kernel of the sequence a is the set KerajTn of all possible subsequences
of the form
Kera,m = {(a(xmr + k)) : r = 0,1... , 0 < k < rrf - 1} .
The following property is closely related to the functional equation A4.1): A se-
sequence (fw) is m-automatic if and only if its m-kernel is finite.
Generalizing the notion of m-automatic sequences, Allouche and Shallit [21]
introduced AZ, m)-regular sequences as sequences of elements from the ring 1Z (or

14.1. FINITE AUTOMATA AND POWER SERIES 233
an extension) whose m-kernel is finitely generated over TZ. They establish sev-
several relations between m-automatic and (TZ, m)-regular sequence. For example, a
(TZ, m)-regular sequence takes only finitely many different values if and only if it
is m-automatic. Thus, the sequence of residues modulo M of any (Z, m)-regular
sequence is m-automatic. On the other hand, (C, m)-regular sequences cannot grow
faster than O(x°^).
The following assertion provides a more direct link to linear recurrence se-
sequences; it follows from [21, Theorem 2.2].
Theorem 14.2. Suppose that a is a (TZ, m)-regular sequence. Then the subse-
subsequence (a(mx)) is a linear recurrence sequence of order n, where n is the dimension
of Kera.
On the other hand, if F is an algebraically closed field then a linear recurrence
sequence a is an (F, m)-regular sequence if and only if all its characteristic roots are
roots of unity - see [21, Theorem 3.3]. Several other structural results are proved
for the class of (TZ, m)-regular sequences in [21]. For example, it is closed under
pointwise sums and products (in particular, it is a ring), as well as convolution.
Finally, some interesting complexity theory properties of regular sequences are
established in [21].
14.1.1. Examples of m-automatic and (TZ, m)-regular sequences. In
this section, several examples of m-automatic and (TZ, m)-regular sequences are
given, together with the recurrence equations which they satisfy.
Many such sequences can be defined in terms of the counting function ep(x)
which equals the number of occurrences of a finite binary string (or pattern) P in
the binary representation of n. For example enG) = 2, ei(9) = 2, en(9) = 0,
e1OiB1) = 2.
Allouche and Shallit [21] provide a nice collection of 34 examples of regular
and (non-regular) sequences; some sequences are well-known, and are named after
other researchers who studied them from different angles. Some of their examples
are the following.
• For any pattern P, (ep(x)) is (Z, 2)-regular. In particular, for P = 1, it
is easy to see that e\Bx) = e\(x) and e\Bx + 1) = e\(x) + 1. Therefore,
the 2-kernel is generated by this sequence and the constant sequence A).
• (eiCx)) is (Z, 2)-regular.
• The binary length sequence B with B@) = 0 and B(x) = 1 + [log a?j if
x > 1, is (Z, 2)-regular. Indeed, it is easy to see that BBx+1) = B(x) + 1,
BDx) = 2BBx)-B(x) and B(Ax + 2) = B(x) + 2. Therefore, its 2-kernel
is generated by (B(x)), (BBx)) and the constant sequence A).
• The power sequence (xk) is (Z, 2)-regular. Its kernel is generated by the
sequences (x-7), j — 0,1,... , k.
• The van der Corput sequence V (of great importance in the theory of
uniformly distributed sequences [647]) is (Q, 2)-regular. Recall that
~1
^(x) = do2
where x = do2° + d^1 -\ \- ds2s is the binary representation of x. One
can verify that i/;Bx) = i/j(x)/2, ipBx) - A + ip(x)) /2. It is mentioned
in [21] that this sequence is related to two other (Z, 2)-regular sequences.

234 14. COMPUTER SCIENCE AND CODING THEORY
• The characteristic function X3 of the integers representable as a sum of
three squares is 2-automatic.
• The Euler binary partition sequence (see Section 9.3) b^ is not regular
(and has no chance to be since it is growing too fast for (9.18)) but the
residue sequence modulo any power of 2 is 2-automatic.
• The complexity of the MergeSort algorithm
is (Z, 2)-regular.
The sequence of primes is not (Z, m)-regular for any m. Indeed, by The-
Theorem 14.2, (pmx) would be a linear recurrence sequence over Z, so
log m = lim
would be an algebraic number, which is impossible.
The same consideration as in the last example shows that prime numbers can-,
not even be approximated in the form px = a(x) + o(xlogx) by a (Z,m)-regular
sequence.
Other examples from [21] involve sequences arising from combinatorics, number
theory, design of algorithms and other branches of mathematics. See also [11], [19],
[285] for further examples.
Many famous 0,1-sequences are of the form
a(x) = ep(x) (mod 2), a(x) = 0,1,
for various binary patterns P. Examples are the Thue-Morse sequence correspond-
corresponding to P = 1, and the Rudin-Shapiro sequence corresponding to P = 11.
Besides that, these sequences also satisfy interesting recurrence equations. For
example, the Thue-Morse sequence atm satisfies the relation
iix = 2k: ~ ¦
with the initial value aim@) = 0. Its generating function Ltm obeys the functional
equation
X - A - X2)Ltm(X) + A - X)(l - X2)Ltm(X2) = 0.
The Rudin-Shapiro sequence ars satisfies the recurrence relation
. , \ars(k), if x = 2k or x = Ak + 1;
|l-araBfc + l), ifx = 4fc + 3,
with the initial value ars@) = 1. Its generating function Lrs obeys the functional
equation
X3 + X(l - X4)Lrs(X) - A - X)(l - X4)Lrs(X2) - 2XA - X4)Lrs(X4) = 0.
A related 2-automatic sequence, the Baum-Sweet sequence dbs, cannot be obtained
in this way but satisfies a similar recurrence relation,
Ml a>bs(k), if x = 2k + 1 or x = 4k;
x) = <

14.1. FINITE AUTOMATA AND POWER SERIES 235
with the initial value a@) = 1. Its generating function Lbs obeys the- functional
equation
Lbs(X)-XLbs(X2) + Lbs(X4) = 0.
Finally, the family of paper-folding sequences comprises sequences satisfying the
recurrence relation
{ '
Thus, the initial values of such a sequence are all its elements on positions which are
powers of 2. Such a 0,1-sequence can be characterized by the following recursive
definition:
A) apf{2x+l)'=apf(l)+x (mod 2);
B) (apfBx)) is again a paper-folding sequence.
To justify the name, recall that such sequences arise if we fold a piece of paper
several times (every time folding one half over the other) and mark 'hills' with l's
and 'valley' with CFs. The sequence (apfBs)) is the sequence of folding instructions.
Various relations between paper-folding sequences and pattern sequences are
analyzed in [285], [809], [811], [856], [862]. Morton and Mourant [862] show that
the only possible patterns P for which (ep(x) (mod 2)) is a paper-folding sequence
are P = 11 (that is, the Rudin-Shapiro sequence [285], [809], [811]), P = 10, and
P = 01.
Paper-folding sequences which are 2-automatic are characterized in [856] as
paper-folding sequences with aperiodic sequence of folding instructions of the form
(apfBs)). A paper-folding sequence itself is never periodic, but is almost peri-
periodic [811].
Many of the sequences above may also be constructed as fixed points of itera-
iterations of finite substitutions. Let °d denote a substitution that acts on an alphabet
Am- That is, each letter uj of Am maps to some word $(u;) € Wm. There is an
associated class of sequences invariant under this substitution, satisfying
a(l)aB)aC) ... = ¦& (a(l)) i) (aB)) -d (
It turns out that such sequences are essentially the same things as m-automatic
sequences, see [248], [285], [400], [736], [745], [1024]. To get the binary sequences
above, sometimes the letters of such an invariant sequence should be replaced with
their binary representations. For example, the Thue-Morse sequence
01101001100101101001011001101001...
is invariant under the substitution tf @) = 01, t?(l) = 10. To get the Rudin-Shapiro
sequence, consider the sequence
02010232020131010201023231320232
which is invariant under the substitution tf@) = 02, i?(l) = 32, i?B) = 01, i?C) =
31, and then make the changes 0 —* 00, 1 —> 01, 2 —* 10, 3 -> 11.
The areas of application of such sequences include number theory, theoretical
computer science, normal numbers, pseudo-random number generation, ergodic
theory, and classical analysis. Originally the Rudin-Shapiro sequence was defined

236 14. COMPUTER SCIENCE AND CODING THEORY
as the sequence of coefficients of the trigonometric polynomial
N
Trs{N: z) = ^(-l)Or'(fc) exp{2nihz)
h=0
which is distinguished for being flat:
A4.2) sup \Tra{N;z)\<CN^2,
which is Log1' logiV better than a typical polynomial. The constant C can be
taken as C = 2 + 21/2 in A4.2). For special values z = 0 and z = 1/2 even
more is known: Trs{N;0)N-^2 and Trs{N;l/2)N-1/2 are dense in the intervals
[{3/b)^2,61/2} and [0.31/2], respectively by [159].
Boyd, Cook and Morton [150] study trigonometric polynomials corresponding
to an arbitrary pattern sequence
oo
TP{N;z) =
...
In particular, they show that for any P there is a constant rp < 1 such that
sup \TP{N',z)\<CNTp,
O?Z<1
and this bound cannot be essentially improved. This bound follows from asymptotic
expansions for such polynomials. Notice that r > 1/2, and r is transcendental for
any pattern with 3 or more digits. For example, Tm = log? = 0.823 ..., where ?
is the largest root of the equation ?3 — 2? — 2 = 0.
The Baum-Sweet sequence aj,s is the sequence of coefficients of the unique
solution of the cubic equation f + Xf + 1 = 0 in the field F2((X-1)) of formal
Laurent series over F2. This is known to be a power series all of whose partial
quotients are bounded. Thus several of the results from Section 9.2 apply to this
power series.
It is shown in [811] that if apf is a paper-folding sequence and 0 < a < 1, then
is transcendental. The coefficients of the Fourier transform of a paper-folding se-
sequence are evaluated in that paper as well.
Various interesting sums and products including the pattern counting function
ep are asymptotically estimated in [393] and precisely evaluated in [20]. The
main result of [20] says that for any pattern P of length n there is an effectively
computable rational function bp such that
h=0 ~
(if P = 0... 0 then the summation starts from h = 1). It is shown in [16] that if
P is of length k then bp can be chosen with degree O(fe11-1), and that it must be
of degree fc3 for infinitely many patterns P. Several nice explicit formulae, many of
them new, are derived from this general result.

14.1. FINITE AUTOMATA AND POWER SERIES 237
Allouche [12] deals with the counting function Na(k) which is defined as the
total number of different patterns P of length k in the infinite word a(l)aB)
Surprisingly, for any paper-folding sequence apf
N A) — 2 N B) — A N C\\ — 8
N (A) — 19 Af E) — 18 N (H) — 93
and
Napf{k)=4k, k>7.
For the Thue-Morse sequence atm, the behaviour of Natrn(k) is more complicated;
it is independently described by de Luca and Varricchio [747] and by Brlek [165]:
'6-2r~1+4s, ifO<s<2r-1,
8 • 2r~l + 2s, if 2r~l < s < 2r,
where r and s are uniquely defined by the representation
fc-l=2r + s, 0<s<2r.
Hence
lim inf iVatm (k)/k = 3, lim sup Natm (k)/k = 10/3.
Tromp and Shallit [1290] generalize this result, and obtain an explicit formula for
the counting function of the sequence of residues e\ (x) modulo an integer k (see
also [14]). Non-existence of palindromic patterns in the Thue-Morse sequence has
been shown in [23].
Pseudo-random properties of the Thue-Morse and Rudin-Shapiro sequences
have been studied in [792].
In [12], a brief summary of many other interesting features of Na(k) is given.
For example Na(k) — O(k) for any automatic sequence (see also [22], [1274]) and if
a is an automatic sequence then (under some mild restrictions) (Na(k + 1) — Na(k))
is automatic too. Allouche [13] gives a survey of results of this kind. Such results
are related to a question about the minimal size of a finite automaton which can
compute correctly given functions from Wm to some other finite alphabet
including the characteristic functions of languages [15], [1010], [1157], [1159],
[1160]". Specifically, for a function
/: Wm—+Bk,
denote by 5/(n) the smallest number of stages in any automaton which computes
/ correctly on any words of length at most n. It is shown in [1160] that, if k, m > 2
then for any such function /,
mn+2
Sf{n) < C{m, k) A + o(l)) , n —> oo,
where
C{m,k) = —2~: ¦
(m — iy\ogm
This bound is precise, because for almost all such functions
mn+1
S/(n) >C(m,fc)(l + o(l)) , n->oo.
IL

238 14. COMPUTER SCIENCE AND CODING THEORY
On the other hand, the characteristic functions \l of a special class of languages
satisfy SXL{n) > (n + 3)/2, and this bound is best possible.
The case m = 1 is exceptional, but can be dealt with as well. Pomerance,
Robson and Shallit [1010] prove that for any function / : W\ —> Bk the inequality
Sf{n) < n + 1 — [logfc n\ holds for infinitely many n, while for almost all functions
Sf{n) > n + 1 — 2 logfc n — 2 logfc logfc n for all sufficiently large n. Once again,the
case of characteristic functions of languages is special and is considered separately.
More precise estimates for some interesting functions, mainly number-theoretic
in nature, are given in [1157].
Following [697] a real number a is called (m, g)-automatic if the sequence of its
g-ary digits is m-automatic; denote by L(m,g) the set of all such numbers. Lehr,
Shallit and Tromp [697] show that L(m,g) is a vector space of infinite dimension
over Q. Moreover, for m = 2 they exhibit a constructive proof which runs as follows.
Consider the power series
h=0
and put a = f(l/g). By Theorem 14.1, a is transcendental over Q. Using ingenious
arguments they show that each power ar is B, g) automatic (apparently a similar
result holds for any m as well). The proof of this is based on the following estimate,
which is of independent interest. Denote by F(n, r) the coefficient of Xn in the rth
power f(X)r. Then, for any n,
FM <
2rr!
(for the proof of the main result, it is enough to know that F(n,r) is bounded by
a constant depending on r only).
On the other hand, the authors of [697] demonstrate that L(m,g) is not closed
under products, nor under inversion.
Links between linear recurrence sequences, automata and numeration systems
are given in [416], [417], [468], [1137], [1156], [1158], [1279]. For example,
Shallit [1156] introduces the notion of a regular numeration system and shows
that all such system are generated by linear recurrence sequences.
Various operations (taking the diagonal, Hadamard products, specialization
and lifting, for instance) on power series which preserve the property of being auto-
automatic are considered in [736]; see also [288], [734], [735]. Multivariate power series
are of interest as well: These questions are related to the still open Grothendieck
conjecture, which asserts that if a linear homogeneous differential equation of order
n
i=0
with coefficients from Q[X] has, for almost all primes p, n independent solutions in
FP[[X]], then all its solutions are algebraic [95], [1058]. Bezivin [105] considers an
analogue of this conjecture for functional equations of the shape A4.1).
Other useful features (some of them unique to these sequences), generalizations
and applications of automatic and related sequences can be found in the papers
quoted above, and in [17], [284].
Finally, consider the special family of cellular automata. Roughly speaking,
such an automaton is a line (finite or infinite) of cells, each cell containing an element

14.1. FINITE AUTOMATA AND POWER SERIES 239
from seme finite alphabet Am = {0,1,... , m — 1}. At each discrete moment of time
t, the state a(t, h) of the cell with coordinate h depends on the state of itself and of
its several neighbours (say with coordinates h — s,... , h + s) at several preceding
moments of time (say at moments of time t — n,... ,t — 1). More formally, for all
t e N, and h € Z,
a(t,h) = F(a(t- 1,/i-s),... ,a{t- 1,/i + s),
A4.3) ... ,a{t - n,h - s),... ,a(t - n,h + s)),
for some function F on Am, and fixed integers n and s. The sequence (finite or
infinite) (a@, /i)),..., (a(n — 1, /i)) is called the initial configuration. The function
F is called the transition rule. For the case of a finite set of cells, for cells at
both ends (with 0 < h < s — 1 and N — s < h < N — 1) some special boundary-
rule should be given. One approach is to compute coordinates in the residue ring
modulo N (that is, assume that the automaton is of circular shape). This removes
the boundary cells.
In many settings only the case n = 1 is considered. A good introduction to
the general theory of such automata, as well as many more advanced topics, can be
found in the collection [1359]. As usual, the theory is much richer if the alphabet
Am has some special algebraic structure. Define the generating function
4=1
Two pieces of this sum are particularly important. The time generating function is
defined .by
= Ta(t,h)Xh.
For each position h the vertical generating function is defined by
4=1
We see from A4.3) that cellular automata are essentially 2-diniensional recurrence
sequences, but here we concentrate on more direct relations between cellular au-
automata and linear recurrence sequences. To exhibit such relations, consider the
class of linear cellular automata, those are cellular automata whose transition rule
is a linear function (provided that the alphabet is a finite ring).
It is shown in [780] that for any linear cellular automata over a ring 71 there
.are rational functions Fq(X),... ,Fn-i(X) € Tl{X) such that (At{X)) satisfies a
recurrence equation of the form
teN,
for an infinite set of cells, or a recurrent congruence
A4.4)
At+n(X) = Fn^(X)At+n^(X) + --- + F0(X)An(X) (mod M(X)). t € N,
for a finite set of cells, where the modulus polynomial M(X) € TZ[X] depends on
the boundary rule (in particular M(X) = XN - 1 for the periodic boundary rule).
For instance, the transition rule
a{t+l,h) = fia{t, h-l) + foa{t,h) + fia{t, h + 1), a{t, h) € ?q

240 14. COMPUTER SCIENCE AND CODING THEORY
can be found in almost every paper devoted to linear cellular automata. For this
sequence, the recurrence equation is
where F(X) = f\X + /o + f-\X~l (or an analogous congruence modulo some
polynomial M(X) € Fg[X] for the case of a finite set of cells). Thus, known results
about linear recurrence sequences over function fields can be applied to linear cel-
cellular automata. Such applications are the main motivation of the paper [1041] on
linear recurrence sequences over function fields. Other methods which are tradi-
traditionally used for linear recurrence sequences over algebraic number fields or finite
fields can be applied as well. We describe several examples of questions which are
not worked out yet but no doubt can be successfully attacked.
Finite automata and linear cellular automata are essentially different and
should not be confused. Generally they generate distinct classes of sequences which
nevertheless have non-trivial intersection [24], [25].
In Chapter 3 the question of periods of solutions of A4.4) over ?q was discussed.
Multidimensional linear cellular automata are of interest as well. In this case,
instead of A4.4) a recurrent congruence arises modulo an ideal in the ring of multi-
variate polynomials over Fg, and the theory becomes even more complicated. In
particular cases, periods of such automata are studied in [780] and later in [557],
[558].
In Section 7.1 (and below in Section 14.3 in the more specific setting of cyclic lin-
linear codes) a question about the distribution of values of linear recurrence sequences
is considered. Many of these results seem to extend to linear cellular automata.
In Section 14.2 we consider the Orbit Problem for linear recurrence sequences
which is of great interest for finite automata too, and is known there under an-
another name as the Reachability Problem. One can also study predictability and
unpredictability of such automata in the spirit of Section 13.2. The techniques
used for linear recurrence sequences can be applied (after some adjustments and
modifications) to linear cellular automata as well.
Polynomial time prediction and the Reachability Problem for linear cellular
automata are considered by Clementi and Impagliazzo [245] from the point of view
of complexity class theory. It is shown that the Reachability problem for linear
cellular automata is not NP-complete unless some very plausible complexity class
classification collapses. Studying reversible and irreversible cellular automata [316],
[854], [1311] can be thought of as a modification of this question.
For a cellular automaton, given an initial configuration 7, denote by Lt (I) the
'length' of its alive cells at the time t; that is Lt = Mt — mt + 1 where Mt and mt
are the maximal and minimal indices h with a(t,h) ^ 0. In [153], the following
classes of binary cellular automata are defined
• For any initial configuration 7,
lim Lt{I) = 0.
t—>oo
• For any initial configuration 7,
0 < sup Lt{I) < oo.
t—>oo
• For some initial configuration 7,
sup Lt(I) = oo.
4->oo

14.2. ALGORITHMS AND CRYPTOGRAPHY 241
It is demonstrated in that paper that membership in each of these classes can be
decided effectively.
Cellular automata defined by A4.3) are one-dimensional. As mentioned above,
one can also define higher-dimensional cellular automata (that is, with cells in a
higher-dimensional space), see [173], [855], [1107], [1108], [1109], [1273], [1359].
Sato [1105], [1106] shows that there is an essential distinction between one-
dimensional and higher-dimensional automata. Roughly speaking, the backward
prediction problem (considered in Section 13.2) is decidable for one-dimensional
but is not for higher-dimensional automata. Several other complexity related issues
of the theory of cellular automata are dealt with in [316].
Litow and Dumas [738], using some properties of diagonals of power series,
prove that for any h the vertical generating function Ah(Y) of a linear cellular
automaton over ?q is algebraic over this field (and thus is ^-automatic).
Various aspects of the theory of cellular automata, including links to linear
recurrence sequences are discussed in [118], [259], [556], [672], [673], [729], [795],
[1273].
Applications of linear cellular automata include cryptography [118], [825],
[904], [1358], pseudo-random number generation [254], [1358], [1359], complexity
theory and theoretical computer science [1359], the theory of self-organizing sys-
systems [1359] and even dynamical systems and physics [539], [787], [809], [1273],
[1306], [1337], [1359].
Many natural orbit portraits arising from linear cellular automata are (when
suitably rescaled in the limit) sets of fractional Hausdorff dimension or fractals.
Fractals also arise from the iterative scheme a(x + 1) = Fx {a(x)) in which the map
Fx is chosen at random from some fixed finite set of mappings according to a fixed
distribution [798]. Such iterations are a particular case of probabilistic automata;
more details and further references can be found in [1359, Chap. 4].
Finally, Granville [476] (see also [547]) gives a generalization of the classical
Lucas congruence for binomial coefficients modulo a prime to prime powers. This
result is motivated in part by applications to finite automata. As an application,
an algorithm of complexity O(log2 n + kA log n log p + fc4plogp) has been designed
to compute the residue
'n\
I (modpk), 0 < m < n,
mj
which can accelerate some computations with finite automata.
14.2. Algorithms and Cryptography
14.2.1. Primality testing. Linear recurrence sequences have been used in
several primality testing and integer factorization algorithms, see [267], [1079].
The first attempts to create a fast and reliable primality test were related to
the Fermat congruence: If gcd(a,M) = 1 and aM~l =k 1 (mod M), then M is
composite. This gives a necessary condition for M to be prime that is computa-
computationally easy. Selecting different a gives a series of tests which test primality to
a high level of confidence. Composite numbers M that pass this test in the sense
that aM~l = 1 (mod M) for some a with gcd(a, A/) = 1 are called pseudo-primes
to the base a. The most extreme form of composite pseudo-primality is exhibited
by the Carmichael numbers: These are numbers M which are pseudo-prime to the
base a for all a with gcd(a, M) = 1.

242 14. COMPUTER SCIENCE AND CODING THEORY
The number Pa{N) of pseudo-primes to the base a, and the number C(N) of
Carmichael numbers, in the interval 1 < M < N are not too large:
A4.5)
Pa{N) < N1' 12 Log log log TV/Log log iV^ q^ ^ ^1-LogloglogiV/LoglogA^
see [267, Sect. 3.3], [499, Sect. A12] and [1079, Chap. 4]. Nonetheless, these
deceptive numbers are significant: Alford, Granville and Pomerance [10] prove
that
C{N) » Na~?
for a = 5/6B - e/2) = 0.290 • • • > 2/7 and any e > 0. This result improves all
previously known bounds not only of C(N) but of Pa{N) as well. It is mentioned
in their paper that the results of computation and some heuristic considerations
suggest that the upper bound in A4.5) may be very precise. Several more results
about Carmichael pseudo-primes and other related questions appear in [59], [60],
[189], [190], [545].
Thus the primality test based on Fermat's Little Theorem is not entirely reli-
reliable. Nonetheless, it is practical and fast, and as a result is widely used.
There are many sophisticated approaches to primality testing, in particular
using elliptic curves, that are outside our scope - consult the papers [58], [452],
[453], [455], [830] for references and discussions. One of the most startling devel-
developments is a relatively simple deterministic primality test due to Agrawal, Kayal
and Saxena [4] that runs in polynomial time.
A different kind of generalization exploits Euler's criterion for quadratic residues
modulo a prime: If M is odd, gcd(a, M) = 1, and a^7^2 ^ ±1 (mod M), then
M is composite. Although there are composite numbers which pass this test — the
Euler pseudo-primes — this simple modification has turned out to be very fruitful.
A further development is the Lehmer test which is very quick when the prime
number factorization of M — 1 = p\l... p*3 is known. The Lehmer test goes as
follows. Select an integer a > 1 and check whether
and
a*7 = 1 (mod M).
If both of these are satisfied, then M is declared to be prime. This statement rests
on the fact that the only integers modulo which there exists a primitive root are
2,4, odd primes and their powers (but the latter possibility can be verified easily).
Using the lower bound C/ log log M for the density of primitive roots modulo a
prime M, and selecting M at random gives a probabilistic algorithm of the Las
Vegas type: It is never cheating when it says 'YES' and almost always correct
when it says 'NO'. For example, this gives the classical rigorous test for Fermat
numbers, see [267, Theorem 4.1.2], [1079, Theorem 4.5].
Theorem 14.3. The Fermat number F^ = 22 + 1 is prime if and only if-
Pratt [1051] shows that certifying primality belongs to the complexity class P.
Further results can be found in [628], where an algorithm is designed to test the
primality of M in O(log17'7 M) arithmetic operations involving integers of size at
most M (thus in time O(log24'7 M)), provided the factorization of M — 1 is known.

14.2. ALGORITHMS AND CRYPTOGRAPHY 243
The notion of Euler pseudo-primes can be extended to the notion of strong
pseudo-primes to the base a which are odd composite numbers M = m2s, with m
odd and such that either am ='l (mod M) or amr = -1 (mod A/). Miller [828]
remarks that the number of consecutive bases a — 2,3... with respect to which
M is a strong pseudo-prime is related to the distribution of primitive roots modulo
a prime, and uses this to show that under the Generalized Riemann Hypothesis
deterministic primality testing can be done in polynomial time.
Finally, there is the notion of pseudo-prime with respect to some linear recur-
recurrence sequences. For example, for a Lucas sequence l~(x) = (a* — afV^i ~ ^2)
having characteristic polynomial f(X) = X2 — f\X — fi with gcd(/i,/2) = 1,
/1/2 7^ —1 and D = f2 + 4/2 7^ 0, Lucas pseudo-primes are composite numbers for
which
?-{M-{D/M)) = 0 (mod A/),
where {D/M) is the Jacobi symbol modulo M, see [267, Sect. 3.5], [1079, Chap. 4]
(it is easy to verify that this condition holds for any prime A/). The best bounds
for C(N), the number of Lucas pseudo-primes on the interval 1 < M < N (for a
fixed Lucas sequence), are
A4.6) exp(logciV) < C{N) < jyi-o-SLogiogiogN/LogiogN
with some absolute constant c > 0. The lower bound is due to Erdos, Kiss and
Sarkosy [352] and the upper bound is due to Gordon and Pomerance [455]. The
constant c depends on results on the distribution of prime numbers, and on the
Linnik constant, in particular. An analogue of the Lehmer test can be designed
with respect to Lucas sequences as well. One application of this is a criterion for
the primality of Mersenne numbers Mn = 2n — 1 which is simpler to formulate in
terms of a non-linear recurrence sequence. This appears in a more general form
in [1079, Theorem 4.16].
Theorem 14.4. Let M = h2n -1 with n odd, and hM not divisible by 3. Then
M is prime if and only if
a{x-2)=0 (modA/n),
where the sequence a satisfies the recurrence relation
a(.T+l) =a{xJ-2, xeZ+
with the initial value a@) = B + ^1/2)h + B - 3l/2)h.
If 3 h a similar sequence with a different initial value can be used in the same
way too - see [1079, Theorem 4.16]. Lehmer sequences can be used as well.
Many interesting results on Lehmer and Lucas pseudo-primes can be found
in [38], [876], [877], [878], [883], [884], [1092].
Miiller and Oswald [885] consider an analogue of Carmichael pseudo-primes
for binary linear recurrence sequences. These are odd composite numbers M such
that a/(A/) = / (mod A/) for all integers /, where
af(x) =XX + \~x
and A is a zero of the polynomial X2 — fX + 1. Numerical results suggest that
such pseudo-primes are very sparsely distributed. Matthews [791] and More [837]
obtain several more relevant results. Each of these papers also provides a good

244 14. COMPUTER SCIENCE AND CODING THEORY
outline of previously known results. Somer [1228] obtains several related results,
see also [881].
Gurak [491], [492] carries this definition further, and considers pseudo-primes
with respect to a linear recurrence sequence of higher degree (see also [834]). In
particular, Gurak extends the upper bound from A4.6) to estimates for such pseudo-
primes. Many other results and references can be found in [267, Chap. 3, 4], [486],
[499, Sect.A12-13], [834], [1079, Chap. 4] and [1355].
Grantham [474], [475] introduces a new type of pseudo-prime related to prop-
properties of the Frobenius automorphism in finite fields; see also [267, Sect. 3.5]. A
related approach has also been used in [880].
Several factorization algorithms are based on non-linear recurrence sequences
similar to the one used in Theorem 14.4. One of them is Pollard's p-method.
Consider the sequence
a(x + l) = a(zJ + 6 x € Z+;
assuming that its values are randomly distributed modulo M, it is reasonable to
expect that the smallest period of this sequence is of order M1/2 (this is a refor-
reformulation of the birthday paradox). However, if p is a proper divisor of M then
for similar reasons the period modulo p should be of order p1/2. Selecting b and
the initial value a@) at random modulo M, it is therefore expected that one of the
numbers gcd (aBx) — a(x), M) produces a proper divisor of M for some x of order
M1/4. It is not yet clear how to put these considerations into a precise form, but
the resulting algorithm is known to be working well, see [267, Sect. 5.2], [1079,
Chap. 6]. The only known rigorous result in this direction is due to Bach [45].
Clearly, other recurrence sequences can be tried as well.
14.2.2. Algorithm design. Several papers study what happens to a proba-
probabilistic algorithm if instead of ideal random numbers, pseudo-random numbers are
used (usually generated by a linear congruencial generator A3.2) or A3.3)). This
question relates directly to any practical implementation of the algorithm. For
both primality testing and the problem of extracting roots in finite fields, this is
done by Bach [44]. Several other probabilistic algorithms are studied by Karloff and
Raghavan [577]. An example of a problem arising in analyzing such pseudo-random
algorithms is the following: For a primitive root A modulo a prime number p and
1 < a < p — 1, denote by fa,x,P{N, H) the number of indices i with 0 < i < p/H — 1
such that the congruence
a\x=u (modp), 1 < x < N, iff + 1 < y < (i + l)ff,
has a solution. Karloff and Raghavan [577] show that the complexity of the Quick-
Sort algorithm using a linear congruencial generator depends on fa^p(N, \j?/N\)
(see also [1288]). The number of comparisons made by the algorithm to sort a
sequence of N elements is
1 + iVlogiV.
In particular, an important question is to determine how large should the modulus
p be in order to have Ca,x,p{N) = O(NlogN), the estimate for the QuickSort
algorithm using an ideal random number generator. Estimating fatx,p{N,H) is an
interesting question on its own merits. Clearly
min{p/H, N} > Ia,x,P{N,H) > max{N/ff, 1},

14.2. ALGORITHMS AND CRYPTOGRAPHY 245
so Ca,x,P(N) = O(NlogN) implies p » N3'2 log~1/2 N.
The behaviour of Iai\iP(N,H) is related to the quantity Ra<XiP(N,H) intro-
introduced in Section 7.2, but this relation is not explicit and some efforts are needed
to estimate Ia.x,P(N, H) using estimates for Ra,\,P(N, H). The asymptotic result
Ia^,P(N,H) = I A + O {p'RaAA", [H/2\)N-2H-2))
was communicated to the authors by Hugh Montgomery. Any upper bound for
Ra,\,P{N,H) can be applied to this to estimate Ia^p{N,H). Unfortunately, when
NH ~ p, the bound G.7) is not strong enough to produce a non-trivial result for
IaXp(N,H). ' •
In [629], the relation
Ia,XfP(N,H) » mm{p/H, iV2#i?aAp(iV,#r V1}
between Ia^p(N,H) and Ra^<p(N,H) is found. It is also shown that, for any
k>2,
T (N m ^ ,yB-. minQI/^-1, 1} - .
laXp{ ' j ^ P
Combining the two bounds above and G.7) gives the following result.
Theorem 14.5. For any e > 0,
'N,
ifp1'2 <N<
< N
Thus Ca,\,P(N) = O(N logN) implies p > N5/3~?.
The bounds for Ra>\tP(N, H) on average can be used as well. In particular,
' N if N < r)l/i~E-
[pl'*-e, HN>pl^-s-
for all but o (<p(p — 1)) primitive roots A modulo p. This bound unfortunately is
not applicable to the problem of estimating Ca,x,p{N)- Another bound from [629],
holds for all but O(p1~s) values a = 1,... ,p - 1. Thus to have Ca<xtP(N) =
O(N log N) for almost all a, p should be of order N2~s at least.
Seroussi and Bshouty [1154] have found an application of linear recurrence
sequences over finite fields to the problem of testing Boolean functions. Alon,
Goldreich, Hastad and Peralta [26] use linear recurrence sequences to construct
so-called almost k-wise independent random variables — a fast growing area of
modern computer science with a vast number of applications.
In [650], a probabilistic algorithm to verify if a given sequence satisfies a linear
recurrence equation is designed. This paper belongs to a new area of computer
science, that of testing and verification of functions.
Rabin [1059] shows that computing the number of zeros modulo p of a linear
recurrence sequence over Fp is an NP-hard problem.
Upper bounds from [1040] for the number of solutions of equations and con-
congruences with exponential polynomials of the shape B.14) (like Theorem 2.9, for

246 14. COMPUTER SCIENCE AND CODING THEORY
instance) can be used to design an algorithm to test identities with such polynomi-
polynomials [578] in the same way as this is done in [1381] for algebraic polynomials.
14.2.3. The Orbit Problem. In its most general form the Orbit Problem-
can be formulated as follows: Given an initial vector a, a matrix A, and a target
vector t of dimension n over a commutative ring 71, determine if t belongs to
the orbit {aAx : x e N}. That is, decide if the equation aAx = t is solvable
for x. As remarked in Section 1.1, coordinates of any matrix exponential function
are linear recurrence sequences whose characteristic polynomial is the characteristic
polynomial of the matrix. Thus the Orbit Problem is a question about simultaneous
solvability of a system of equations in linear recurrence sequences.
For the Orbit Problem over Q, Kannan and Lipton [573] get a version of
Theorems 1.2 and 2.5 for the vector aAx, and show that this problem can be solved
in polynomial time.
On the other hand, good explicit upper bounds for this problem are still not
known. It is possible that the original algorithm of [573] can be essentially refined
using results about the growth and number of solutions of equations with linear
recurrence sequences over Q, as well as results about the number of solutions of
congruences.
The paper [193] addresses a more general question about matrix (semi-)groups
with two generators over algebraic number fields, and provides a new approach
leading to a deterministic polynomial time algorithm as well. In particular, this
paper contains a ver}' simple proof of the main result of [573], For further progress
in the Orbit Problem for matrix groups see [43], [194], [192] and [224].
The case of fields of positive characteristic seems to be harder. Indeed, the
Orbit Problem over a finite field Fg is related to the discrete logarithm problem:
Let q = pr denote a prime power and a,g.t € F*. Then the equation agx = Ms
equivalent to the system of equations
A4.7) aj{x)=tij, j = l,...,r,
where
and wi,... .*<;,- is a basis of Fg over Fp. The system A4.7) is a particular case
of G.1). It is shown in [872] (using results given in Section 7.1), that for some values
..of parameters the solvability of G.1) can be efficiently verified. For example, if both
m and q are fixed, then this can be done in polynomial time n0'1'. Unfortunately,
for m large this method does not produce any non-trivial bounds. Thus in particular
it is not applicable to the system A4.7) (where m = n = r) corresponding to the
discrete logarithm case.
Lange [672], [673] shows that linear recurrence sequences are useful in the
implementation of some polynomial factorization algorithms over finite fields.
14.2.4. Cryptography. As mentioned in Section 5.1, bounds for exponential
sums from [198], [199], [410], [413], [414] are often motivated by cryptographic
questions.
The result of [411] on the period of the power generator has also found some
cryptographic applications: It implies that the cycling attack on the RSA cryp-
tosystem has negligible chance of success. It also gives some security assurances to

14.3. CODING THEORY 247
a recent cryptographic construction related to timed-release cryptography; ses [411]
for more details.
Theorem 5.8 and the bounds E.2), E.4), E.5) have been one of the main tools
(together with some methods from geometry of numbers) in proving certain bit
security results for some major cryptosystems [450], [451], as well as in design-
designing rigorously proved attacks on the Digital Signature Algorithm and its modifi-
modifications [336], [923], [924]. On the other hand, the bit security results of [449]
and [1206] are based on the bound for the number of zeros of linear recurrence
sequences given by Theorem 5.10. In turn, the result of [1206] has recently been
improved in [722] by using the bound E.1).
In Sections 13.1 and 13.2, potential applications of linear recurrence sequences
to cryptography (related to pseudo-random properties of such sequences) are dis-
discussed. There are also more direct applications: Niederreiter [931]. [937] de-
describes the following generalization of the celebrated Diffie-Hellman key-exchange
system. Two participants, Alice and Bob, use the same linear recurrence se-
sequence a of order n over a field F which is known to the attacker. Each of
them selects a secret number, say k and L Then Alice computes and sends to
Bob the values a(?),... ,aBnf), and Bob computes and sends to Alice the val-
values a(k).... ,aBnk). Knowing these values and using the Berlekanip-Massey al-
algorithm, for example, Alice and Bob compute the characteristic polynomials of
sequences ai{x) = a(?x) and a^(x) = a(kx). Now each of them can compute the
same sequence a^x) = at(kx) = ak(?x), whose first m < n values can be used as
the common key. To break this cryptosystem. the attacker will have to find the val-
values afc^(l),... , a.kt(rn) from the values a(?),.... aBn?) and a(k) . aBnk) only.
Several more modifications of this basic scheme are considered in [931] as well.
A study of a cryptosystem based on Lucas sequences (analogous to the discrete
logarithm and RSA cryptosystem) can be found in [124] and [125].
Krawczyk [642] shows how to use linear recurrence sequences for hashing. An-
Another way of using linear recurrence sequences for cryptographic purposes is pre-
presented by Johansson [560]. Klapper [613] addresses some complexity issues of
using linear and non-linear recurrence sequences in cryptography.
Many of the aforementioned links between cryptography and recurrence se-
sequences as well as several others are discussed by Menezes, van Oorschot and
Vanston [813] and Stinson [1251].
14.3. Coding Theory
14.3.1. Cyclic Linear Codes. The widely used cyclic linear codes are lin-
linear recurrence sequences over finite fields [85] and [768], so the theory of linear
recurrence sequences applies to such codes. More precisely, given a polynomial /
of degree n and period t over ?q, the set of vectors, or code-words (a(l) , a(t))
over all sequences from ?(/) is called a cyclic linear code of dimension n and length
t with checking polynomial f. The polynomial
f(x)
is called the generating polynomial. The period of / is the length of the code and
the degree of / is the dimension of the code. The cyclic linear code of dimension
n and length t with checking polynomial / and the cyclic linear code of dimension

248 14. COMPUTER SCIENCE AND CODING THEORY
t — n and length t with the checking polynomial g are dual as vector spaces over
Hence, results on the number of zeros and the distribution of values of linear
recurrence sequences can be translated into results about the weight distribution
of codewords of a cyclic linear code, while bounds for exponential sums with linear
recurrence sequences readily produce bounds for correlation functions (both peri-
periodic and aperiodic) for such codes. For example, for a linear recurrence sequence a
of order n over a prime field Fp, let
N
x=i
denote the Lee weight of the vector
A4.8) A(N) = (a(l),..
where ||a||p is the smallest (by absolute value) representative of the residue class of
a. It is shown in [1196] that
La(N) = N?-^
for any iV <'t, where t is the period a. Direct application of Theorems 7.1 and 7.2
produces worse error terms; in order to get the bound above some additional con-
considerations are needed. For the Hamming weight Wa(N), the number of non-zero
elements of the vector A4.8), those two theorems can be applied immediately.
On the other hand, some new specific problems arise in the coding theory
context. Indeed, the results mentioned above are directly or indirectly related to
Theorems 5.1, 5.2, 7.1 and 7.2 and therefore are non-trivial for the case of larger
periods only (of order about qn^2 for sequences over ?q). This situation is not typical
for coding theory where the case of small t (logarithmically small sometimes) is of
major interest, because it corresponds to cyclic linear codes with small redundancy
r = t — n.
One of the approaches to the case of small periods is discovered in [1202,
Sect. 7.3] and relies on Szemeredi's Theorem [1269] on integer sets without arith-
arithmetical progressions (as in Section 2.1).
The first proofs of the Szemeredi Theorem were non-effective. However, for
A = 3, Heath-Brown [522] gets an effective result. More recently, Gowers has
found an effective result for A = 4, [463]; and then for all A in [464]. Indeed, the
brilliant work of Gowers [464] asserts that for every integer s > 1 and sufficiently
large integer JV, every subset S of {1.2,..., iV} of size at least
A4.9) |S|>iV(lnlniV)-~2~2S+9
contains an arithmetic progression of length s. See [462] for an overview of these
developments. This result implies that any cyclic linear code of prime length t —¦ oo
with redundancy that is not too small (for example any sequence of codes with the
transfer rate R = n/t bounded away from 1, limsupj^^ n/t < 1) has the minimal
distance d —> oo.
Theorem 14.6. For any e > 0 and any cyclic linear code C over ?q of suffi-
sufficiently large prime length t = p with gcd(p,q) = 1 and dimension n, the minimal

14.3. CODING THEORY 249
distance d satisfies *•
d> A + o(l)) log log log log log i
provided that the redundancy r = t — n of C satisfies
PROOF. It is clear that the set of roots of X* — 1 forms a multiplicative group Qt,
which is a subgroup of a multiplicative group of a certain finite extension of ?q and
thus is cyclic. Let a be a generator of this group. Because all the roots of g are
distinct elements of Qt, there are integers 0 < m,\ < ... < mr < t — 1 such that the
powers
am% i = l,...,r,
are all distinct roots of g. Let a be the solution to the equation
2 = exp (-()
Then A4.9) shows that the set S = {m1;..., mr} contains an arithmetic progression
aJ + b, j = 0,..., s — 1, of length s > [a\. We show that d > s. Indeed, let
v = (vo,... ,Wf_i) G C be an arbitrary non-zero code word. Then
t-i
A4.10) Ylviai{aj+b) =°> i = o,...,s-i. , .
If ii,... ,iw are the positions of the non-zero components of v and w < s, then
using only the first w equations from A4.10) shows that the system of equations
Ul-l
u-0
has a non-zero solution xu = Vi^al"b, u — 0...., w — 1. Therefore the matrix of
the system V = (P1^)™ ._0, where 0 = aa, is singular. On the other hand, V is a
Vandermonde matrix. Because 0 < a < t and t is prime, the elements B%u = a1""
are pairwise distinct. Therefore det V ^ 0. This contradiction implies that w > s.
Finally, the estimate
a - A + o(l)) log log log log log i
gives the result. ?
One more characteristic of coding theory problems is that q is usually small.
To avoid some messy details, the case q = 2 (which is the most important case for
computing applications) will be considered.
The method used to prove Theorems 5.3 and 5.4 turns out to be useful for
studying cyclic linear codes as well. For a cyclic linear code, denote by M(w) the
number of code-words A(t) given by A4.8) with Hamming weight Wa(t) < w. The
following theorem is proved in [1191]. Similar results are independently obtained
in [1003].
Theorem 14.7. Let f denote an irreducible checking polynomial of degree n
and period t over ?2- For any integer r with n >r > nw/t,
rt -nw /-J \vj

250 14. COMPUTER SCIENCE AND CODING THEORY
Proof. Let a,, i = 1,... , Q be m = M(w) — 1 non-zero sequences generating code
words of weight at most w. Since
x—l
where wa(x) is the Hamming weight of the vector (a(x + 1),... , a(x + n)),
.. n t 1 n
i=l x=l v-1
where I(v) is the numbers of vectors
A4.11) (ai(x + l),... ,ai(x + n)), i = l,...,m, x = l,...,t,
of weight v. Among the vectors A4.11), each non-zero binary string (d\,... , dn)
occurs at most n times (in fact either never or exactly n times). Therefore
I(v)<n(n
and certainly 1@) = 0. Then
SO
"¦ mw <
~ n *—' " ' n
r j
(v)v + r > /(w) = — rmi — > I(v)(r — v)
\V-\ V = T / \ V=\ /
rmt 1x—s(n
n n *-^f \v
and the bound follows. D
Now let w/t <lu< 1/2. The estimate
from [768, Sect. lO.ll], where
and the choice r = [(u> + 6)n\ for sufficiently small S > 0, together show that the
bound
M(w) = OBH^n+sn^)
holds. Now let 0 < ip(ct) < 1/2 be the unique root of the equation
)) = a, 0<a<l/2.
Theorem 14.8. Let W denote the minimum weight of non-zero code-words of
the cyclic linear code with irreducible checking polynomial f of degree n and of period
t over ?2- Assume that log2 t/n > a > 0. Then, for t —> 00, W > ip(a)t + o(t).

14.3. CODING THEORY 251
This result was proved in [1188], but it follows also from Theorem 14.7. Indeed,
it is clear that M(W) >t + l, (the zero-word plus t cyclic shifts of a minimal weight
word). Then
+ i
rt — nW
SO
n N
Setting r = \nip{a) - n1/2j gives Theorem 14.8.
Other applications of these techniques give Theorems 9.7 and 9.8; the latter
can also be reformulated as an upper bound on the covering radius of cyclic linear
codes.
14.3.2. Correlation Functions. Fix a non-trivial additive character \ of a
ring 1Z. For two sequences a and b of period / over K, define the periodic and
aperiodic correlation functions as
t t-h
Pab(h) = J^x{a(x) - b(x + h)), $ab(h) = J^X (a(x) - b(x +
respectively [1104], [1378]. In the case a =b these functions are called autocorre-
autocorrelation functions.
Let 97ln denote the set of all M-sequences a of order n and period t = 2n — 1.
Set
N
rn= max max I
It is clear that any non-trivial correlation function (periodic or aperiodic) between
M-sequences of order iV does not exceed r^-. Define
r = lim sup rn/n.
n—>oc
Helleseth [525] gives examples of sequences with high periodic correlation, which
shows that r > 1/3. An upper bound for r follows from Theorem 5.4:
1/3 <r< 1-2-0A/2) = 0.78... .
It is not clear how to apply this method to estimating the correlation between non-
nonlinear recurrence sequences (sums with a single non-linear sequence can be dealt
with; cf. Theorem 5.3). Certainly other bounds for exponential sums with linear
recurrence sequences produce bounds for correlation functions of cyclic linear code.
On the other hand, in Section 5.1 bounds which hold for all, or at least a very
wide class of, linear recurrence sequences are obtained. For coding theory appli-
applications only special classes of sequences need be considered, many of which admit
good estimates for correlation functions. An exhaustive survey of older results is
provided by Sarwate and Pursley [1104]; more recent results are surveyed by Helle-
Helleseth [526] and by Helleseth and Kumar [527]. A variety of examples of families
of linear recurrence sequences with small correlation can be found in [223], [244],
[274], [301], [440], [441], [442], [443], [446], [447], [528], [611], [612], [614],
[615], [616], [704], [963], [964], [965], [966], [985]. [1264], [1292], and references
therein.

252 14. COMPUTER SCIENCE AND CODING THEORY
Klapper [611] considers the dual problem of constructing sequences with large
linear complexity and low correlation. For n = 2km, he finds a family of sequences
(derived from linear recurrence sequences) of size 2n/2 with the largest value of
periodic correlation function 2n/2 + 1 and with linear complexity at least
3mkCk - l)m~~2.
For k = 2, the complexity is exponentially large, being of order 1.5n5n/4~2. This
work is continued in [612], see also [240], [444], [1153], [1264].
The problems considered so far are specific forms of a well-known number-
theoretic question: To find bounds for the number of zeros in exponential sums.
The next question is specific to coding theory.
For a cyclic linear code with irreducible checking polynomial / e F2[X] of
degree n and period t, denote by s the number of different weights of its code-
codewords and put T = Bn - 1) jt. Trivially, s < min{t,T}. Better upper bounds for
s are established in [1191]
'A4.12) s<min{(l + o(l))T/\ogT, C/4I/32n/3 + 2} .
The first bound is derived by considering intersections of cyclotomic classes
Cm = { m2i (mod 2n - 1); i = 0,..., n } C Z/Bn - 1)Z,
where m e Z/Bn - 1)Z, under the shifts jT + Cm, j = 1,... , t, in the residue
ring Z/Bn - 1)Z. The second bound follows from the identity E.8) (with q = 2,
c = 0, N = t). Indeed, for the weight Wa(t) of a non-zero code vector A(t) of the
form A4.8),
Also, t non-zero code words generate t distinct shifts of the same sequence and of
the same weight. Thus if w\ ws-\ are s — 1 distinct non-zero weights of the
code, then
t2 + t{t-2wlf + ¦¦¦ + t(t - 2wsf < 2nt.
Since the sum of squares of s different integers is at least s3/12 + O(s2), the
last inequality gives the bound s = 0Bn/3). More exact computation and the
congruence Wa(t) = 0 (mod 2) produce the desired estimate.
The same question is important for correlation functions as well.
Let a be a binary Af-sequence of order n and of period t = 2n — 1. In this case all
possible M-sequences of the same period admit a unique representation in the form
(a(kx + ?)) with certain integers k and I, satisfying the conditions 0 < k, I < t — 1,
gcd(M) = 1- Set
p
and denote by sn(k) the number of different values among the idn(k,i), 0 < I < t,
for a fixed k with gcd(d,t) — 1, and by sn the number of different values among
¦dn(k, i) for all possible values k and I with 0 <k,l <t-l, gcd(k, t) = 1. There are
many investigations that study the distribution of values of the functions "dn{kj)
and sn(i), and in particular for I of a special form [525], [1104]. The values of I
with small sn(?) are of special interest. For example, Cusic and Dobbertin [273]
show that sn(i) = 3 for I = 2m + 2<m+1)/2 + 1 and I = 2<m+1)/2 + 3 if n is even

14.3. CODING THEORY 253
and m = n/2 is odd. Some other results can be found in [202], [303], [442],
[525], [540], [615] and [1104]. Non-trivial upper bounds for sn(tj and sn, are
given in [1191]. The bound of sn has been substantially improved in [409] which
makes use of Theorem 5.10. The results of [1191] and [409] can be combined in
the following statement.
Theorem 14.9. For any e > 0 and n —¦ oo, the bounds
A) sn(l)
B) sn =
hold.
In [1196], it is pointed out that bounds for exponential sums over exponential
functions can be successfully applied to studying the dimension of the most famous
cyclic linear codes, namely BCH-codes [85], [768]. Roughly speaking, estimating
the dimension of BCH-codes of length n with designed distance A over ?q is equiv-
equivalent to estimating the maximal number J(q, n, A) over all i = 0,... , n — 1 of
a = 0,... , n — 1 for which the congruence
aqx = ? + y (mod n), 1 < x < t, l<y<A
holds, where t is the period of q modulo n, see [768, Sect. 7.3]. The result of that
paper was improved in [1202, Sect. 7.3]. Finally, in [629] results on the distribution
of exponential functions are used to give the following improved estimates:
T. . , . f n52 log <5 a(nM2 n<52Loglogn"|
J(q, n, A) < min I^^ ^4 |
where 6 = A/n. a(n) is the sum of the positive divisors of n. and
with some positive constant C(q) > 0 depending only on q, which is better for some
values of parameters.
Despite being one of the most theoretically attractive and practically useful
codes, BCH-codes are not optimal in the class of cyclic linear codes for several
reasons. In [1188], a construction is given for an infinite sequence of cyclic linear
codes of length t, dimension n and minimal weight w, satisfying the conditions
w/n —>¦ 1/2, log n/ log t —>¦ 2/3, n —>¦ oc.
For primitive BCH-codes with the same relation between the length and dimension,
instead of 1/2 one would get some number u2/z < 3/8 which is the root of the
equation s{u2/z) — 2/3 where s(u) is the Berlekamp function (see [85, Sect. 12.6]).
Kuz'min and Nechaev [662] show that projections of linear recurrence se-
sequences over Galois rings produce new codes with many desirable features; see
also [827], [919] and references therein.
BCH-codes are not the only codes whose behaviour is related to questions
about the distribution of residues of exponential functions. Clark and Lewis [243]
show that the existence of some special arithmetic codes is related to the following
question: Describe the set of pairs (r, p) where r is an integer and p is a prime,
gcd(p, r) = 1, such that the number of solutions of the congruence
arx = y (mod p), 1 < xt, -f- < y <
r+1 ~"~ r+1

254 14. COMPUTER SCIENCE AND CODING THEORY
where t is the period of r modulo p, does not depend on a = 1,... p—1. Gordon [454]
indicates links of this problem to many classical questions of number theory.
Finally, the classification of self-dual codes over Z4 leads to a question about
integer divisors of binary linear recurrence sequences [1005]. This link is a primary
motivation of the study of such divisors in [840].

Sequences from the on-line Encyclopedia
Sequences mentioned in the text that appear in Sloane's Online Encyclope-
Encyclopedia of Integer Sequences [1222] are listed here, together with the pages on which
they appear. In some cases the entry here reflects a specific sequence satisfying a
recurrence relation in the text.
A000045, Fibonacci sequence / =
(/(n)), 177, 73, 93, 95, 148, 181, 184,
187
A000058, Sylvester's sequence, 161
A000110, Bell numbers, 150, 151, 156
A000123, binary partition sequence,
154
A000204, Lucas sequence, 93, 99, 103,
104, 104, 106, 112, 180, 184, 184, 23, 104,
104, 111, 163, 163 181, 184
A000367, even Bernoulli numerators,
187
A000594, Ramanujan's r-numbers, 150
A000668, Mersenne primes, 93, 94, 95,
100, 157, 180
A001285, Thue-Morse sequence, 234,
235, 237
A001353, 163
A001462, Golomb's sequence, 10
A001580, 2n + n2, 94
A001611, f(n) + 1, 107
A001644, Tribonacci sequence, 186
A001906, /Bn), 93
A002064, Cullen numbers, 94
A002445, even Bernoulli denominators,
187
A002487, Stern's diatomic sequence,
153
A003023, aliquot sequence, 63
A003261, Woodall (or Riesel) numbers,
107
A006720, a Somos-4 sequence, 9, 179
A006769, EDS for E :i/ + y = x3 - x,
P=@,0), 11,464
A007420, Berstel's sequence. 38, 28
A007925, 100
A014551, Jacobsthal-Lucas sequence,
106, 114, 180
A014566, Sierpinski numbers, 100
A019434, Fermat primes, 93
A020987, Rudin-Shapiro sequence,
234, 235
A023057, Catalan's conjecture, 159
A024036, Dn - 1), 93
A046859, Ackerman's function, 10
A048578, Pisot sequence LC,5), 106
A062395, (8n + l), 106
A070939, binary length sequence, 233
A078495, Somos-7 sequence, 95
A079472, 2/(n)/(n- 1), 178
255

Bibliography
1. N. Adachi, An application of Frey's idea to exponential Diophantine equations, Proc. Japan
Acad. Ser. A Math. Sci. 70 A994), no. 8, 261-263. MR 95i:11022
2. R. Adler, M. Keane, and M. Smorodinsky, A construction of a normal number for the con-
continued fraction transformation, J. Number Theory 13 A981), no. 1, 95-105. MR 82k:10070
3. L. Afflerbach and R. Weilbacher, The exact determination of rectangle discrepancy for
linear congruential pseudorandom numbers. Math. Comp. 53 A989), no. 187, 343-354.
MR 90h:65009
4. M. Agrawal, N. Kayal, and N. Saxena, Primes is in P,
www.cse.iitk.ac.in/news/primality.pdf, 2002.
5. S. D. Ahlgren, Polynomial-exponential equations in two variables, J. Number Theory 62
A997), no. 2, 428-438. MR 97k:11044
6. , The set of solutions of a polynomial-exponential equation, Acta Arith. 87 A999),
no. 3, 189-207. MR 99m:11031
7. S. Akiyama, A new type of inclusion exclusion principle for sequences and asymptotic
formulas for C(it), J. Number Theory 45 A993), no. 2, 200-214. MR 94k:11027
8. , A criterion to estimate the least common multiple of sequences and asymptotic
formulas for ?C) arising from recurrence relation of an elliptic function, Japan. J. Math.
(N.S.) 22 A996), no. 1, 129-146. MR 97f:11021
9. R. Z. Aleev, Higman's central unit theory, units of integral group rings of finite cyclic
groups and Fibonacci numbers, Internat. J. Algebra Comput. 4 A994). no. 3. 309-358. MR
95h:16042
10. W. R. Alford, A. Granville, and C. Pomerance, There are infinitely jnany Carmichael
numbers, Ann. of Math. B) 139 A994), no. 3. 703-722. MR 95k:11114
11. J.-P. Allouche, Automates finis en theorie des nombres, Exposition. Math. 5 A987), no. 3,
239-266.. MR 88k:11046
12. , The number of factors in a paperfolding sequence, Bull. Austral. Math. Soc. 46
A992), no. 1, 23-32. MR 93f:11020
13. , Sur la complexite des suites infinies. Bull. Belg. Math. Soc. Simon Stevin 1 A994),
no. 2, 133-143. MR 96d:68167
14. J.-P. Allouche, A. Arnold, J. Berstel, S. Brlek. W. Jockusch, S. Plouffe, and B. E. Sagan,
A relative of the Thue-Morse sequence, Discrete Math. 139 A995), no. 1-3, 455t461. MR
96c:11029
15. J.-P. Allouche and M. Bousquet-Melou, On the conjectures of Rauzy and Shallit for infinite
words, Comment. Math. Univ. Carolin. 36 A995), no. 4, 705-711. MR 97e:68103
16. J.-P. Allouche, P. Hajnal, and J. Shallit, Analysis of an infinite product algorithm, SIAM
J. Discrete Math. 2 A989), no. 1, 1-15. MR 90f:68073
17. J.-P. Allouche and P. Liardet, Generalized Rudin-Shapiro sequences, Acta Arith. 60 A991),
no. 1, 1-27. MR 92k:11080
18. J.-P. Allouche, M. Mendes France, and A. J. van der Poorten, An infinite product with
bounded partial quotients, Acta Arith. 59 A991), no. 2, 171-182. MR 92k:11074
19. J.-P. Allouche, P. Morton, and J. Shallit, Pattern spectra, substring enumeration, and
automatic sequences, Theoret. Comput. Sci. 94 A992), no. 2, 161-174. MR 93i:11030
20. J.-P. Allouche and J. Shallit, Infinite products associated with counting blocks in binary
strings, J. London Math. Soc. B) 39 A989), no. 2, 193-204. MR 90g:11013
21. , The ring of k-regular sequences, Theoret. Comput. Sci. 98 A992), no. 2, 163-197.
MR 94c: 11021
257

258 BIBLIOGRAPHY
22. , Complexity des suites de Rudin-Shapiro generalise.es, J. Theor. Nombres Bordeaux
5 A993), no. 2, 283-302. MR 95d:11030
23. , Sums of digits, overlaps, and palindromes, Discrete Math. Theor. Comput. Sci. 4
B000), no. 1, 1-10. MR 2001c:11009
24. J.-P. Allouche, F. von Haeseler, H.-O. Peitgen, A. Petersen, and G. Skordev, Automaticity of
double sequences generated by one-dimensional linear cellular automata. Theoret. Comput.
Sci. 188 A997), no. 1-2, 195-209. MR 98j:68116
25. J.-P. Allouche, F. von Haeseler, H.-O. Peitgen, and G. Skordev, Linear cellular automata,
finite automata and Pascal's triangle, Discrete Appl. Math. 66 A996). no. 1, 1-22. MR
97b: 11033
26. N. Alon, O. Goldreich, J. Hastad, and R. Peralta, Simple constructions of almost k-wise
independent random variables, Random Structures Algorithms 3 A992). 289-304, Adden-
Addendum: 4 A993), 119-120. MR93k:94006a
27. J. Althaler and A. Diir, Finite linear recurring sequences and homogeneous ideals, Appl.
Algebra Engrg. Comm. Comput. 7 A996), no. 5, 377-390. MR 99e:94026
28. A. S. Ambrosimov, On the distribution of the frequencies of multigrams in linear recurrent
sequences over a residue ring, Uspekhi Mat. Nauk 48 A993), no. 5B93), 157-158. MR
95a:11008
29. Y. Amice, Les nombres p-adiques, Presses Universitaires de France, Paris, 1975. MR 56
#5510
30. V. S. Anashin, Uniformly distributed sequences over p-adic integers, Number-theoretic and
algebraic methods in computer science (Moscow, 1993), World Sci. Publishing, River Edge,
NJ, 1995, pp. 1-18. MR96m:11107
31. M. Anderson and D. W. Masser, Lower bounds for heights on elliptic curves, Math. Z. 174
A980), no. 1, 23-34. MR 82g: 10049
32. §. Andrei, M. Kudlek, and R. §. Niculescu, Some results on the Collatz problem, Acta
Inform. 37 B000), no. 2, 145-160. MR 2002c:11022
33. S,. Andrei and C. Masalagiu, About the Collatz conjecture, Acta Inform. 35 A998), no. 2,
167-179. MR 99d:68097
34. D. Applegate and J. C. Lagarias, Density bounds for the Sx + 1 problem. I. Tree-search
method. Math. Comp. 64 A995), no. 209, 411-426. MR 95c:11024
35. , Density bounds for the 3x + 1 problem. II. Krasikov inequalities. Math. Comp. 64
A995), no. 209, 427-438. MR 95c:11025
36. ___, The distribution of 3x + 1 trees, Experiment. Math. 4 A995). no. 3, 193-209. MR
97e: 11033
37. , Lower bounds for the total stopping time of 3x + l iterates, Math. Comp. 72 B003),
no. 242, 1035-1049 (electronic). MR 1 954 983
38. F. Arnault, The Rabin-Monier theorem for Lucas pseudoprim.es, Math. Comp. 66 A997),
no. 218, 869-881. MR 97f:11009
39. D. K. Arrowsmith and F. Vivaldi. Geometry of p-adic Siegel discs. Phys. D 71 A994),
no. 1-2, 222-236. MR 95d:11162
40. M. Artin and B. Mazur, On periodic points, Ann. of Math. B) 81 A965), 82-99. MR 31
#754
41. M. Ayad, Periodicite (mod q) des suites elliptiques et points S-entiers sur les courbes
elliptiques, Ann. Inst. Fourier (Grenoble) 43 A993), no. 3, 585-618. MR 94f:11009
42. M. Ayad and D. L. McQuillan, Irreducibility of the iterates of a quadratic polynomial over
afield, Acta Arith. 93 B000), no. 1, 87-97, Erratum: 99 B001), 97. MR 2001c:11031
43. L. Babai, R. Beals, J.-Y. Cai, G. Ivanyos, and E. M. Luks, Multiplicative equations over
commuting matrices, Proceedings of the Seventh Annual ACM-SIAM Symposium on Dis-
Discrete Algorithms (Atlanta, GA, 1996) (New York), ACM, 1996, pp. 498-507. MR 1 381
955
44. E. Bach, Realistic analysis of some randomized algorithms, J. Comput. System Sci. 42
A991), no. 1, 30-53. MR 92b:11090
45. , Toward a theory of Pollard's rho method, Inform, and Comput. 90 A991), no. 2,
139-155. MR 92a:11151
46. , Efficient prediction of Marsaglia-Zaman random number generators, IEEE Trans.
Inform. Theory 44 A998), no. 3, 1253-1257. MR 99b:65007

BIBLIOGRAPHY 259
47. E. Bach and L. Huelsbergen, Statistical evidence for small generating sets, Math. Comp.
61 A993), no. 203, 69-82. MR 93k: 11089
48. E. Bach, R. Lukes, J. Shallit, and H. C. Williams, Results and estimates on pseudopowers,
Math. Comp. 65 A996), no. 216, 1737-1747. MR 97a:11161
49. E. Bach and J. Shallit, Factoring with cyclotomic polyjiomials, Math. Comp. 52 A989),
no. 185, 201-219. MR 89k:11127
50. A. Baker, Linear forms in the logarithms of algebraic numbers. I, Mathematika 13 A967),
204-216.
51. , Linear forms in the logarithms of algebraic numbers. II, Mathematika 14 A967),
102-107.
52. , Linear forms in the logarithms of algebraic numbers. Ill, Mathematika 14 A967),
220-228. MR 36 #3732
53. , Linear forms in the logarithrns of algebraic numbers. IV, Mathematika 15 A968),
204-216. MR 41 #3402
54. , Transcendental number theory, Cambridge University Press, London, 1975. MR
54 #10163
55. , The theory of linear forms in logarithms, Transcendence theory: advances and
applications (Proc. Conf., Univ. Cambridge, Cambridge, 1976), Academic Press. London,
1977, pp. 1-27. MR 58 #16543
56. , Logarithmic forms and the abc-conjecture, Number theory (Eger, 1996), de
Gruyter, Berlin, 1998, pp. 37-44. MR 99e:11101
57. M. Baker, Lower bounds for the canonical height on elliptic curves over abelian extensions,
Int. Math. Res. Not. B003), no. 29, 1571-1589.
58. R. Balasubramanian and M. Ram Murty, Elliptic pseudoprim.es. II, Seminaire de Theorie
des Nombres. Paris 1988-1989, Birkhauser Boston, Boston, MA, 1990, pp. 13-25. MR
92f:11076
59. R. Balasubramanian and S. V. Nagaraj, Density of Carmichael numbers with three prime
factors, Math. Comp. 66 A997), no. 220, 1705-1708. MR 98d:11110
60. , The least witness of a composite number, Lect. Notes in Comp. Sci. 1396 A997),
66-74.
61. C. Ballot, Density of prime divisors of linear recurrences, Mem. Amer. Math. Soc. 115
A995). no. 551, viii+102. MR 95i:11110
62. , Group structure and maximal division for cubic recursions with a double root,
Pacific J. Math. 173 A996), no. 2, 337-355. MR 97k:11018
63. , The density of primes p, such that —1 is a residue modulo p of two consecutive
Fibonacci numbers, is 2/3, Rocky Mountain J. Math. 29 A999), no. 3, 749-761. MR 1 733
067
64. , Strong arithmetic properties of the integral solutions of X3 + DY3 + D2Z3 —
3DXYZ = 1. where D = A/3 ± 1,M 6 Z*, Acta Arith. 89 A999), no. 3. 259-277. MR
2001d:11012
65. W. Banks, F. Griffin, D, Lieman, and I. E. Shparlinski, Non-linear complexity of the Naor-
Reingold pseudo-random function, Lect. Notes in Comp. Sci. 1787 B000), 53-59.
66. G. Barat and P. J. Grabner, Distribution of binomial coefficients and digital functions, J.
London Math. Soc. B) 64 B001), no. 3, 523-547. MR 1 865 548
67. E. Barone, A heuristic probabilistic argument for the Collatz sequence, Ital. J. Pure Appl.
Math. 4 A998), 151-153 A999). MR 2000d:11033
68. D. Barsky, J.-P. Bezivin, and A. Schinzel, Une caracterisation arithmetique de suites
recurrentes lineaires, J. Reine Angew. Math. 494 A998), 73-84. MR 99j:11011
69. T. Bass, The Reach Tee Shirt Site, www.math.harvard.edu/"propp/reach/shirt .html.
70. N. L. Bassily. I. Katai, and M. Wijsmuller, Number of prime divisors of <j>k(n), where <j>k
is the k-fold iterate of 4>, J. Number Theory 65 A997), no. 2, 226-239. MR 2000c:11159
71. , On the prime power divisors of the iterates of the Euler-cp function, Publ. Math.
Debrecen 55 A999), no. 1-2, 17-32. MR 2000g:11092
72. A. Batra and P. Morton, Algebraic dynamics of polynomial maps on the algebraic closure
of a finite field. I, Rocky Mountain J. Math. 24 A994), no. 2, 453-481. MR 95d:11163
73. , Algebraic dynamics of polynomial maps on the algebraic closure of a finite field.
II, Rocky Mountain J. Math. 24 A994), no. 3, 905-932. MR 95j:11114

260 BIBLIOGRAPHY
74. E. Bavencoffe and J.-P. Bezivin, Une famille remarquable de suites recurrentes lineaires,
Monatsh. Math. 120 A995), no. 3-4, 189-203. MR 97a:11027
75. A. F. Beardon, Iteration of rational functions, Springer-Verlag, New York, 1991. MR
92j:30026
76. P.-G. Becker, k-regular power series and Mahler-type functional equations, J. Number The-
Theory 49 A994), no. 3, 269-286. MR 96b:11026
77. P.-G. Becker and T. Topfer, Transcendency results for sums of reciprocals of linear recur-
recurrences, Math. Nachr. 168 A994), 5-17. MR 95d:11089
78. W. Beckner and A. Regev, Asymptotics and algebraicity of some generating functions, Adv.
in Math. 65 A987), no. 1, 1-15. MR 88h:05008
79. E. G. Belaga and M. Mignotte, Embedding the 3x + 1 conjecture in a 3x + d context,
Experiment. Math. 7 A998), no. 2, 145-151. MR 2000d:11034
80. B. Benzaghou and J.-P. Bezivin, Proprietes algebriques de suites differentiellement fi-nies,
Bull. Soc. Math. France 120 A992), no. 3, 327-346. MR 93m:12006
81. D. Berend and M. D. Boshernitzan, On a result of Mahler on the decimal expansions of
(na), Acta Arith. 66 A994), no. 4, 315-322. MR 95f:11051
82. , Numbers with complicated decimal expansions, Acta Math. Hungar. 66 A995),
no. 1-2, 113-126. MR 95m:11073
83. C. A. Berenstein and A. Yger, Exponential polynomials and V-modules, Compositio Math.
95 A995), no. 2, 131-181. MR 95m:32004
84. F. Bergeron and C. Reutenauer, Combinatorial resolution of systems of differential equa-
equations. III. A special class of differentially algebraic series, European J. Combin. 11 A990),
no. 6, 501-512. MR 91m:05010
85. E. R. Berlekamp, Algebraic coding theory, McGraw-Hill Book Co., New York, 1968. MR 38
#6873
86. D. J. Bernstein and J. C. Lagarias, The 3x+ 1 conjugacy map, Canad. J. Math. 48 A996),
no. 6, 1154-1169. MR 98a:11027
87. J. Berstel and M. Mignotte, Deux proprietes decidables des suites recurrentes lineaires,
Bull. Soc. Math. France 104 A976), no. 2, 175-184. MR 54 #2576
88. V. Berthe, Automates et valeurs de transcendance du logarithme de Carlitz, Acta Arith.
66 A994), no. 4, 369-390. MR 95h:11068
89. , Combinaisons lineaires de ?(s)/Tls sur F9(x), pour 1 < s < q — 2, J. Number
Theory 53 A995), no. 2, 272-299. MR 97c:11075
90. A. Bertrand-Mathis, Nombres normaux dans diverses bases, Ann. Inst. Fourier (Grenoble)
45 A995), no. 5, 1205-1222. MR 97m:11103
91. , Nombres normaux, J. Theor. Nombres Bordeaux 8 A996), no. 2, 397-412. MR
98c:11073
92. , Ensembles normaux relatifs a des matrices non-commutantes, J. Number Theory
63 A997), no. 1, 180-190. MR 98f:11079
93r F. Beukers, The multiplicity of binary recurrences, Compositio Math. 40 A980), no. 2,
251-267. MR 81g:10019
94. , The zero-multiplicity of ternary recurrences, Compositio Math. 77 A991), no. 2,
165-177. MR 92a:11014
95. , Recurrent sequences and p-adic spectra, Math. Z. (to appear).
96. F. Beukers and H. P. Schlickewei, The equation x + y = 1 infinitely generated groups, Acta
Arith. 78 A996), no. 2, 189-199. MR97k:11051
97. F. Beukers and R. Tijdeman, On the multiplicities of binary complex recurrences, Compo-
Compositio Math. 51 A984), no. 2, 193-213. MR 85i:11017
98. J.-P. Bezivin, Factorisation de suites recurrentes lineaires et applications, Bull. Soc. Math.
France 112 A984), no. 3, 365-376. MR 86j:11017
99. , Diviseurs premiers de suites recurrentes lineaires, European J. Combin. 7 A986),
no. 3, 199-204. MR 88d:11014
100. , Sur les diviseurs premiers des suites recurrentes liniaires, Ann. Fac. Sci. Toulouse
Math. E) 8 A986/87), no. 1, 61-73. MR 88j:11007
101. , Diviseurs premiers de suites recurrentes non lineaires, Collect. Math. 38 A987),
no. 1, 37-55. MR 90a:11022
102. , Suites recurrentes lineaires en caracteristique non nulle, Bull. Soc. Math. France
115 A987), no. 2, 227-239. MR 89d:11009

BIBLIOGRAPHY 261
103. , Plus petit com.rn.un multiple des termes consecutifs d'une suite recurrente lineaire,
Collect. Math. 40 A989), no. 1, 1-11 A990). MR 92f:11022
104. , Une generalisation du theoreme de Skolem-Mahler-Lech, Quart. J. Math. Oxford
Ser. B) 40 A989), no. 158, 133-138. MR 90g:11021
105. , Les suites q-recurrentes lineaires, Compositio Math. 80 A991), no. 3, 285-307.
MR93d:11014
106. , Fractions continues et suites recurrentes, C. R. Acad. Sci. Paris Ser. I Math. 318
A994), no. 11, 991-994. MR 95e:11015
107. , Fonctions multiplicatives et equations differentielles, Bull. Soc. Math. France 123
A995), no. 3, 329-349. MR 97d:11009
108. , Sur les suites recurrentes a coefficients polynomes, J. Number Theory 66 A997),
no. 2, 282-290. MR 98h:11027
109. , Sur les suites presque-periodiques, Arch. Math. (Basel) 70 A998), no. 6, 447-454.
MR99d:11091
110. J.-P. Bezivin and V. Laohakosol, On the theorem of Skolem-Mahler-Lech, Exposition. Math.
9 A991), no. 1, 89-96. MR 92c:11140
111. J.-P. Bezivin, A. Petho, and A. J. van der Poorten, A full characterisation of divisibility
sequences, Amer. J. Math. 112 A990), no. 6, 985-1001. MR 91k:11017
112. J.-P. Bezivin and P. Robba, Rational solutions of linear differential equations, J. Austral.
Math. Soc. Ser. A 46 A989), no. 2, 184-196. MR 90c: 12009
113. M. Bicknell-Johnson, A short history of The Fibonacci Quarterly, Fibonacci Quart. 25
A987), no. 1, 2-5.
114. H. Bilharz, Primdivisoren mit vorgegebener Primitivwurzel, Math. Ann. 114 A937), 476-
492.
115. Y. Bilu, Catalan's conjecture (after Mihailescu), Preprint, 2002.
116. Y. Bilu, G. Hanrot, and P. M. Voutier, Existence of primitive divisors of Lucas and Lehmer
numbers, J. Reine Angew. Math. 539 B001), 75-122, With an appendix by M. Mignotte.
MR 2002j: 11027
117. S. R. Blackburn, Fast rational interpolation, Reed-Solomon decoding, and the linear com-
complexity profiles of sequences, IEEE Trans. Inform. Theory 43 A997), no. 2, 537-548. MR
98c:94012
118. , Linear cellular automata as stream cipher components, Preprint, 1997.
119. , Orthogonal sequences of polynomials over arbitrary fields, 3: Number Theory 68
A998), no. 1, 99-111. MR 98m:11013
120. , The linear complexity of the self-shrinking generator, IEEE Trans. Inform. Theory
45 A999), no. 6, 2073-2077. MR 2000f:94025
121. S. R. Blackburn, T. Etzion, and K. G. Paterson, Permutation polynomials, de Bruijn
sequences, and linear complexity, J. Combin. Theory Ser. A 76 A996), no. 1, 55-82. MR
97h:94004
122. R. E. Blahut, Theory and practice of error control codes, Addison-Wesley Publishing Com-
Company Advanced Book Program, Reading, MA, 1983. MR 85f:94001
123. R. Blecksmith, M: Filaseta, and C. Nicol, A result on the digits of an, Acta Arith. 64
A993), no. 4, 331-339. MR 94d:11005
124. D. Bleichenbacher, Efficiency and security of cryptosystems based on number theory, Ph.D.
thesis, Zurich, 1996.
125. D. Bleichenbacher, W. Bosma, and A. K. Lenstra,' Some remarks on Lucas-based cryptosys-
cryptosystems, Advances in cryptology—CRYPTO '95 (Santa Barbara, CA, 1995), Springer, Berlin,
1995, pp. 386-396. MR 97m:94012
126. V. D. Blondel and N. Portier, The presence of a zero in an integer linear recurrent sequence
is NP-hard to decide, Linear Algebra Appl. 351-352 B002), 91-98. MR 1 917 474
127. L. Blum, M. Blum, and M. Shub, A simple unpredictable pseudorandom number generator,
SIAM J. Comput. 15 A986), no. 2, 364-383. MR 87k:65007
128. E. Bombieri, J. Mueller, and M. Poe, The unit equation and the cluster principle, Acta
Arith. 79 A997), no. 4, 361-389. MR 98a: 11037
129. E. Bombieri and A. J. van der Poorten, Continued fractions of algebraic numbers, Compu-
Computational algebra and number theory (Sydney, 1992), Kluwer Acad. Publ., Dordrecht, 1995,
pp. 137-152. MR96g:11079

262 BIBLIOGRAPHY
130. E. Borel, Les probabilites denombrables et leurs applications arithmetiques, Rend. Circ.
Math. Palermo 27 A909), 247-271.
131. A. I. Borevich and I. R. Shafarevich, Number theory, Academic Press, New York, 1966. MR
33 #4001
132. W. Bosma and C. Kraaikamp, Metrical theory for optimal continued fractions, J. Number
Theory 34 A990), no. 3, 251-270. MR 91d:11095
133. , Optimal approximation by continued fractions. J. Austral. Math. Soc. Ser. A 50
A991)r no. 3. 481-504. MR 92f: 11093
134. J. Bourgain. On triples in arithmetic progression, Geom. Funct. Anal. 9 A999), no. 5.
968-984. MR 2001h: 11132
135. R. Bowen and O. E. Lanford, III., Zeta functions of restrictions of the shift transformation,
Global Analysis (Proc. Sympos. Pure Math., Vol. XIV, Berkeley, Calif., 1968), Amer. Math.
Soc, Providence, R.I., 1970, pp. 43-49. MR 42 #6284
136. G. E. P. Box and G. M. Jenkins, Times series analysis. Forecasting and control, Holden-
Day, San Francisco, Calif., 1970. MR 42 #7019
137. J. Boyar, Inferring sequences produced by a linear congruential generator missing low-order
bits, J. Cryptology 1 A989), no. 3, 177-184. MR 90g:94012
138. , Inferring sequences produced by pseudo-random number generators, J. Assoc. Com-
put. Mach. 36 A989), no. 1, 129-141. MR 91g:68035
139. D. W. Boyd. Reciprocal polynomials having small measure, Math. Comp. 35 A980), no. 152.
1361-1377. MR 82a:30005
140. , Speculations concerning the range of Mahler's measure, Canad. Math. Bull. 24
A981), no. 4. 453-469. MR 83h:12002
141. , .Reciprocal polynomials having^ small measure. II, Math. Comp. 53 A989), no. 187.
355-357" S1-S5. MR 89m:30013
142. , Salem numbers of degree four have periodic expansions, The'orie des nombres (Que-
(Quebec, PQ, 1987), de Gruyter, Berlin, 1989, pp. 57-64. MR 90j:11071
143. , Irreducible polynomials, with many roots of maximal modulus. Acta Arith. 68
A994), no. 1. 85-88. MR95i:11119
144. , On beta expansions for Pisot numbers, Math. Comp. 65 A996), no. 214, 841-860.
MR 96g:11090
145. , 'On the beta expansion for Salem numbers of degree 6, Math. Comp. 65 A996).
no. 214, 861-875, S29-531. MR 96g:11091
146. , The beta expansion for Salem numbers, Organic mathematics (Burnaby, BC, 1995).
Amer. Math. Soc, Providence, RI, 1997, pp. 117-131. MR98k:11146
147. , Mahler's measure and special values of L-functions, Experiment. Math. 7 A998).
no. 1, 37-82. MR 99d:11070
148. , Mahler's measure and special values of L-functions—some conjectures, Number
theory in progress, Vol. 1 (Zakopane-Koscielisko, 1997). de Gruyter, Berlin, 1999, pp. 27-34.
MR 2000f:11139
149. , Mahler's measure and invariants of hyperbolic manifolds, Number theory for the
millennium. I (Urbana, IL, 2000), A K Peters, Natick. MA, 2002, pp. 127-143. MR 1 956
222
150. D. W. Boyd. J. Cook, and P. Morton, On sequences of ±l's defined by binary patterns.
Dissertationes Math. (Rozprawy Mat.) 283 A989), 64. MR 91c:11006
151. M. Boyle and D. Handelman, The spectra of nonnegative matrices via symbolic dynamics.
Ann. of Math. B) 133 A991), no. 2, 249-316. MR 92d:58057
152. , Algebraic shift equivalence and primitive matrices, Trans. Amer. Math. Soc. 336
A993), no. 1. 121-149. MR 93e:58050
153. G. Braga, G. Cattaneo, P. Flocchini, and C. Quaranta Vogliotti, Pattern growth in elemen-
elementary cellular automata, Theoret. Comput. Sci. 145 A995), no. 1-2, 1-26. MR 96h:68137
154. B. Branner, The Mandelbrot set, Chaos and fractals (Providence, RI, 1988), Amer. Math.
Soc, Providence, RI, 1989, pp. 75-105. MR 1 010 237
155. J. J. Brennan and B. Geist, Analysis of iterated modular exponentiation: the orbits of
xa mod N. Des. Codes Cryptogr. 13 A998), no. 3, 229-245. MR 99b:11086
156. B. Brent, 3.r + 1 dynamics on rationals with fixed denominator, arXiv:math.DS/0204170.
2002.

BIBLIOGRAPHY 263
157. R. P. Brent, On the-periods of generalized Fibonacci recurrences, Math. Comp. 63 A994),
no. 207, 389-401. MR 94i:11012
158. L. Brenton and R. R. Bruner, On recursive solutions of a unit fraction equation, J. Austral.
Math. Soc. Ser. A 57 A994), no. 3, 341-356. MR 95i:11024
159. J. Brillhart, P. Erdos, and P. Morton, On sums of Rudin-Shapiro coefficients. II, Pacific J.
Math. 107 A983), no. 1, 39-69. MR 85i: 11080
160. B. Brindza, Zeros of polynomials and exponential Diophantine equations, Compositio Math.
61 A987), no. 2, 137-157. MR 88d:11029
161. , On the generators of S-unit groups in algebraic number fields. Bull. Austral. Math.
Soc. 43 A991), no. 2, 325-329. MR 92m:11124
162. B. Brindza, K. Gyory, and R. Tijdeman, On the Catalan equation over algebraic number
fields, J. Reine Angew. Math. 367 A986), 90-102. MR 87g:11041
163. B. Brindza, K. Liptai. and L. Szalay, On products of the terms of linear recurrences. Number
theory (Eger, 1996), de Gruyter, Berlin, 1998, pp. 101-106. MR 99e:11015
164. B. Brindza, A. Pinter, and W. M. Schmidt, Multiplicities of binary recurrences, Canad.
Math. Bull. 44 B001), no. 1, 19-21. MR 2002a:11010
165. S. Brlek, Enumeration of factors in the Thue-Morse word, Discrete Appl. Math. 24 A989).
no. 1-3, 83-96. MR 90i:20071
166. S. Brocco. A note on Mignosi's generalization of the CX + l)-problem. J. Number Theory
52 A995), no. 2, 173-178. MR 96d:11025
167. J. Browkin, The abc-conjecture, Number theory. Birkhauser, Basel, 2000. pp. 75-105. MR
2001f:11053
168. J. Browkin, M. Filaseta, G. Greaves, and A. Schinzel, Squarefree values of polynomials
and the abc-conjecture, Sieve methods, exponential sums, and their applications in number
theory (Cardiff, 1995), Cambridge Univ. Press, Cambridge, 1997, pp. 65-85. MR 99d:11101
169. G. Brown and W. Moran, Schmidt's conjecture on normality for commuting matrices,
Invent. Math. Ill A993), no. 3, 449-463. MR 94c:11064
170. T. C. Brown. D.-Y. Pei, and P. J.-S. Shiue, Irrational sums, Rocky Mountain J. Math. 25
A995), no. 4, 1219-1,223. MR 96m:11055
171. VV. D. Brownawell and D. VV. Masser. Vanishing sums in function fields. Math. Proc.
Cambridge Philos. Soc. 100 A986). no. 3, 427-434. MR 87k:11080
172. T. Brox, Collatz cycles with few descents. Acta Arith. 92 B000). no. 2. 181-188. MR
2001a:11032
173. L. Le Bruyn and M. Van den Bergh. Algebraic properties of linear cellular automata, Linear
Algebra Appl. 157 A991), 217-234. MR 92k:68086
174. Y. Bugeaud, Linear forms in p-adic logarithms and the Diophantine ~ equation
(xn - l)/(x - 1) = j/9. Math. Proc. Cambridge Philos. Soc. 127 A999). no. 3, 373-381.
MR 2000h: 11029
175. , Fundamental systems of S-units with small height and their applications to Dio-
Diophantine equations, Publ. Math. Debrecen 56 B000), no. 3-4, 279-292. Dedicated to Pro-
Professor Kalman Gyory on the occasion of his 60th birthday. MR 2001d:11037
176. , On some exponential Diophantine equations. Monatsh. Math. 132 B001), no. 2,
93-97. MR 2002c: 11026
177. . On the Diophantine equation a(xn - l)/(x - 1) = yq, Number theory (Turku,
1999), de Gruyter, Berlin, 2001, pp. 19-24. MR 2002b: 11042
178. , Linear mod one transformations and the distribution of fractional parts {?(p/q)n},
Preprint, 2002.
179. , Nombres de Liouville et nombres normaux, C. R. Math. Acad. Sci. Paris 335
B002), no. 2, 117-120. MR 2003e:11081
180. Y. Bugeaud, P. Corvaja, and U. Zannier, An upper bound for the G.C.D. of an — 1 and
bn - 1. Math. Z. 243 B003), no. 1, 79-84. MR 1 953 049
181. Y. Bugeaud, G. Hanrot, and M. Mignotte, Sur Vequation diophantienne (xn - l)/(x- 1) =
2/9. ///, Proc. London Math. Soc. C) 84 B002), no. 1, 59-78. MR 2002h: 11027
182. Y. Bugeaud and M. Mignotte, On integers with identical digits, Mivthematika 46 A999),
no. 2, 411-417. MR 2002d:11035
183. . L'equation de Nagell-Ljunggren ^^ = yq, Enseign. Math. B) 48 B002), no. 1-2,
147-168. MR 1 923 422

264 BIBLIOGRAPHY
184. , On the Diophantine equation (xn — l)/(x — 1) = yq with negative x, Number
Theory for the Millennium, Vol.1, A. K. Peters, Natick, MA, 2002, pp. 145-151. MR 1 956
223
185. Y. Bugeaud, M. Mignotte, and Y. Roy, On the Diophantine equation (xn - l)/(x- 1) = yi,
Pacific J. Math. 193 B000), no. 2, 257-268. MR 2001f:11049
186. P. Bundschuh, Irrationalitdtsmafie fur ea, a ^ 0 rational oder Liouville-Zahl, Math. Ann.
192 A971), 229-242. MR 44 #3962
187. D. A. Burgess, On character sums and primitive roots, Proc. London Math. Soc. C) 12
A962), 179-192. MR 24 #A2569
188. D. A. Burgess and P. D. T. A. Elliott, The average of the least primitive root, Mathematika
15 A968), 39-50. MR 38 #5736
189. R. J. Burthe, Jr., The average least witness is 2, Acta Arith. 80 A997), no. 4, 327-341.
MR98h:11118
190. , Upper bounds for least witnesses and generating sets, Acta Arith. 80 A997), no. 4,
311-326. MR 98h:11117
191. R. N. Buttsworth and K. R. Matthews, On some Markov matrices arising from the gener-
generalized Collatz mapping, Acta Arith. 55 A990). no. 1, 43-57. MR 92a: 11016
192. J.-Y. Cai, W. H. Fuchs, D. Kozen, and Z. Liu, Efficient average-case algorithms for the
modular group, 35th Annual Symposium on Foundations of Computer Science (Santa Fe,
NM, 1994), IEEE Comput. Soc. Press, Los Alamitos, CA, 1994, pp. 143-152. MR 1 489
243
193. J.-Y. Cai, R. J. Lipton, and Y. Zalcstein, The complexity of the ABC problem, SIAM J.
Comput. 29 B000), no. 6, 1878-1888. MR 2001f:68045
194.. J.-Y. Cai and Z. Liu, The bounded membership problem of the monoid SL2(N), Math.
Systems Theory 29 A996), no. 6, 573-587. MR 98b:68054
195. E. Cakgak, A.remark on the minimal polynomial of the product of linear recurring se-
sequences, Finite Fields Appl. 4 A998), no. 1, 87-97. MR 99b:11009
196. C. Calude and H. Jiirgensen, Randomness as an invariant for number representations,
Results and trends in theoretical computer science (Graz, 1994), Springer, Berlin, 1994,
pp. 44-66. MR 96f:11100
197. C. Calude, S. Marcus, and I. Tevy, The first example of a recursive function which is not
primitive recursive, Historia Math. 6 A979), no. 4, 380-384. MR 80i:03053
198. R. Canetti, J. B. Friedlander, S. V. Konyagin. M. Larsen, D. Lieman, and I. E. Shparlinski,
On the statistical properties of Diffie-Hellman distributions, Israel J. Math. 120 B000),
23-46. MR 2001k: 11258
199. R. Canetti, J. B. Friedlander, and I. E. Shparlinski, On certain exponential sums and the
distribution of Diffie-Hellman triples, J. London Math. Soc. B) 59 A999), no. 3, 799-812.
MR 2000g: 11079
200. E. R. Canfield and N. C. Wormald, Menage numbers, bijections and P-recursiveness, Dis-
Discrete Math. 63 A987), no. 2-3, 117-129. MR 88d:05007
201. L. Cangelmi and F. Pappalardi, On the r-rank Artin conjecture. II, J. Number Theory 75
A999), no. 1, 120-132. MR 2000i:11149
202. A. Canteaut, P. Charpin, and H. Dobbertin, Binary m-sequences with three-valued cross-
correlation: a proof of Welch's conjecture, IEEE Trans. Inform. Theory 46 B000), no. 1,
4-8. MR2001e:94011
203. D. G. Cantor, On arithmetic properties of coefficients of rational functions, Pacific J. Math.
15 A965). 55-58. MR 31 #1245
204. , On arithmetic properties of the Taylor series of rational functions., Canad. J.
Math. 21 A969), 378-382. MR 39 #422
205. , On arithmetic properties of the Taylor series of rational functions. II, Pacific J.
Math. 41 A972), 329-334. MR 46 #5286
206. , On the continued fractions of quadratic surds, Acta Arith. 68 A994), no. 4, 295-
305. MR 96c: 11079
207. W. Carlip and E. Jacobson, A criterion for stability of two-term recurrence sequences
modulo 2k, Finite Fields Appl. 2 A996), no. 4, 369-406. MR 97h:11012
208. , Unbounded stability of two-term recurrence sequences modulo 2k, Acta Arith. 74
A996), no. 4, 329-346. MR 97b:11021

BIBLIOGRAPHY 265
209. , Stability of two-term recurrence sequences with even parameter, Finite Fields Appl.
3 A997), no. 1, 70-83. MR 98b:11014
210. W. Carlip, E. Jacobson, and L. Somer, A criterion for stability of two-term recurrence
sequences modulo odd primes, Applications of Fibonacci numbers, Vol. 7 (Graz, 1996),
Kluwer Acad. Publ., Dordrecht, 1998, pp. 49-60. MR 1 638 430
211. W. Carlip and L. Somer, Bounds for frequencies of residues of regular second-order re-
recurrences modulo pr, Number theory in progress, Vol. 2 (Zakopane-Koscielisko, 1997), de
Gruyter, Berlin, 1999, pp. 691-719. MR 2000e:11012
212. G. Carter, Enumeration results on linear complexity profiles, Cryptography and coding, II
(Cirencester, 1989), Oxford Univ. Press, New York, 1992, pp. 23-34. MR 93b:94018
213. J. W. S. Cassels, An embedding theorem for fields, Bull. Austral. Math. Soc. 14 A976),
no. 2, 193-198, Addendum: 14 A976), 479-480. MR 54 #10213a
214. , Local fields, Cambridge University Press, Cambridge, 1986. MR 87i:11172
215. L. Cerlienco, M. Mignotte, and F. Piras, Suites recurrentes lineaires: propridtes algebriques
et arithmetiques, Enseign. Math. B) 33 A987), no. 1-2, 67-108. MR 88h:11010
216. U. Cerruti and F. Vaccarino, R-algebras of linear recurrent sequences, J. Algebra 175
A995), no. 1, 332-338. MR 96e:11030
217. J. S. Chahal, Topics in number theory, Plenum Press, New York, 1988. MR 89m:11001
218. M. Chamberland, A continuous extension of the 3x + 1 problem to the real line, Dynam.
Contin. Discrete Impuls. Systems 2 A996), no. 4, 495-509. MR 97m:11028
219. D. G. Champernowne, The construction of decimals normal in the scale often, J. London
Math. Soc. 8 A933), 254-260.
220. A. H. Chan and R. A. Games, On the linear span of binary sequences obtained from finite
geometries, Advances in cryptology—CRYPTO '86 (Santa Barbara, Calif., 1986), Springer,
Berlin, 1987, pp. 405-417. MR 88i:94025
221. A. H. Chan, M. Goresky, and A. Klapper, On the linear complexity of feedback registers,
IEEE Trans. Inform. Theory 36 A990), no. 3, 640-644.
222. Agnes H. Chan and R. A. Games, On the quadratic spans of de Bruijn sequences, IEEE
Trans. Inform. Theory 36 A990), no. 4, 822-829. MR 91i:11014
223. A. Chang, P. Gaal, S. W. Golomb, G. Gong, T. Helleseth, and P. V. Kumar, On a conjec-
conjectured ideal autocorrelation sequence and a related triple-error correcting cyclic code, IEEE
Trans. Inform. Theory 46 B000), no. 2, 680-687. MR 2001d:94035
224. D. X. Charles, A note on the subgroup membership problem for PSLB,p), Electronic Colloq.
on Comp. Compl., Report 2001-0029 B001), 1-6.
225. G. Chasse, Combinatorial cycles of a polynomial map over a commutative field, Discrete
Math. 61 A986), no. 1, 21-26. MR 87k:12001
226. I. Chen, On Siegel's modular curve of level 5 and the class number one problem, J. Number
Theory 74 A999), no. 2, 278-297. MR 2000b: 11065
227. Y.-G. Chen, On integers of the form it2n + 1, Proc. Amer. Math. Soc. 129 B001), no. 2,
355-361. MR 2003a:11004
228. , On integers of the forms k - 2n and k2n + 1, J. Number Theory 89 B001), no. 1,
121-125. MR2002b:ll020
229. J. Cheon and S. Hahn, The orders of the reductions of a point in the Mordell-Weil group
of an elliptic curve, Acta Arith. 88 A999), no. 3, 219-222. MR 2000i:11084
230. B. P. Chisala, Cycles in Collatz sequences, Publ. Math. Debrecen 45 A994), no. 1-2, 35-39.
MR95h:11019
231. V. Chothi, G. R. Everest, and T. Ward, S-integer dynamical systems: periodic points, J.
Reine Angew. Math. 489 A997), 99-132. MR 99b:11089
232. W. S. Chou, On inversive maximal period polynomials over finite fields, Appl. Algebra
Engrg. Comm. Comput. 6 A995), no. 4-5, 245-250. MR 96h:11126
233. W.-S. Chou, The period lengths of inversive congruential recursions, Acta Arith. 73 A995),
no. 4, 325-341. MR 97d:11118
234. W. S. Chou, The period lengths of inversive pseudorandom vector generations, Finite Fields
Appl. 1 A995), no. 1, 126-132. MR 96i: 11087
235. W.-S. Chou and S. D. Cohen, The dynamics of linearized and sublinearized polynomials in
finite fields, Preprint, 2001.
236. W. S. Chou and G. L. Mullen, Generating linear spans over finite fields, Acta Arith. 61
A992), no. 2, 183-191. MR 93d:11125

266 BIBLIOGRAPHY
237. W.-S. Chou and H. Niederreiter, On the lattice test for inversive congruential pseudorandom
numbers, Monte Carlo and quasi-Monte Carlo methods in scientific computing (Las Vegas,
NV, 1994), Springer, New York, 1995, pp. 186-197. MR 97k:65017
238. D. V. Chudnovsky and G. V. Chudnovsky, Sequences of numbers generated by addition in
formal groups and new primality and factorization tests, Adv. in Appl. Math. 7 A986),
no. 4, 385-434. MR 88h: 11094
239. , Computer assisted number theory with applications, Number theory (New York,
1984-1985), Springer, Berlin, 1987, pp. 1-68. MR89a:11130
240. H. Chung and J.-S. No, Linear span of extended sequences and cascaded GMW sequences,
IEEE Trans. Inform. Theory 45 A999), no. 6, 2060-2065. MR 2000h:94024
241. J. Cigler and G. Helmberg, Neuere Entwicklungen der Theorie der Gleichverteilung, Jber.
Deutsch. Math. Verein. 64 A961), no. Abt. 1, 1-50 A961). MR 23 #A2409
242. D. A. Clark and M. Kuwata, Generalized Artin's conjecture for primitive roots and cyclicity
modp of elliptic curves over function fields, Canad. Math. Bull. 38 A995), no. 2, 167-173.
MR96f:11150
243. W. E. Clark and L. W. Lewis, Prime cyclic arithmetic codes and the distribution of power
residues, J. Number Theory 32 A989), no. 2, 220-225. MR 90f:94049
244. F. Clarke, The discrete Fourier transform of a recurrent sequence, Appl. Algebra Engrg.
Comm. Comput. 8 A997), no. 6, 485-489. MR 98g:65133
245. A. Clementi and R. Impagliazzo, The reachability problem for finite cellular automata,
Inform. Process. Lett. 53 A995), no. 1, 27-31. MR 95k:68165
246. C. I. Cobeli, S. M. Gonek, and A. Zaharescu, On the distribution of small powers of a
primitive root, J. Number Theory 88 B001), no. 1, 49-58. MR 2002c:11119
247. C. I. Cobeli and A. Zaharescu, On the distribution of primitive roots modp, Acta Arith.
83 A998), no. 2, 143-153. MR 99a:11110
248. A. Cobham, Uniform tag sequences, Math. Systems Theory 6 A972). 164-192. MR 56
#15230 .
249. G. L. Cohen and H. J. J. te Riele, Iterating the sum-of-divisors function. Experiment. Math.
5 A996), no. 2, 91-100, Erratum: 6 A997), 177. MR97m:11007
250. S. D. Cohen and D. Hachenberger, Actions of linearized polynomials on the algebraic closure
of a finite field, Finite fields: theory, applications, and algorithms (Waterloo, ON, 1997),
Amer. Math. Soc, Providence, RI, 1999, pp. 17-32. MR 2000d:11153
251. . The dynamics of linearized polynomials, Proc. Edinburgh Math, Soc. B) 43 B000),
no. 1, 113-128. MR2001a:11195
252. S. D. Cohen, H. Niederreiter, I, E. Shparlinski, and M. Zieve, Incomplete character sums
and a special class of permutations. J. Theor. Nombres Bordeaux 13 B001), no. 1, 53-63.
MR2002e:lllll
253. P. Collas and D. Klein, An ergodic adding machine on the Cantor set. Enseign. Math. B)
40 A994), no. 3-4, 249-266. MR 96a:58115
254. A. Compagner and A. Hoogland, Maximum-length sequences, cellular automata, and ran-
random numbers, J. Comput. Phys. 71 A987), no. 2, 391-428. MR 89a:65009
255. A. Conflitti and I. E. Shparlinski, On the multidimensional distribution of the subset sum
generator of pseudorandom numbers, Math. Comp. (to appear).
256. J. H. Conway and N. J. A. Sloane, Sphere packings, lattices and groups, third ed., Springer-
Verlag, New York, 1999. MR 2000b:11077
257. D. Coppersmith and J. Davenport. Polynomials whose powers are sparse, Acta Arith. 58
A991), no. 1, 79-87. MR 92h:12001
258. D. Coppersmith, H. Krawczyk, and Y. Mansour, The shrinking generator, Advances in
cryptology—CRYPTO '93 (Santa Barbara, CA, 1993), Springer, Berlin, 1994, pp. 22-39.
MR 95c:94010
259. R. Cordovil, R. Dilao, and A. Noronha da Costa, Periodic orbits for additive cellular au-
automata, Discrete Comput. Geom. 1 A986), no. 3, 277-288. MR 87k:68114
260. I. P. Cornfeld, S. V. Fomin, and Ya. G. Sinai, Ergodic theory, Springer-Verlag, New York,
1982. MR 87f:28019
261. C. Corrales-Rodrigafiez and R. Schoof, The support problem and its elliptic analogue, J.
Number Theory 64 A997), no. 2, 276-290. MR 98c:11049
262. P. Corvaja and U. Zannier, Diophantine equations with power sums and universal Hilbert
sets, Indag. Math. (N.S.) 9 A998), no. 3, 317-332. MR 2000j:11045

BIBLIOGRAPHY 267
263. , Finiteness of integral values for the ratio of two linear recurrences., Invent, Math.
149 B002), no. 2, 431-451. MR 1 918 678
264. , Some new applications of the subspace theorem, Compositio Math. 131 B002),
319-340. MR2003e:11076
265. , On the greatest prime factor of (ab + l)(ac + 1), Proc. Amer. Math. Soc. 131
B003), no. 6, 1705-1709 (electronic). MR 1 955 256
266. R. Couture and P. L'Ecuyer, On the lattice structure of certain linear congruential se-
sequences related to AWC/SWB generators, Math. Comp. 62 A994), no. 206, 799-808. MR
94g:65007
267. R. Crandall and C. Pomerance, Prime numbers: A computational perspective, Springer-
Verlag, New York, 2001. MR 2002a: 11007
268. R. Crocker. On the sum of a prime and of two powers of two, Pacific J. Math. 36 A971),
103-107. MR 43 #3200
269. J. Cullen. Question 15897, Educational Times (December, 1905), 534.
270. A. J. C. Cunningham and H.J. Woodall, Factorisation of Q = 2q ± q and q • 2q ± 1, Math.
Mag. 47 A917), 1-38.
271. T. W. Cusick, Properties of the x'2 mod N pseudorandom number generator. IEEE Trans.
Inform. Theory 41 A995), no. 4, 1155-1159. MR 96k:65006
272. T. W. Cusick, C. Ding, and Ari Renvall. Stream ciphers and number theory. North-Holland
Publishing Co., Amsterdam, 1998. MR 99h:94045
273. T. W. Cusick and H. Dobbertin, Some new three-valued crosscorrelation functions for bi-
binary m-sequences, IEEE Trans. Inform. Theory 42 A996), no. 4, 1238-1240. MR 98c:94013
274. T. W. Cusick and G. Gong, A conjecture on binary sequences with the "trinomial property",
IEEE Trans. Inform. Theory 47 B001), no. 1. 426-427. MR 2001k:94039
275. Z. D. Dai, Binary sequences derived from ML-sequences over rings. I. Periods and minimal
polynoviials. J. Cryptology 5 A992), no. 3. 193-207. MR 93g:68030
276. Z. D. Dai, T. Beth, and D. Gollmann, Lower bounds for the linear complexity of sequences
over residue rings, Advances in cryptology—EUROCRYPT '90 (Aarhus, 1990), Springer,
Berlin, 1991, pp. 189-195.
277. Z. D. Dai. X. N. Feng. M. L. Liu, and Z. X. Wan, Nonlinear feedforward sequences of
m-sequences. Ill, Systems Sci. Math. Sci. 7 A994), no. 4, 367-370. MR 95m:94004
278. K. Dajani and C» Kraaikamp, A Gauss-Kusmin theorem for optimal continued fractions,
Trans. Amer. Math. Soc. 351 A999), no. 5. 2055-2079. MR 99h:11089
279. "The mother of all continued fractions''', Colloq. Math. 84/85 B000), no. , part
1, 109-123. Dedicated to the memory of Anzelm Iwanik. MR 2001h:11100
280. Ergodic theory of numbers, Cams Mathematical Monographs, vol. 29. Mathemat-
Mathematical Association of America, Washington. DC, 2002. MR 2003f:37014
281. H. Davenport, Linear forms associated with an algebriac number-field, Quart. J. Math.,
Oxford Ser. B) 3 A952), 32-41. MR 13,918c
282. , Bases for finite fields, J. London Math. Soc. 43 A968), 21-39, Addendum: 44
A969). 378. MR 37 #2729
283. A. M. Decaillot, L'arithmeticien Edouard Lucas A842-1891): theorie et instrumentation,
Rev. Histoire Math. 4 A998), no. 2, 191-236. MR 2000i:01024
284. F. M. Dekking, Iteration of maps by an automaton, Discrete Math. 126 A994), no. 1-3,
81-86. MR 95d:11031
285. F. M. Dekking, M. Mendes France, and A. J. van der Poorten, Folds! 1-3, Math. Intell. 4
A982). 130-138, 173-181, 190-195.
286. P. Deligne. La conjecture de Weil. I, Inst. Hautes Etudes Sci. Publ. Math. 43 A974),
273-307. MR 49 #5013
287. J. Denef. The rationality of the Poincare series associated to the p-adic points on a variety,
Invent. Math. 77 A984), no. 1, 1-23. MR 86c:11043
288. J. Denef and L. Lipshitz, Algebraic power series and diagonals. J. Number Theory 26
A987). no. 1, 46-67. MR 88f:16002
289. J. Denef, L. Lipshitz, T. Pheidas, and J. Van Geel (eds.), Hubert's tenth problem: relations
with arithmetic and algebraic geometry, Contemporary Mathematics, vol. 270, American
Mathematical Society, Providence, RI, 2000. Papers from the workshop held at Ghent
University, Ghent, November 2-5, 1999. MR 2001g:00018

268 BIBLIOGRAPHY
290. C. Deninger, Deligne periods of mixed motives, K-theory and the entropy of certain In-
Inactions, J. Amer. Math. Soc. 10 A997). no. 2, 259-281. MR 97k:11101
291. L. Denis, Geometric et suites recurrentes, Bull. Soc. Math. Prance 122 A994), no. 1, 13-27.
MR 95b:11065
292. , Points periodiques des automorphismes affines, J. Reine Angew. Math. 467 A995),
157-167. MR 96m:14018
293. R. Devaney, The fractal geometry of the Mandelbrot set, math.bu.edu/DYSYS/FRACGEOM/.
294. A. Diab, Sur les zeros communs des polynomes exponentiels, C. R. Acad. Sci. Paris Ser.
A-B 281 A975), no. 18, Ai, A757-A758. MR 52 #11012
295. , Une remarque sur les polynomes exponentiels, C. R. Acad. Sci. Paris Ser. A-B 280
A975), Ai, A759-A761. MR 51 #3408
296. C. Ding, Linear complexity of generalized cyclotomic binary sequences of order 2, Finite
Fields Appl. 3 A997), no. 2, 159-174. MR 99a:11017
297. , Autocorrelation values of generalized cyclotomic sequences of order two, IEEE
Trans. Inform. Theory 44 A998), no. 4. 1699-1702. MR 99h:94042
298. , Linear complexity of some generalized cyclotomic sequences, Internat. J. Algebra
Comput. 8 A998), no. 4, 431-442. MR 99k:11026
299. , Pattern distributions of Legendre sequences, IEEE Trans. Inform. Theory 44
A998), no. 4, 1693-1698. MR 2000a:94011
300. C. Ding and T. Helleseth, On cyclotomic generator of order r, Inform. Process. Lett. 66
A998), no. 1, 21-25. MR 99c:94029
301. C. Ding, T. Helleseth, and H. Martinsen, New families of binary sequences with optimal
three-level autocorrelation, IEEE Trans. Inform. Theory 47 B001), no. 1, 428-433. MR
2003b:94033
302. C. Ding, T. Helleseth, and W. Shan, On the linear complexity of Legendre sequences, IEEE
Trans. Inform. Theory 44 A998), no. 3. 1276-1278. MR 99d:94017
.303. H. Dobbertin, T. Helleseth, P. V.F Kumar, and H. Martinsen, Ternary m-sequences with
three-valued cross-correlation function: new decimations of Welch and Niho type, IEEE
Trans. Inform. Theory 47 B001), no. 4. 1473-1481. MR 2002f:94028
304. E. Dobrowolski, On a question of Lehvier and the number of irreducible factors of a poly-
polynomial, Acta Arith. 34 A979), no. 4, 391-401. MR 80i:10040
305. E. Dobrowolski and K. S. Williams, An upper bound for the sum X^nia+i /(n) for a certain
class of functions f, Proc. Amer. Math. Soc. 114 A992), no. 1, 29-35. MR 92c:11086
306. A. Dress and F. Luca, A characterization of certain binary recurrence sequences, Algebraic
combinatorics and applications (GoCweinstein, 1999), Springer, Berlin, 2001, pp. 89-101.
MR 2002e:11011
307. , Real numbers that have good Diophantine approximations of the form rn+i/rn,
Acta Acad. Paedagog. Agriensis Sect. Mat. (N.S.) 28 B001), 13-19. MR 2002j:11071
308. , Unbounded integer sequences (An)n>0 with An+iAn-i — A\ bounded are of Fi-
Fibonacci type. Algebraic combinatorics and applications (GoCweinstein, 1999), Springer,
Berlin, 2001. pp. 102-109. MR 2002e:11012
309. M. Drmota. The distribution of patterns in digital expansions, Algebraic number theory and
Diophantine analysis (Graz, 1998), de Gruyter, Berlin, 2000, pp. 103-121. MR 2001f:11124
310. M. Drmota and J. Gajdosik, The distribution of the sum-of-digits function, J. Theor. Nom-
bres Bordeaux 10 A998), no. 1, 17-32. MR 2002e:11095
311. M. Drmota and G. Larcher, The suvi-of-digits-function and uniform distribution modulo
1, J. Number Theory 89 B001), no. 1. 65-96. MR 2002e:11094
312. H. Dubner and W. Keller, New Fibonacci and Lucas primes, Math. Comp. 68 A999),
" no. 225, 417-427, S1-S12. MR 99c:11008
313. A. Dujella and R. F. Tichy, Diophantine equations for second-order recursive sequences of
polynomials, Q. J. Math. 52 B001), no. 2, 161-169. MR 2002d:11030
314. J.-M. Dumont, P. J. Grabner, and A. Thomas, Distribution of the digits in the expansions
of rational integers in algebraic bases, Acta Sci. Math. (Szeged) 65 A999), no. 3-4, 469-492.
MR2001f:11132
315. J.-M. Dumont and A. Thomas, Modifications de nombres normaux par des transducteurs,
Acta Arith. 68 A994), no. 2, 153-170. MR 96c:11086
316. B. Durand, A random NP-complete problem for inversion of 2D cellular automata, Theoret.
Comput. Sci. 148 A995), no. 1, 19-32. MR 96g:68086

BIBLIOGRAPHY 269
317. D. Duverney, Sur I'irrationalite de ?+~ rn/(qn - r), C. R. Acad. Sci. Paris Ser. I Math.
320 A995), no. 1, 1-4. MR 95m:11075
318. D. Duverney, T. Kanoko, and T. Tanaka, Transcendence of certain reciprocal sums of linear
recurrences, Monatsh. Math. 137 B002), no. 2, 115-128. MR 1 937 623
319. R. Dvornicich and U. Zannier,. On sums of roots of unity, Monatsh. Math.. 129 B000),
no. 2, 97-108. MR 2001f:11183
320. B. M. Dwork, On the rationality of the zeta function of an algebraic variety, Amer. J.
Math. 82 A960), 631-648. MR 25 #3914
321. B. M. Dwork and A. J. van der Poorten, The Eisenstein constant, Duke Math. J. 65 A992),
no. 1,23-43. MR 93c:12010 " " .
322. S. Egami, The distribution of residue Classes modulo a in an algebraic number field,
Tsukuba J. Math. 4 A980), no. 1, 9-13. MR 82d:10070
323. , Average version of Artin's conjecture in an algebraic number field, Tokyo J. Math.
4 A981), no. 1, 203-212. MR 83b:12015
324. J. Eichenauer-Herrmann, Improved lower bounds for the discrepancy of inversive congru-
ential pseudorandom numbers, Math. Comp. 62 A994), no. 206, 783-786. MR 94g:11058
325. , On generalized inversive congruential pseudorandom numbers. Math. Comp. 63
A994). no. 207, 293-299. MR 94k:11088
326. J. Eichenauer-Herrmann and F. Emmerich, Compound inversive congruential pseudoran-
pseudorandom numbers: an average-case analysis, Math. Comp. 65 A996), no. 213, 215-225. MR
96i:65005
327. J. Eichenauer-Herrmann, F. Emmerich, and G. Larcher, Average discrepancy, hyper-planes,
and compound pseudorandom numbers, Finite Fields Appl. 3 A997), no. 3, 203-218. MR
98j: 11059
328. J. Eichenauer-Herrmann, E. Herrmann, and S. Wegenkittl, A survey of quadratic and in-
inversive congruential pseudorandom numbers', Monte Carlo and quasi-Monte Carlo methods
1996 (Salzburg), Springer, New York, 1998, pp. 66-97. MR 99d:11085
329. J. Eichenauer-Herrmann and G. Larcher, Average behaviour of compound nonlinear congru-
congruential pseudorandom numbers, Finite Fields Appl. 2 A996), no. 1, 111-123. MR 97b:11103
330. J. Eichenauer-Herrmann and H. Niederreiter, An improved upper bound for the discrepancy
of quadratic congruential pseudorandom numbers, Acta Arith. 69 A995), no. 2, 193-198.
MR 95k:llO99
331. J. Eichenauer-Herrmann and A. Topuzoglu, On the period length of congruential pseudo-
pseudorandom number sequences generated by inversions, J. Comput. Appl. Math. 31 A990),
no. 1, 87-96. MR 92e:65008
332. M. Einsiedler, G. R. Everest, and T. Ward, Primes in sequences associated to polynomials
(after Lehmer), LMS J. Comput. Math. 3 B000), 125-139. MR 2002a:11017
333. , Morphic heights and periodic points, New York Number Theory Seminar B001),
arXiv: math. NT/0204179.
334. Primes in elliptic divisibility sequences, LMS J. Comput. Math. 4 B001), 1-15.
MR 2002e:11181
335. M. Einsiedler and T. Ward, Asymptotic geometry of non-mixing shapes, Ergodic Theory
Dynam. Systems 23 B003), 75-85.
336. E. El Mahassni, P. Q. Nguyen, and I. E. Shparlinski, The insecurity of Nyberg-Rueppel and
other DSA-like signature schemes with partially known nonces, Cryptography and lattices
(Providence, RI, 2001), Lecture Notes in Comput. Sci., vol. 2146, Springer, Berlin, 2001,
pp. 97-109. MR 2003e:94066
337. E. El Mahassni and I. E. Shparlinski, On the uniformity of distribution of congruential
generators over elliptic curves, Sequences and their applications (Bergen, 2001), Springer,
Berlin, 2002, pp. 257-264. MR 2003e:94055
338. S. Eliahou, The 3x + 1 problem: new lower bounds on nontrivial cycle lengths, Discrete
Math. 118 A993), no. 1-3, 45-56. MR 94h:11017
339. N. Elkies, Non-torsion points of low height on elliptic curves,
www.math, harvard. %du/~elkies/low_height .html.
340. , On finite sequences satisfying linear recursions, New York J. Math. 8 B002),
85-97. MR 20O3e:15O29
341. N. Elkies, G. Kuperberg, M. Larsen, and J. Propp. Alternating-sign matrices and domino
tilings. I, J. Algebraic Combin. 1 A992), no. 2, 111-132. MR 94f:52035

270 BIBLIOGRAPHY
342. , Alternating-sign matrices and domino tilings. II, J. Algebraic Combin. 1 A992).
no. 3, 219-234. MR 94f:52036
343. P. D. T. A. Elliott and L. Murata, On the average of the least primitive root modulo p, J.
London Math. Soc. B) 56 A997), no. 3, 435-454. MR 98m:11094
344. F. Emmerich, Pseudorandom vector generation by the compound inversive method, Math.
Comp. 65 A996), no. 214, 749-760. MR 96m:11064
345. . Equidistribution properties of compound inversive pseudorandom vectors, Finite
Fields Appl. 4 A998), no. 1, 16-28. MR 99b:11087
346. J. W. England, The zeta function of toral endomorphisms, Proc. Amer. Math. Soc. 34
A972), 321-322. MR 45 #3431
347. J. W. England and R. L. Smith, The zeta function of automorphisms of solenoid groups,
J. Math. Anal. Appl. 39 A972), 112-121. MR 46 #6400
348. D. Erdmann and S. Murphy, An approximate distribution for the maximum order complex-
complexity, Des. Codes Cryptogr. 10 A997), no. 3, 325-339. MR 97k:94027
349. P. Erdos, On the sum ?d|2"-i d'1, Israel J. Math. 9 A971), 43-48. MR 42 #4508
350. P. Erdos. A. Granville, C. Pomerance, and C. Spiro, On the normal behavior of the iterates
of some arithmetic functions, Analytic number theory (Allerton Park, IL, 1989), Birkhauser
Boston, Boston, MA, 1990, pp. 165-204. MR92a:11113
351. P. Erdos, P. Kiss, and C. Pomerance, On prime divisors of Mersenne numbers, Acta Arith.
57 A991), no. 3, 267-281. MR 92d:11104
352. P. Erdos. P. Kiss, and A. Sarkozy, A lower bound for the counting function of Lucas
pseudoprimes, Math. Comp. 51 A988), no. 183, 315-323. MR 89e:11011
353. P. Erdos and K. Mahler, Some arithmetical properties of the convergents of a continued
fraction. J. London Math. Soc. 14 A939). 12-18.
354. P. Erdos and M. Ram Murty, On the order of a (mod p), Number theory (Ottawa, ON,
1996). Amer. Math. Soc, Providence, RI, 1999, pp. 87-97. MR 2000c:11152
355. P. Erdos and A. M. Odlyzko, On the density of odd integers of the form (p — 1J""" and
related questions, J. Number Theory-11 A979), no. 2, 257-263. MR 80i:10077
356. P. Erdos and T. N. Shorey, On the greatest prime factor of 2P — 1 for a prime p and other
expressions, Acta Arith. 30 A976), no. 3. 257-265. MR 54 #7402
357. P. Erdos. C. L. Stewart, and R. Tijdeman. Some Diophantine equations with many solu-
solutions, Compositio Math. 66 A988), no. 1, 37-56. MR 89j:11027
358. A. Eremenko and L. A. Rubel, On the zero sets of certain entire functions, Proc. Amer.
Math. Soc. 124 A996), no. 8, 2401-2404. MR 96j:30045
359. G. R. Everest, A "Hardy-Littlewood" approach to the S-unit equation, Compositio Math.
70 A989), no. 2, 101-118. MR 90g:11124
360. ¦ p-primary parts of unit traces and the p-adic regulator, Acta Arith. 62 A992),
no. 1, 11-23. MR93i:11134
361. An asymptotic formula implied by the Leopoldt conjecture, Quart. J. Math. Oxford
Ser. B) 45 A994), no. 177, 19-28. MR 95b:11103
362. The mean value of a sum of S-units, J. London Math. Soc. B) 51 A995), no. 3,
417-428. MR96h:11022
363. Mean values of algebraic linear forms, Proc. London Math. Soc. C) 70 A995),
no. 3, 529-555. MR 96b: 11096
364. On the p-adic integral of an exponential polynomial, Bull. London Math. Soc. 27
A995). no. 4, 334-340. MR 96c:11137
365. G. R. Everest and J. H. Loxton, Counting algebraic units with bounded height, J. Number
Theory 44 A993), no. 2, 222-227. MR 94g:11105
366. G. R. Everest and A. J. van der Poorten, Factorisation in the ring of exponential polyno-
polynomials, Proc. Amer. Math. Soc. 125 A997), no. 5, 1293-1298. MR 97h:16038
367. G. R. Everest, A. J. van der Poorten, Y. Puri, and T. Ward, Integer sequences and periodic
points, J. Integer Seq. 5 B002), no. 2, Article 02.2.3, 10 pp. MR 1 938 222
368. G. R. Everest, P. Rogers, and T. Ward, A higher rank Mersenne problem, ANTS V Springer
Lecture Notes in Computer Science 2369 B002), 95-107.
369. G. R. Everest and I. E. Shparlinski, Divisor sums of generalised exponential polynomials,
Canad. Math. Bull. 39 A996), no. 1, 35-46. MR 97g:11021
370. , Counting the values taken by algebraic exponential polynomials, Proc. Amer. Math.
Soc. 127 A999), no. 3, 665-675. MR 99f:11042

BIBLIOGRAPHY 271
371. , Zsigmondy's theorem for elliptic curves, Preprint, 2002.
372. G. R. Everest and N. Stephens, Primes generated by elliptic curves. Preprint. 2002.
373. G. R. Everest and T. Ward, Heights of polynomials and entropy in algebraic dynamics,
Springer-Verlag London Ltd., London, 1999. MR 2000e:11087
374. , The canonical height of an algebraic point on an elliptic curve, New York J. Math.
6 B000), 331-342. MR 2001J.-11056
375. J.-H. Evertse, On equations in S-units and the Thue-Mahler equation, Invent. Math. 75
A984), no. 3, 561-584. MR 85f:11048
376. , On sums of S-units and linear recurrences, Compositio Math. 53 A984), no. 2,
225-244. MR'86c: 11045
377. , The number of solutions of linear equations in roots of unity, Acta Arith. 89
A999), no. 1, 45-51. MR 2000e:11033
378. J.-H. Evertse. K. Gyory, C. L. Stewart, and R. Tijdeman, S-unit equations and their ap-
applications, New advances in transcendence theory (Durham, 1986). Cambridge Univ. Press,
Cambridge, 1988, pp. 110-174. MR 89J-.11028
379. J.-H. Evertse, P. Moree, C. L. Stewart, and R. Tijdeman, Multivariate Diophantine equa-
equations yjith many solutions, Acta Arith. 107 B003), no. 1, 103-125.
380. J.-H. Evertse and H. P. Schlickewei, The absolute subspace theorem and linear equations
with unknowns from a multiplicative group, Number theory in progress, Vol. 1 (Zakopane-
Koscielisko. 1997), de Gruyter, Berlin, 1999, pp. 121-142. MR 2000d:11094
381. , A quantitative, version of the absolute subspace theorem, J. Reine Angew. Math.
548 B002). 21-127. MR 1 915 209
382. J.-H. Evertse, H. P. Schlickewei, and W. M. Schmidt, Linear equations in variables which
lie in a multiplicative group, Ann. of Math. B) 155 B002), no. 3, 807-836. MR 1 923 966
383. F. Fabris, Periods distribution in the linear feedback generalized registers, J. Inform. Optim.
Sci. 16 A995), no. 1, 61-82. MR 96c:94003
384. J. FabrykowskL On quadratic residues and nonresidues in difference sets modulo m, Proc.
Amer. Math. Soc. 122 A994), no. 2, 325-331. MR 95a: 11003
385. G. Faltings. Diophantine approximation on abelian varieties, Ann. of Math. B) 133 A991),
no. 3. 549-576. MR 93d:11066
386. G. Faltings and G. Wiistholz, Diophantine approximations on protective spaces, Invent.
Math. 116 A.994), no. 1-3, 109-138. MR95g:11068
387. W. Feit, On large Zsigmondy primes, Proc. Amer. Math. Soc. 102 A988). no. 1, 29-36.
MR89b:11009
388. R. G. Ferretti, An estimate for the multiplicity of binary recurrences. C. R. Acad. Sci. Paris
Ser. I Math. 325 A997), no. 11, 1143-1148. MR 99f:11086
389. M. Filaseta and S. Konyagin. On a limit point associated with the abc-conjecture, Colloq.
Math. 76 A998), no. 2, 265-268. MR 99b:11029
390. P. Fitzpatrick and S. M. Jennings, Comparison of two algorithms for decoding alternant
codes. Appl. Algebra Engrg. Comm. Comput. 9 A998), no. 3, 211-220. MR 99h:94069
391. P. Fitzpatrick and G. H. Norton, The Berlekamp-Massey algorithm and linear recurring
sequences over a factorial domain, Appl. Algebra Engrg. Comm. Comput. 6 A995), no. 4-5,
309-323. MR 96j:94015
392. M. Flahive and H. Niederreiter, On inversive congruential generators for pseudorandom
numbers, Finite fields, coding theory, and advances in communications and computing (Las
Vegas, NV, 1991), Dekker, New York, 1993, pp. 75-80. MR 94a:11117
393. P. Flajolet, P. J. Grabner, P. Kirschenhofer, H. Prodinger, and R. F. Tichy, Mellin trans-
transforms and asymptotics: digital sums, Theoret. Comput. Sci. 123 A994). no. 2, 291-314.
MR94m:11090 ;
394. A. Flammeiikamp and F. Luca, Binomial coefficients and Lucas sequences, J. Number
Theory 93 B002), no. 2, 246-284. MR 2003d: 11047
395. L. Flatto, Z-numbers and f3-transformations, Symbolic dynamics and its applications (New
Haven, CT, 1991), Amer. Math. Soc, Providence, RI, 1992, pp. 181-201. MR 94c:11065
396. L. Flatto, J. C. Lagarias, and A. D. Pollington, On the range of fractional parts {?(p/q)n},
Acta Arith. 70 A995), no. 2, 125-147. MR 96a:11073
397. L. Flatto, J. C. Lagarias, and B. Poonen, The zeta function of the beta transformation,
Ergodic Theory Dynam. Systems 14 A994), no. 2, 237-266. MR 95c:58141

272 BIBLIOGRAPHY
398. M. Fletcher and G. C. Smith, Chaos, elliptic curves and all that, Applications of Fibonacci
numbers, Vol. 5 (St. Andrews, 1992), Kluwer Acad. Publ., Dordrecht, 1993, pp. 245-256.
MR 95a: 11055
399. E. V. Flynn, B. Poonen, and E. F. Schaefer, Cycles of quadratic polynomials and rational
points on a genus-2 curve, Duke Math. J. 90 A997), no. 3, 435-463. MR 98j:11048
400. N. P. Fogg, Substitutions in dynamics, arithmetics and combinatorics, Lecture Notes in
Mathematics, vol. 1794, Springer, Berlin, 2002.
401. W. Forman and H. N. Shapiro, An arithmetic property of certain rational powers, Comm.
Pure Appl. Math. 20 A967), 561-573. MR 35 #2852
402. A. S. Fraenkel, Iterated floor function, algebraic numbers, discrete chaos, Beatty subse-
subsequences, semigroups, Trans. Amer. Math. Soc. 341 A994), no. 2, 639-664. MR 94d.-11011
403. Z. Franco and C. Pomerance, On a conjecture of Crandall concerning the qx + 1 problem,
Math. Comp. 64 A995), no. 211, 1333-1336. MR 95j:11019
404. J. N. Franklin, Deterministic simulation of random processes, Math. Comp. 17 A963),
28-59. MR 26 #7125
405. , Equidistribution of matrix-power residues modulo one, Math. Comp. 18 A964),
560-568. MR 30 #3077
406. J. B. Friedlander, J. Hansen, and I. E. Shparlinski, Character sums with exponential func-
functions, Mathematika 47 B000), no. 1-2, 75-85 B002). MR 1 924 489
407. , On the distribution of the power generator modulo a prime power, Preprint, 2001.
408. J. B. Friedlander, S. Konyagin, and I. E. Shparlinski, Some doubly exponential sums over
Zm, Acta Arith. 105 B002), no. 4, 349-370. MR 1 932 568
409. J. B. Friedlander, M. Larsen, D. Lieman, and I. E. Shparlinski, On' the correlation of binary
M-sequences, Des. Codes Cryptogr. 16 A999), no. 3, 249-256. MR 2000g:94024
410. J. B. Friedlander, D. Lieman, and I. E. Shparlinski, On the distribution of the RSA gener-
generator, Sequences and their applications (Singapore, 1998), Springer, London, 1999, pp. 205-
212. MR 2002f:11108
411. J. B. Friedlander, C. Pomerance, and I. E. Shparlinski, Period of the power generator and
small values of Carmichael's function, Math. Comp. 70 B001), no. 236, 1591-1605. MR
2002g:11112
412. J. B. Friedlander and I. E. Shparlinski, Double exponential sums over thin sets, Proc. Amer.
Math. Soc. 129 B001), no. 6, 1617-1621. MR 2001m:11137
413. , On the distribution of Diffie-Hellman triples with sparse exponents, SIAM J. Dis-
Discrete Math. 14 B001), no. 2, 162-169. MR 2003a:94036
414. , On the distribution of the power generator, Math. Comp. 70 B001), no. 236,
1575-1589. MR2002f:11107
415. A. M. Frieze, J. Hastad, R. Kannan, J. C. Lagarias, and A. Shamir, Reconstructing truncated
integer variables satisfying linear congruences, SIAM J. Comput. 17 A988), no. 2, 262-280.
MR89d:11115
416. C. Frougny, Representations of numbers and finite automata, Math. Systems Theory 25
A992), no. 1, 37-60. MR 93b:68054
417. , On multiplicatively dependent linear numeration systems, and periodic points,
Theor. Inform. Appl. 36 B002), no. 3, 293-314. MR 1 958 245
418. C. Fuchs, An upper bound for the G.C.D. of two linear recurring sequences, Math. Slovaca
(to appear).
419. C. Fuchs and R. F. Tichy, Perfect powers in linear recurring sequences, Acta Arith. 107
B003), 9-25. MR 1 956 982
420. A. Fuster-Sabater and P. Caballero-Gil, On the linear complexity of nonlinearly filtered
PN-sequences, Advances in cryptology—ASIACRYPT '94 (Wollongong, 1994), Springer,
Berlin, 1995, pp. 80-90.
' 421. D. Gale, Somos sequence update, Mathematical Intelligencer 13 A991), no. 4, 49-50.
422. , The strange and surprising saga of the Somos sequences, Mathematical Intelli-
Intelligencer 13 A991), no. 1, 40-42.
423. S. Gao, J. von zur Gathen, and D. Panario, Gauss periods: orders and cryptographical
applications, Math. Comp. 67 A998), no. 221, 343-352. MR 98c:11134
424. A. Garcia and J. F. Voloch, Fermat curves over finite fields, J. Number Theory 30 A988),
no. 3, 345-356. MR 90a: 14027

BIBLIOGRAPHY 273
425. M. V. P. Garcia and F. A. Tal, A note on the generalized,3n + 1 problevi, Acta Arith. 90
A999), no. 3, 245-250. MR 2000i:11019
426. J. von zur Gathen, A. Knopfmacher, F. Luca, L. G. Lucht, and I. E. Shparlinski, Average
order in cyclic groups, J. Theor. Nombres Bordeaux (to appear).
427. J. von zur Gathen and F. Pappalardi, Density estimates related to Gauss periods, Proc.
Workshop on Cryptography and Computational Number Theory (CCNT'99), Singapore
(K.-Y. Lam, I. E. Shparlinski, H. Wang, and C. Xing, eds.), Birkhauser, 2001, pp. 33-41.
428. J. von zur Gathen and I. E. Shparlinski, Orders of Gauss periods in finite fields, Appl.
Algebra Engrg. Comm. Comput. 9 A998), no. 1, 15-24. MR 99j:11142
429. , Constructing elements of large order in finite fields, Applied algebra, algebraic
algorithms and error-correcting codes (Honolulu, HI, 1999), Springer, Berlin, 1999, pp. 404-
409. MR 2002g:12001
430. , Gaufi periods in finite fields. Finite fields and applications (Augsburg, 1999).
Springer, Berlin, 2001, pp. 162-177. MR 2002h:11132
431. G. Ge, Recognizing units in number fields, Math. Comp. 63 A994), no. 207, 377-387. MR
94i:11107
432. A. O. Gelfond, Sur les divisere premiers de valeurs de la fonction exponentielle, Proc. Phys.
Math. Inst. Acad. Sci. USSR 5 A934).
433. A. Ghosh, The distribution ofap'2 modulo 1, Proc. London Math. Soc. C) 42 A981), no. 2,
252-269. MR 82j: 10067
434. K. Girstmair, On the cosets of the Iq-power group in the unit group modulo p, Abh. Math.
Sem. Univ. Hamburg 62 A992), 217-232. MR 94a:11165
435. , The digits ofl/p in connection with class number factors, Acta Arith. 67 A994),
no. 4, 381-386. MR 96g:11134
436. , Class number factors and distribution of residues, Abh. Math. Sem. Univ. Hamburg
67 A997), 65-104. MR 99e:11141
437. J. P. Glass, J. H. Loxton, and A. J. van der Poorten, Identifying a rational function, C. R.
Math. Rep. Acad. Sci. Canada 3 A981)r no. 5, 279-284. MR 82m:10018
438. D. Gluck and B. D. Taylor, A new statistic for the 3x +1 problem, Proc. Amer. Math. Soc.
130 B002), no. 5, 1293-1301. MR 2002k:11031
439. J. Dj. Golic. On the linear complexity of functions of periodic GF(<?) sequences, IEEE Trans.
Inform. Theory 35 A989), no. 1, 69-75. MR 90e:94022
440. S. W. Golomb and G. Gong, Periodic binary sequences with the "trinomial property", IEEE
Trans. Inform. Theory 45 A999), no. 4. 1276-1279. MR 2000g:94026
441. S. W. Golomb, G. Gong, and Z. D. Dai, Cyclic inequivalence of cascaded GMW-sequences,
Discrete Math. 219 B000), no. 1-3, 279-285. MR 2001i:94046
442. G. Gong, Theory and applications of q-ary interleaved sequences, IEEE Trans. Inform.
Theory 41 A995), no. 2, 400-411. MR 96b:94008
443. , On q-ary cascaded GMW sequences, IEEE Trans. Inform. Theory 42 A996), 263-
267.
444. , New designs for signal sets with low cross-correlation, balance property and large
linear span: GF(p) case, Faculty of Math.. Univ. Waterloo, Research Report CORR 2000-32
B000).
445. G. Gong, T. A. Berson, and D. R. Stinson, Elliptic curve pseudorandom sequence genera-
generators, Selected areas in cryptography (Kingston, ON, 1999), Springer, Berlin, 2000, pp. 34-
48. MR 2001j:94032
446. G. Gong, Z. D. Dai, and S. W. Golomb, Enumeration and criteria for cyclically shift-
distinct GMW sequences, IEEE Trans. Inform. Theory 46 B000), no. 2r 474-484. MR
2001h:94019
447. G. Gong and S. W. Golomb, Binary sequences with two-level autocorrelation, IEEE Trans.
Inform. Theory 45 A999), no. 2, 692-693. MR 99j:94032
448. G. Gong and C. C. Y. Lam, Linear recursive sequences over elliptic curves, Sequences and
their applications (Bergen, 2001), Springer, Berlin, 2002, pp. 182-196.
449. M. I. Gonzalez Vasco, M. Naslund, and I. E. Shparlinski, The hidden number problem in
extension fields and its applications, Lect. Notes in Comp. Sci. 2286 B002).
450. M. I. Gonzalez Vasco and I. E. Shparlinski, On the security of Diffie-Hellman bits, Proc.
Workshop on Cryptography and Computational Number Theory (CCNT'99), Singapore
(K.-Y. Lam. I. E. Shparlinski, H. Wang, and C. Xing, eds.), Birkhauser, 2001, pp. 257-268.

274 BIBLIOGRAPHY
451. , Security of the most significant bits of the Shamir message passing scheme, Math.
Comp. 71 B002). no. 237, 333-342. MR 2002j:11153
452. D. M. Gordon, On the number of elliptic pseudoprimes. Math. Comp. 52 A989), no. 185,
231-245. MR89f:11169
453. , Pseudoprijnes on elliptic curves, Theorie des nombres (Quebec, PQ, 1987), de
Gruyter, Berlin, 1989, pp. 290-305. MR 91g:11158
454. , Equidistant arithmetic codes and character sums, J. Number Theory 46 A994),
no. 3, 323-333. MR 95d:11165
455. D. M. Gordon and C. Pomerance, The distribution of Lucas and elliptic pseudoprimes,
Math. Comp. 57 A991), no. 196, 825-838. MR92h:11081
456. M. Goresky and A. Klapper, Arithmetic cross correlations of feedback xvith carry shift reg-
register sequences. IEEE Trans. Inform. Theory 43 A997), no. 4, 1342-1345. MR 98j:94010
457. M. Goresky, A. Klapper, M. Ram Murty, and I. E. Shparlinski, On decimations of l-
sequences, Preprint. 2002.
458. M. Goresky, A. Klapper, and L. Washington, Fourier transforms and the 2-adic span of
periodic binary sequences, IEEE Trans. Inform. Theory 46 B000), no. 2, 687-691. MR
2001k:94041
459. R. Gottfert and H. Niederreiter, On the minimal polynomial of the product of linear recur-
recurring sequences, Finite Fields Appl. 1 A995), no. 2, 204-218. MR 96h:11007
460. X. Gourdon and B. Salvy, Effective asymptotics of linear recurrences with rational coeffi-
coefficients, Proceedings of the 5th Conference on Formal Power Series and Algebraic Combina-
Combinatorics (Florence, 1993), vol. 153, 1996, pp. 145-163. MR 97c:11013
461. E. Gourin, On irreducible polynomials in several variables which become reducible when the
variables are replaced by powers of themselves, Trans.- Amer. Math. Soc. 32 A930), no. 3,
485-501.
462. W. T. Gowers, Fourier analysis and Szemeredi's theorem, Proceedings of the International
Congress of Mathematicians, Vol. I (Berlin, 1998), vol. Extra Vol. I, 1998. pp. 617-629. MR
2000i:11026
463. , A new proof of Szemeredi's theorem for arithmetic progressions of length four,
Geom. Funct. Anal. 8 A998). no. 3,-529-551, Erratum: 11 B001), 869. MR 2000d:11019-
464. , A new proof of Szemeredi's theorem, Geom. Funct. Anal. 11 B001), no. 3, 465-588.
MR2002k:11014
465. P. J. Grabner, P. Kirschenhofer, H. Prodinger, and R. F. Tichy, On the moments of the
sum-of-digits function, Applications of Fibonacci numbers, Vol. 5 (St. Andrews, 1992).
Kluwer Acad. Publ., Dordrecht, 1993, pp. 263-271. MR 95d:11123
466. P. J. Grabner, P. Kiss, and R. F. Tichy, Diophantine approximation in terms of linear
recurrent sequences, Number theory (Halifax, NS, 1994), Amer. Math. Soc, Providence,
RI, 1995, pp. 187-195. MR97h:11085
467. P. J. Grabner and P. Liardet, Harmonic properties of the sum-of-digits function for complex
bases, Acta Arith. 91 A999), no. 4, 329-349. MR 2001f:11126
468. P. J. Grabner, P. Liardet, and R. F. Tichy, Odometers and systems of numeration, Acta
Arith. 70 A995), no. 2, 103-123. MR 96b:11108
469. P. J. Grabner and J. M. Thuswaldner, On the sum of digits function for number systems
with negative bases, Ramanujan J. 4 B000), no. 2, 201-220. MR 2001m: 11015
470. P. J. Grabner, R. F. Tichy, and R. Winkler, On the stability of the quotients of successive
terms of line.ar recurring sequences, Number-theoretic and algebraic methods in computer
science (Moscow, 1993), World Sci. Publishing, River Edge, NJ, 1995. pp. 185-192. MR
97b:11099
471. M. Grady and M. Newman, Residue periodicity in subgroup counting functions, The
Rademacher legacy to mathematics (University Park, PA, 1992), Amer. Math. Soc, Prov-
Providence, RI, 1994, pp. 265-273. MR 96b:20028
472. S. W. Graham and C. J. Ringrose, Lower bounds for least quadratic nonresidues, Analytic
number theory (Allerton Park, IL, 1989), Birkhauser Boston, Boston, MA, 1990, pp. 269-
309. MR92d:11108
473. D. Grant, Sequences of fields with many solutions to the unit equation. Rocky Mountain J.
Math. 26 A996), no. 3, 1017-1029. MR98f:11121
474. J. Grantham, A probable prime test, with high confidence, J. Number Theory 72 A998),
no. 1, 32-47. MR 2000e:11160

BIBLIOGRAPHY 275
475. , Probenius pseudoprimes, Math. Comp. 70 B001), no. 234, 873-891. MR
2001g:11191
476. A. Granville, Arithmetic properties of binomial coefficients. I. Binomial coefficients modulo
prime powers, Organic mathematics (Burnaby, BC, 1995), Amer. Math. Soc, Providence,
RI, 1997, pp. 253-276. MR 99h:11016
477. A. Granville and Z.-W. Sun, Values of Bernoulli polynomials, Pacific J. Math. 172 A996),
no. 1, 117-137. MR98b:11018
478. F. Griffin, H. Niederreiter, and I. E. Shparlinski, On the distribution of nonlinear recursive
congruential pseudorandom numbers of higher orders, Applied algebra, algebraic algorithms
and error-correcting codes (Honolulu, HI, 1999), Springer, Berlin, 1999, pp. 87-93. MR
2002j:94038
479. F. Griffin and I. E. Shparlinski, On the linear complexity of the Naor-Reingold pseudo-
pseudorandom function, Lect. Notes in Comp. Sci. 1726 A999), 301-308.
480. , On the linear complexity profile of the power generator, IEEE Trans. Inform.
Theory 46 B000), no. 6, 2159-2162. MR 2001k:94053
481. G. Grisel, Sur la longueur de la fraction continue de a™, Acta Arith. 74 A996), no. 2,
161-176. MR96m:11004
482. , Length of the powers of a rational fraction, J. Number Theory 62 A997), no. 2,
322-337. MR98a:11088
483. , Length of continued fractions in principal quadratic fields, Acta Arith. 85 A998),
no. 1, 35-49. MR 99g:11015
484. M. Gromov, Groups of polynomial growth and expanding maps, Inst. Hautes Etudes Sci.
Publ. Math. 53 A981), 53-73. MR 83b-.53O41
485. G. Grossman and F. Luca, Sum of factorials in binary recurrence sequences, J. Number
Theory 93 B002), 87-107. MR 2002m:11011
486. D. Guillaume and F. Morain, Building pseudoprimes with a large number of prime factors,
Appl. Algebra Engrg. Comm. Comput. 7 A996), no. 4, 263-277. MR 98d:11011
487. R. Gupta and M. Ram Murty, A remark on Artin's .conjecture, Invent. Math. 78 A984),
no. 1, 127-130. MR86d:11003
488. Primitive points on elliptic curves, Compositio Math. 58 A986), no. 1, 13-44. MR
87h: 11050
489. , Cyclicity and generation of points mod p on elliptic curves, Invent. Math. 101
A990), no. 1, 225-235. MR91e;11065
490. S. Gupta and D. Zagier, On the coefficients of the minimal polynomials of Gaussian periods,
Math. Comp. 60 A993), no. 201, 385-398. MR 93d:11086
491. S. Gurak, Pseudoprimes for higher-order linear recurrence sequences. Math. Comp. 55
A990), no. 192, 783-813. MR 91a:11067
492. . On higher-order pseudoprimes of Lehmer type, Number theory (Halifax, NS, 1994),
Amer. Math. Soc, Providence, RI, 1995, pp. 215-227. MR 96f:11167
493. , On the minimal polynomials for certain Gauss periods over finite fields, Finite
fields and applications (Glasgow, 1995), Cambridge Univ. Press, Cambridge, 1996, pp. 85-
96. MR97m:11150
494. , On the middle factor of the period polynomial for finite fields, Number theory (Ot-
(Ottawa, ON, 1996), Amer. Math. Soc, Providence, RI, 1999, pp. 121-131. MR 2000b:11134
495. R. Guralnick, T. Penttila, C. E. Praeger, and J. Saxl, Linear groups with orders having
certain large prime divisors, Proc London Math. Soc. C) 78 A999), no. 1, 167-214. MR
99m:20113
496. J. Gutierrez and D. Gomes-Perez, Iterations of multivariate polynomials and discrepancy
of pseudorandom numbers, Lect. Notes in Comp. Sci. 2227 B001), 192-199.
497. J. Gutierrez, H. Niederreiter, and I. E. Shparlinski, On the multidimensional distribution
of inversive congruential pseudorandom numbers in parts of the period, Monatsh. Math.
129 B000), no. 1, 31-36. MR 2001e:11088
498. J. Gutierrez, I. E. Shparlinski, and A. Winterhof. On the linear and nonlinear complexity
profile of nonlinear pseudorandom number generators, IEEE Trans. Inform. Theory 49
B003), 60-64.
499. R. K. Guy, Unsolved problems in number theory, second ed., Springer-Verlag, New York,
1994. MR 96e: 11002

276 BIBLIOGRAPHY
500. K. Gyory, On some arithmetical properties of Lucas and Lehmer numbers, Acta Arith. 40
A981/82), no. 4, 369-373. MR 83k:10018
501. , On arithmetic graphs associated with integral domains, A tribute to Paul Erdos,
Cambridge Univ. Press, Cambridge, 1990, pp. 207-222. MR 92h:11023
502. , On arithmetic graphs associated with integral domains. II, Sets, graphs and num-
numbers (Budapest, 1991), North-Holland, Amsterdam, 1992, pp. 365-374. MR 94e:11025
503. , Some recent applications of S-unit equations, Asterisque 209 A992), 11, 17-38.
MR 94e:11026
504. K. Gyory, P. Kiss, and A. Schinzel, On Lucas and Lehmer sequences and their applications
to Diophantine equations, Colloq. Math. 45 A981), no. 1, 75-80 A982). MR 83g:10009
505. L. Hajdu, A quantitative version of Dirichlet's S-unit theorem in algebraic number fields,
Publ. Math. Debrecen 42^.A993), no. 3-4, 239-246. MR 94e:11118
506. L. Halbeisen and N. Hungerbiihler, Optimal bounds for the length of rational Collatz cycles,
Acta Arith. 78 A997), no. 3, 227-239. MR 98g:11025
507. M. Hall, An isomorphism between linear recurring sequences and algebraic rings, Trans.
Amer. Math. Soc. 44 A938), no. 2, 196-218.
508. S. Hallgren, Linear congruential generators over elliptic curves, Preprint CS-94-143, Dept.
of Comp. Sci., Carnegie Mellon Univ., 1994.
509. F. Halter-Koch and W. Narkiewicz, Finiteness properties of polynomial mappings, Math.
Nachr. 159 A992), 7-18. MR 94j:14016
510. . , Polynomial mappings defined by forms with a common factor, Sem. Theor. Nom-
bres Bordeaux B) 4 A992), no. 2, 187-198. MR 94g:11020
' 511. , Polynomial cycles infinitely generated domains, Monatsh. Math. 119 A995), no. 4,
275-279. MR 96d: 13035
512. _, Scarcity of finite polynomial orbits, Publ. Math. Debrecen 56 B000), no. 3-4,
405-414, Dedicated to Professor Kalman Gyory on the occasion of his 60th birthday. MR
2001h:11028
513. G. Hansel, Une demonstration simple du theoreme de Skolem- Mahler-Lech, Theoret. Corn-
put. Sci. 43 A986), no. 1, 91-98. MR 88j:11091
514. J. C Hansen and E. Schmutz, How random is the characteristic polynomial of a random
matrix1?, Math. Proc. Cambridge Philos. Soc. 114 A993), no. 3, 5.07-515. MR 94j:05009
515. G. H. Hardy, Divergent series, Oxford, at the Clarendon Press, 1949. MR 11,25a
516. G. H. Hardy and E. M. Wright, An introduction to the theory of numbers, fifth ed., The
Clarendon Press Oxford University Press, New York, 1979. MR 81i:10002
517. D. Harkin, On the mathematical work of Francois-Bdouard-Anatole Lucas, Enseignement
Math. B) 3 A957), 276-288. MR 20 #3762
518. G. Harman, Trigonometric sums over primes. I, Mathematika 28 A981), no. 2, 249-254
A982). MR 83j:10045
519. , One hundred years of normal numbers, Number Theory for the Millennium, Vol.11,
A. K. Peters, Natick, MA, 2002, pp. 149-166.
520. S. Hatjispyros and F. Vivaldi, A family of rational zeta functions for the quadratic map,
Nonlinearity 8 A995), no. 3, 321-332. MR 96c:58141
521. D. R. Heath-Brown, Artin's conjecture for primitive roots, Quart. J. Math. Oxford Ser. B)
37 A986), no. 145, 27-38. MR 88a:11004
522. , Integer sets containing no arithmetic progressions, J. London Math. Soc. B) 35
A987), no. 3, 385-394. MR 88g: 11005
523. , Zero-free regions for Dirichlet L-functions, and the least prime in an arithmetic
progression, Proc. London Math. Soc. C) 64 A992), no. 2, 265-338. MR 93a:11075
524. D. R. Heath-Brown and S. Konyagin, New bounds for Gauss sums derived from fcth pow-
powers, and for Heilbronn's exponential sum, Q. J. Math. 51 B000), no. 2, 221-235. MR
2001h:11106
525. T. Helleseth, Some results about the cross-correlation function between two maximal linear
sequences, Discrete Math. 16 A976), no. 3, 209-232. MR 55 #2341
526. , Correlation of m-sequences and related topics, Sequences and their applications
(Singapore, 1998), Springer, London, 1999, pp. 49-66. MR 2002f:94030
527. T. Helleseth and P. V. Kumar, Sequences with low correlation, Handbook of coding theory,
Vol. I, II, North-Holland, Amsterdam, 1998, pp. 1765-1853.

BIBLIOGRAPHY 277
528. T. Helleseth, P. V. Kumar, and H. Martinsen, A new family of ternary sequences with ideal
two-level autocorrelation function, Des. Codes Cryptogr. 23 B001), no. 2, 157-166. MR
2002e:94090
529. T. Helleseth and H. M. Martinsen, Binary sequences of period 1m — 1 with large linear
complexity, Inform, and Comput. 151 A999), no. 1-2, 73-91. MR 2000c:11025
530. D. Hensley, The distribution mod n of fractions with bounded partial quotients, Pacific J.
Math. 166 A994), no. 1, 43-54. MR 95i:11083 .
531. T. Herlestam, On functions of linear shift register sequences, Advances in cryptology—
EUROCRYPT '85 (Linz, 1985), Springer, Berlin, 1986, pp. 119-129. MR 87g-.94O17
532. S. Hernandes and F. Luca, On the largest prime factor of (ab+ l)(ac+ l)(bc+ 1), Preprint,
2002.
533. M. Hindry and J. H. Silverman, The canonical height and integral points On elliptic curves,
Invent. Math. 93 A988), no. 2, 419-450. MR 89k:11044
534. , On Lehmer's conjecture for elliptic curves, Seminaire de Theorie des Nombres,
Paris 1988-1989, Birkhauser Boston, Boston, MA, 1990, pp. 103-116. MR 92e: 11062
535. P. A. Hines, Characterising the linear complexity of span 1 de Bruijn sequences over finite
fields, 3. Combin. Theory Ser. A 81 A998), no. 2, 140-148. MR 99b:05012
536. , On the minimum linear complexity of de Bruijn sequences over non-prime finite
fields, 3. Combin. Theory Ser. A 86 A999), no. 1, 127-139. MR 2000b:94014
537. A. Hinkkanen, Zeta functions of rational functions are rational, Ann. Acad. Sci. Fenn. Ser.
A I Math. 19 A994), no. 1, 3-10. MR 94h:58137
538. J. G. Hinz, A note on Artin's conjecture in algebraic number fields, 3. Number Theory 22
A986), no. 3, 334-349. MR 87f:11067
539. A. Hof and O. Knill, Cellular automata with almost periodic initial conditions, Nonlinearity
8 A995), no. 4, 477-491. MR 96g:58093
540. H. D. L. Hollmann and Q. Xiang, A proof of the Welch and Niho conjectures on cross-
correlations of binary m-sequences, Finite Fields Appl. 7 B001), no. 2, 253-286. MR
2002f:94031
541. A. N. W. Hone, N. Joshi, and A. V. Kitaev, An entire function defined by a nonlinear
recurrence relation, 3. London Math. Soc. B) 66 B002), no. 2, 377-387. MR 1 920 409
542. C. Hooley, On Artin's conjecture, 3. Reine Angew. Math. 225 A967), 209-220. MR 34
#7445
543. , Applications of sieve methods to the theory of numbers, Cambridge University
Press, Cambridge, 1976. MR 53 #7976
544. A. E. D. Houston, On the limit of maximal density of sequences with a perfect linear
complexity profile, Des. Codes Cryptogr. 10 A997), no. 3, 351-359. MR 98a:94022
545. E. W. Howe, Higher-order Carmichael numbers, Math. Comp. 69 B000), no. 232, 1711-
1719. MR 2001a:11012
546. E. Hrushovski, P. H. Kropholler, A. Lubotzky, and A. Shalev, Powers infinitely generated
groups, Trans. Amer. Math. Soc. 348 A996), no. 1, 291-304. MR 96f:20061
547. H. Hu and Z.-W. Sun, An extension of Lucas' theorem, Proc. Amer. Math. Soc. 129 B001),
no. 12, 3471-3478 (electronic). MR 2002i:11019
548. P.-C. Hu and C.-C. Yang, A generalized abc-conjecture over function fields, 3. Number
Theory 94 B002), 286-298. MR 2003d:11055
549. C. Hua and G.-Z. Xiao, The linear complexity of binary sequences with period Bn — l)fc,
IEEE Trans. Inform. Theory 37 A991), 672-673.
550. L. K. Hua, Die Abschatzung von Exponentialsummen und ihre Anwendung in der Zahlen-
theorie, B. G. Teubner Verlagsgesellschaft, Leipzig, 1959. MR 24 #A94
551. K. Huber, On the period length of generalized inversive pseudorandom number generators,
Appl. Algebra Engrg. Comm. Comput. 5 A994), no. 5, 255-260. MR 96c:11090
552. M. Iosifescu and C. Kraaikamp, On Denjoy's canonical continued fraction expansion, Osaka
J. Math. 40 B003), no. 1, 235-244. MR 1 955 806
553. S. Jakubec, J. Kostra, and K. Nemoga, On the existence of an integral normal basis gener-
generated by a unit in prime extensions of rational numbers, Math. Comp. 56 A991), no. 194,
809-815. MR 91h:11117
554. D. Jarden, Any Lucas number Lap, for any prime p > 5, has at least two distinct primitive
prime divisors, Fibonacci Quart. 6 A968), 407.

278 BIBLIOGRAPHY
555. D. Jarden and M. Jarden, On the existence, of an infinitude of composite primitive divisors
of second-order recurring sequences, Fibonacci Quart. 6 A968), 322-334, 406. MR 39
#1422
556. E. Jen, Linear cellular automata and recurring sequences in finite fields, Comm. Math.
Phys. 119 A988), no. 1, 13-28. MR 90h:68085
557. , A periodicity in one-dimensional cellular automata, Chaos (Woods Hole, MA.
1989), Amer. Inst. Phys., New York, 1990, pp. 121-144. MR 93d:68052
558. , Exact solvability and quasiperiodicity of one-dimensional cellular automata, Non-
linearity 4 A991), no. 2, 251-276. MR 92j:68084
559. E. Jensen and M. Ram Murty, Artin's conjecture for polynomials over finite fields, Number
theory, Birkhauser, Basel, 2000, pp. 167-181. MR 2001h:11153
560. T. Johansson, A shift register construction of unconditionally secure authentication codes.
Des. Codes Cryptogr. 4 A994), no. 1, 69-81. MR 94j:94014
561. J. P. Jones and P. Kiss, An asymptotic formula concerning Lehmer numbers, Publ. Math.
Debrecen 42 A993), no. 3-4, 199-213. MR 94j:11015
562. , Representation of integers as terms of a linear recurrence with maximal index, Acta
Acad. Paedagog. Agriensis Sect. Mat. (N.S.) 25 A998), 21-37 A999). MR 2000i:11032
563. J. A. Joseph, A chaotic extension of the 3z + 1 function to 2.2[i), Fibonacci Quart. 36
A998), no. 4, 309-316. MR 99M1026
564. N. Joshi and A. V. Kitaev, On Boutroux's tritronquee solutions of the first Painleve equa-
equation, Stud. Appl. Math. 107 B001), no. 3, 253-291. MR 2002g:34202
565. A. Joux and J. Stern, Lattice reduction: a toolbox for the cryptanalyst, J. Cryptology 11
A998), no. 3, 161-185. MR 99c:94031-
566. S.-M. Jung and B. Volkmann, Remarks on a paper of Wagner, J. Number Theory 56 A996),
no. 2, 329-335. MR 96k: 11095
567. T. Kagawa and N. Terai, Squares in Lucas sequences and some Diophantine equations.
Manuscripta Math. 96 A998), no. 2, 195-202. MR 99i:11019
568. T. Kaida. S. Uehara, and K. Imamura, An algorithm for the k-error linear complexity
of sequences over GF(pm) with period pn, p a prime, Inform, and Comput. 151 A999).
no. 1-2, 134-147. MR 2000f:94020
569. , A new algorithm for the k-error linear complexity of sequences over GF(pm) with
period p". Sequences and their applications (Singapore, 1998), Springer, London, 1999.
pp. 284-296. MR 2002i:11129
570. , On the profile of the k-error linear complexity and zero sum property of sequences
over GF(pm) with period pn, Sequences and their applications (Bergen, 2001), Springer.
Berlin, 2002, pp. 218-227. MR 2003d:94060
571. T. Kamae. Number-theoretic problems involving two independent bases, Number theory and
cryptography (Sydney, 1989), Cambridge Univ. Press, Cambridge, 1990, pp. 196-203. MR
91h:11073
572. O. V. Kamlovskii and A. S. Kuz'min, Distribution of elements on cycles of linear recurrent
sequences over Galois rings. Uspekhi Mat. Nauk 53 A998), no. 2C20), 149-150. MR
99e:11022
573. R. Kannan and R. J. Lipton. Polynomial-time algorithm for the orbit problem, J. Assoc.
Comput. Mach. 33 A986), no. 4, 808-821. MR 88b:68086
574. H. Kano. General constructions of normal numbers of Korobov type, Osaka J. Math. 30
A993), no. 4, 909-919. MR 94J-.11069
575. .4 remark on Wagner's ring of normal numbers, Arch. Math. (Basel) 60 A993).
no. 1,46-50.. MR 94f:11068 .
576. H. Kano and I. Shiokawa, Rings of normal and nonnormal numbers, Israel J. Math. 84
A993), no. 3, 403-416. MR 95e:11086
577. H. J. Karloff and P. Raghavan, Randomized algorithms and pseudorandom numbers, 3.
Assoc. Comput. Mach. 40 A993), no. 3, 454-476. MR 96h:68096
578. M. Karpinski, A. J. van der Poorten, and I. E. Shparlinski, Zero testing of p-adic and mod-
modular polynomials, Theoret. Comput. Sci. 233 B000), no. 1-2, 309-317. MR 2001m:12016
579. M. Karpinski and I. E. Shparlinski, On some approximation problems concerning sparse
polynomials over finite fields. Theoret. Comput. Sci. 157 A996), no. 2. 259-266. MR
96m:68084

BIBLIOGRAPHY 279
580. T. Kato. L.-M. Wu, and N. Yanagihara, The serial test for a nonlinear pseudorandom
number generator, Math. Comp. 65 A996), no. 214, 761-769. MR 96g:65007
581. A. Katok and B. Hasselblatt, Introduction to the modern theory of dynamical systems,
Cambridge University Press, Cambridge, 1995. MR 96c:58055
582. N. M. Katz. Gauss sums, Kloosterman sums, and monodromy groups, Princeton University
Press, Princeton, NJ, 1988. MR 91a:11028
583. W. Keller, New Cullen primes, Math. Comp. 64 A995), no. 212, 1733-1741, S39-S46,
With a biographical sketch of James Cullen by T. G. Holt and a supplement by Keller and
Wolfgang Niebuhr. MR 95m:11015
584. B. W. Kernighan and D. M. Ritchie, The C programming language, Prentice Hall, Engle-
wood Cliffs. NJ, 1988.
585. K. H. Kim. N. S. Ormes, and F. W. Roush, The spectra of nonnegative integer matrices
via formal power series, J. Amer. Math. Soc 13 B000), no. 4, 773-806. MR 2001g:15013
586. C. Kimberling, Terms common to two sequences satisfying the same linear recurrence.
Applications of Fibonacci numbers, Vol. 4 (Winston-Salem, NC, 1990), Kluvver Acad. Publ.,
Dordrecht. 1991, pp. 177-188. MR 93j:11009
587. P. Kiss, Zero terms in second-order linear recurrences, Math. Sem. Notes Kobe Univ. 7
A979), no. 1, 145-152. MR 80j:10015
588. On common terms of linear recurrences, Acta Math. Acad. Sci. Hungar. 40 A982),
no. 1-2, 119-123. MR 84h:10014
589. Differences of the terms of linear recurrences, Studia Sci. Math. Hungar. 20 A985),
no. 1-4, 285-293. MR 88f:11008
590. Primitive divisors of Lucas numbers, Applications of Fibonacci numbers (San Jose,
CA, 1986). Kluwer Acad. Publ., Dordrecht, 1988, pp. 29-38. MR 89j:liO16
591. On rank of apparition of primes in Lucas sequences, Publ. Math. Debrecen 36
A989). no. 1-4, 147-151 A990). MR 91e:11019
592. On prime divisors of the terms of second order linear recurrence sequences, Ap-
Applications of Fibonacci numbers, Vol. 3 (Pisa, 1988), Kluwer Acad. Publ.. Dordrecht, 1990,
pp. 203-207. MR 92g:11013
593. On primitive prime power diviS'ofS of Lucas numbers, Number theory, Vol. II
(Budapest. 1987), North-Holland, Amsterdam, 1990. pp. 773-786. MR 91g:11014
594. Some results concerning the reciprocal sum of prime divisors of a Lucas num-
number, Applications of Fibonacci numbers, Vol. 5 (St. Andrews, 1992), Kluvver Acad. Publ.,
Dordrecht. 1993, pp. 417-420. MR 95b:11091
595. Pure powers and power classes in recurrence sequences, Math. Slovaca 44 A994),
no: 5, 525-529. MR 96c:11017
596. An approximation problem concerning linear recurrences, Number theory (Eger,
1996), de Gruyter, Berlin, 1998, pp. 289-293. MR 99d:11089
597. On sums of the reciprocals of prime divisors of terms of a linear recurrence, Ap-
Applications of Fibonacci numbers, Vol. 7, Kluwer Acad. Publ., Dordrecht. 1998, pp. 215-220.
598. , On a problem concerning perfect powers in linear recurrences, Acta Acad. Paeda-
gog. Agriensis Sect. Mat. (N.S.) 26 A999), 25-30 B000). MR 2001a:11021
599. Note on a result of I. Nemes and A. Petho concerning polynomial values in linear
recurrences, Publ. Math. Debrecen 56 B000), no. 3-4, 451-455, Dedicated to Professor
Kalman Gyory on the occasion of his 60th birthday. MR 2001f:11018
600. Results concerning products and sums of the terms of linear recurrences, Acta
Acad. Paedagog. Agriensis Sect. Mat. (N.S.) 27 B000), 1-7 B001). MR 2002a:11011
601. P. Kiss and F. Matyas, An asymptotic formula for tt, J. Number Theory 31 A989), no. 3,
255-259. MR 90e:11036
602. Perfect powers from the sums of terms of linear recurrences, Period. Math. Hungar.
42 B001). no. 1-2, 163-168. MR 2002k:11017
603. , Products of the terms of linear recurrences, Studia Sci. Math. Hungar. 37 B001),
no. 3-4, 355-362. MR 2002i:11014
604. P. Kiss and B. M. Phong, Weakly composite Lucas numbers, Ann. Univ. Sci. Budapest.
Eotvos Sect. Math. 31 A988), 179-182 A989). MR 90j:11017
605. Reciprocal sum of prime divisors of Lucas numbers, Acta Acad. Paed. Agriensis,
Sect. Math. 19 A989), 47-54.

280
BIBLIOGRAPHY
606. P. Kiss and B. Tropak, Average order of logarithms of terms in binary recurrences, Discuss.
Math. 10 A990), 29-39 A991). MR 93e:11021
607. P. Kiss and B. Zay, On sequences of zeros and ones, Studia Sci. Math. Hungar. 29 A994),
no. 3-4, 437-442. MR 95h:11021
608. B. Kitchens and K. Schmidt, Markov subgroups of (Z/2Z)Z , Symbolic dynamics and its
applications (New Haven, CT, 1991), Amer. Math. Soc, Providence, RI, 1992, pp. 265-283.
MR 93k:58136
609. , Mixing sets and relative entropies for higher-dimensional Markov shifts, Ergodic
Theory Dynam. Systems 13 A993), no. 4, 705-735. MR 95f:28022
610. A. Klapper, The vulnerability of geometric sequences based on fields of odd characteristic,
J. Cryptology 7 A994), no. 1, 33-51. MR 94J-.94015
611. , d-form sequences: families of sequences with low correlation values and large linear
spans,
III
ll 1
11!
,n
n
til
IVans.
i
n
I
btm. T
leery k
i
1
i
Jb), M. i
1*1
i i
\
\ 111 I
612.
613.
614.
615.
616.
617.
618.
619.
620.
621.
622.
623.
624.
625.
626.
627.
628.
629.
630.
, Large families of sequences with near-optimal correlations and large linear span,
IEEE Trans. Inform. Theory 42 A996), no. 4, 1241-1248. MR 97m:94017
, On the existence of secure feedback registers, Lect. Notes in Comp. Sci. 1070
A996), 256-267.
, Cross-correlations of quadratic form sequences in odd characteristic, Des. Codes
Cryptogr. 11 A997), no. 3, 289-305. MR 98j:94021
A. Klapper, A. H. Chan, and M. Goresky, Cross-correlations of linearly and quadratically
related geometric sequences and GMW sequences, Discrete Appl. Math. 46 A993), no. 1,
1-20. MR 94g:94015
A. Klapper and M. Goresky, Partial period autocorrelations of geometric sequences, IEEE
Trans. Inform. Theory 40 A994), no. 2, 494-502. MR 95h:94016
, Feedback shift registers, 1-adic span, and combiners with memory, J. Cryptology
10 A997), no. 2, 111-147. MR 98f:94012
A. Klapper and J. Xu, Algebraic feedback shift registers, Theoret. Comput. Sci. 226 A999),
no. 1-2, 61-92, Cryptography; MR 2001m:94040
D. E. Knuth, The art of computer programming. Vol. 2, third ed., Addison-Wesley Pub-
Publishing Co., Reading, Mass., 1998. MR 83i:68003
N. Koblitz, p-adic numbers, p-adic analysis, and zeta-functions. Springer-Verlag, New York,
1977. MR 57 #5964
, A course in number theory and cryptography, Springer-Verlag, New York, 1987.
MR 88i:94001
, Elliptic curve cryptosystems, Math. Comp. 48 A987), no. 177, 203-209. MR
88b:94017
D. R. Kohel and I. E. Shparlinski, On exponential sums and group generators for elliptic
curves over finite fields, Algorithmic number theory (Leiden, 2000), Springer, Berlin, 2000,
pp. 395-404. MR 2003c: 11094
S. V. Konjagin, Letter to the editors: "The number of solutions of congruences of the
nth degree with one unknown" [Mat. Sb. (N.S.) 109A51)B), 171-187, 327, 1979; MR
80k: 10013a], Mat. Sb. (N.S.) 110A52) A979), no. 1, 158. MR 80k:10013b
, The number of solutions of congruences of the nth degree with one unknown, Mat.
Sb. (N.S.) 109A51) A979), no. 2, 171-187, 327. MR 80k:10013a
M. Kontsevich and D. Zagier, Periods, Mathematics unlimited—2001 and beyond, Springer,
Berlin, 2001, pp. 771-808. MR 2002i: 11002
S. V. Konyagin, Estimates for Gaussian sums and Waring's problem modulo a prime,
Trudy Mat. Inst. Steklov. 198 A992), 111-124. MR 96e:11122
S. V. Konyagin and C. Pomerance, On primes recognizable in deterministic polynomial time,
The mathematics of Paul Erdos, I, Springer, Berlin, 1997, pp. 176-198. MR 98a: 11184
S. V. Konyagin and I. E. Shparlinski, Character sums with exponential functions and their
applications, Cambridge University Press, Cambridge, 1999. MR 2000h:11089
S. V. Konyagin and T. Steger, Polynomial congruences, Mat. Zametki 55 A994), no. 6,
73-79, 158. MR 96e:11043
r
a-rc Mat 7.Q
otVi AT

BIBLIOGRAPHY 281
633. , Unimprovable estimates of trigonometric sums with exponential functions, Doklady
Akad. Nauk SSSR (N.S.) 89 A953), 597-600. MR 15,15d
634. , Teoretiko-chislovye metody v priblizhennom analize, Gosudarstv. Izdat. Fiz.-Mat.
Lit., Moscow, 1963. MR 28 #716
635. , Distribution of fractional parts of exponential functions, Vestnik Moskov. Univ.
Ser. I Mat. Meh. 21 A966), no. 4, 42-46. MR 33 #5600
636. , Trigonometric sums with exponential functions, and the distribution of the digits
in periodic fractions, Mat. Zametki 8 A970), 641-652. MR 43 #6165
637. . The distribution of digits in periodic fractions, Mat. Sb. (N.S.) 89A31) A972),
654-670, 672. MR 54 #12619
638. C. Kraaikamp, A new class of continued fraction expansions, Acta Arith. 57 A991), no. 1,
1-39. MR 92a: 1109.0
639. C. Kraaikamp and H. Nakada, On normal numbers for continued fractions, Ergodic Theory
Dynam. Systems 20 B000), no. 5, 1405-1421. MR 2001i:11101
640. I. Krasikov and J. C. Lagarias, Bounds for the 3z + 1 problem using difference inequalities,
arXiv:math.NT/0205002, 2002.
641. H. Krawczyk, How to predict congruential generators, 3. Algorithms 13 A992), no. 4, 527-
545. MR 93g:65013
642. , LFSR-based hashing and authentication, Lect. Notes in Comp. Sci. 839 A994),
129-139.
643. M. Kfizek, F. Luca, and L. Somer, 17 lectures on Fermat numbers, Springer-Verlag, New
York, 2001, From number theory to geometry, With a foreword by Alena Solcova. MR
2002i:11001
644. K. K. Kubota, On a conjecture of Morgan Ward. I, Acta Arith. 33 A977), no. 1, 11-28.
645. , On a conjecture of Morgan Ward. II, Acta Arith. 33 A977), no. 1, 29-48.
646. , On a conjecture of Morgan Ward. Ill, Acta Arith. 33 A977). no. 2, 99-109. MR
56 #235b
647. L. Kuipers and H. Niederreiter, Uniform distribution of sequences, Wiley-Interscience [John
Wiley & Sons], New York, 1974. MR 54 #7415
648. M. R. S. Kulenovic and G. Ladas, Dynamics of second order rational difference equations,
Chapman & Hall/CRC, Boca Raton, FL, 2002. With open problems and conjectures. MR
1 935 074
649. P. V. Kumar and T. Helleseth, An expansion for the coordinates of the trace function
over Galois rings, Appl. Algebra Engrg. Comm. Comput. 8 A997), no. 5, 353-361. MR
98e:11142
650. S. R. Kumar arid D. Sivakumar, Efficient self-testing/self-correction of linear recurrences,
37th Annual Symposium on Foundations of Computer Science (Burlington, VT, 1996),
IEEE Comput. Soc. Press, Los Alamitos, CA, 1996, pp. 602-611.
651. E. Kuo, Applications of graphical condensation for enumerating matchings and tilings,
Preprint, 2002.
652. V. L. Kurakin, Representations over the ring Z,pn of a linear recursive sequence of maximal
period over the field GF(p), Diskret. Mat. 4 A992), no. 4, 96-116. MR 94e:11013
653. , Convolution of linear recurrent sequences, Uspekhi Mat. Nauk 48 A993),
no. 4B92), 235-236. MR 94k:11018
654. , The structure of Hopf algebras of linear recurrent sequences, Uspekhi Mat. Nauk
48 A993), no. 5B93), 177-178. MR 94k:16066
655. , The first coordinate sequence of a linear recurrence of maximum period over a
Galois ring, Diskret. Mat. 6 A994), no. 2, 88-100. MR 95h:11140
656. , Representations over a field of linear recurrents of maximal period over a residue
ring, Uspekhi Mat. Nauk 49 A994), no. 2B96), 157-158. MR 95g:11011
657. P. Kurlberg, On the order of unimodular matrices modulo integers,
arXiv:math.NT/0202053, 2001.
658. P. Kurlberg and Z. Rudnick, On quantum ergodicity for linear maps of the torus, Comm.
Math. Phys. 222 B001), no. 1. 201-227. MR 2002j:81082
659. K. Kurosawa, F. Sato, T. Sakata, and W. Kishimoto, A relationship between linear complex-
complexity and k-error linear complexity, IEEE Trans. Inform. Theory 46 B000), no. 2, 694-698.
MR 2001i:94055

BIBLIOGRAPHY 283
685. M. Laurent, Minoration de la hauteur de Neron-Tate, Seminar on number theory, Paris
1981-82 (Paris, 1981/1982), Birkhauser Boston, Boston, MA, 1983. pp. 137-151. MR
85e:11048
686. , Equations exponentielles-polynbmes et suites recurrentes lineaires. II. J. Number
Theory 31 A989), no. 1, 24-53. MR 90b:11023
687. W. M. Lawton, A problem of Boyd concerning geometric means of polynomials, J. Number
Theory 16 A983), no. 3, 356-362. MR 84i:10056
688. R. R. Laxton, Linear recurrences of order two, J. Austral. Math. Soc. 7 A967), 108-114.
MR 34 #7489
689. , On groups of linear recurrences. I. Duke Math. J. 36 A969). 721-736. MR 41
#3427
690. , On groups of linear recurrences. II. Elements of finite order. Pacific J. Math. 32
A970), 173-179. MR 41 #3428
691. On a problem of M. Ward, Fibonacci Quart. 12 A974), 41-44. MR 52 #10577
692. J. W. Layman, Maximum zero strings of Bell numbers modulo primes. J. Combin. Theory
Ser. A 40 A985), no. 1, 161-168. MR 87a:11020
693. M. H, Le. A note on the Diophantine equation (xm - l)/(x - 1) - y" + 1. Math. Proc.
Cambridge Philos. Soc. 116 A994), no. 3, 385-389. MR 95h:11030
694. C. Lech, A note on recurring series. Ark. Mat, 2 A953), 417-421. MR 15,104e
695. D. H. Lehmer, Factorization of certain cyclotomic functions, Ann. of Math. 34 A933),
461-479.
696. , The mathematical work of Morgan Ward, Math. Comp. 61 A993), no. 203, 307-
311. MR 93k:01071
697. S, Lehr, J. Shallit, and J. Tromp, On the vector space of the automatic reals, Theoret,
Comput. Sci. 163 A996), no. 1-2, 193-210. MR 97i:03037
698. F. Lemmermeyer, The Euclidean algorithm in algebraic number fields. Exposition. Math.
13 A995). no, 5, 385-416. MR 96i:11115
699. H. W. Lenstra. Jr., Euclidean number fields of large degree, Invent, Math, 38 A976/77),
no. 3, 237-254. MR 55 #2836
700. . On Artin's conjecture and Euclid's algorithm in global fields. Invent. Math. 42
A977), 201-224. MR 58 #576
701. H. W. Lenstra, Jr. and R. J. Schoof, Primitive normal bases for finite fields. Math. Comp.
48 A987). no, 177, 217-231. MR 88c:11076
702. H. W. Lenstra, Jr. and J, Shallit, Continued fractions and linear recurrences, Math. Comp,
61 A993). no. 203, 351-354. MR 93k:11004
703. A. Leutbecher and G. Niklasch, On cliques of exceptional units and Lenstra's construction
of Euclidean fields, Number theory (Ulm, 1987), Springer, New York. 1989, pp. 150-178.
MR 90i:11123
704. V. I. Levenshteln, Bounds for packings of metric spaces and some of their applications,
Problemy Kibernet. 40 A983), 43-110. MR 86c:52014
705. M. B. Levin, The uniform distribution of the sequence {a\x}. Mat. Sb. (N.S.) 98A40)
A975), no. 2 A0), 207-222, 333. MR 53 #10732
706. The distribution of the fractional parts of the exponential function, Izv. Vyss.
Ucebn. Zaved. Matematika 11 A977), no. 186. 50-57. MR 58 #21963
707. , Absolutely normal numbers, Vestnik Moskov. Univ. Ser. I Mat. Mekh. 1 A979),
31-37, 87. MR 80d:10076
708. , On the complete uniform distribution of the fractional parts of the exponential
function. Trudy Sem. Petrovsk. 7 A981), 245-256. MR 83j:10059
709. . Uniform distribution of a matrix exponential function, Investigations in number
theory (Russian), Saratov. Gos. Univ., Saratov, 1988, pp. 46-62. MR 91d:11085
710. , The choice of parameters in generators of pseudorandom numbers. Dokl. Akad.
Nauk SSSR 307 A989), no. 3, 529-534. MR 91d:11093
711. , Simultaneously absolutely normal numbers, Mat. Zametki 48 A990), no. 6, 61-71.
MR 92g:11077
712. , On the discrepancy of Markov-normal sequences, J. Theor. Nombres Bordeaux 8
A996), no. 2, 413-428. MR 97k:11113
713. , Discrepancy estimates of completely uniformly distributed and pseudorandom num-
number sequences, Internat. Math. Res. Notices 22 A999), 1231-1251. MR 2001f:11129

284 BIBLIOGRAPHY
714. , On the discrepancy estimate of normal numbers, Acta Arith. 88 A999), no. 2,
99-111. MR 2000j:11115
715. M. B. Levin and I. E. Shparlinski, Uniform distribution of fractional parts of recurrent
sequences, Uspekhi Mat. Nauk 34 A979), no. 3B07), 203-204. MR 80ktl0046
716. M. B. Levin and M. Smorodinsky, A Zd generalization of the Davenport-Erdos construction
of normal numbers, Colloq. Math. 84/85 B000), no. part 2, 431-441, Dedicated to the
memory of Anzelm Iwanik. MR 2002a: 11087
717. D. J. Lewis and J. Turk, Repetitiveness in binary recurrences, J. Reine Angew. Math. 356
A985), 19-48. MR 86e:11015
718. S. Li, On the number of elements with maximal order in the multiplicative group modulo
n, Acta Arith. 86 A998), no. 2, 113-132. MR 99k:11144
719. , On extending Artin's conjecture to composite moduli, Mathematika 46 A999),
no. 2, 373-390. MR 2002d:11118
720. , Artin's conjecture on average for composite moduli, J. Number Theory 84 B000),
no. 1, 93-118. MR 2001h:11127
721. S. Li and C- Pomerance, On generalizing Artin's conjecture on primitive roots to composite
moduli, J. Reine Angew. Math. 556 B003), 205-224.
722. W.-C. W. Li, M. Naslund, and I. E. Shparlinski, Hidden number problem with the trace
and bit security of XTR and LUC. Advances in cryptology—CRYPTO '02 (Santa Barbara,
2002) (Berlin), Springer, 2002.
723. A. I. Lichtman, The soluble subgroups and the Tits alternative in linear groups over rings
of fractions of polycylie group rings. I, J. Pure Appl. Algebra 86 A993), no. 3, 231-287.
MR 94d:20056
724. , The soluble subgroups and the .Tits alternative in linear groups over rings of
fractions of polycyclic group rings. II, J. Group Theory 2 A999), no. 2, 173-189. MR
2000c:20077
725. R. Lidl and H. Niederreiter, Finite fields, Addison-Wesley Publishing Company Advanced
Book Program, Reading, MA, 1983. MR 86c: 11106
726. D. Lieman and I. E. Shparlinski, On a new exponential sum, Canad. Math. Bull. 44 B001),
no. 1, 87-92. MR 2001m:11138
727. D. Lind, Brgodic automorphisms of the infinite torus are Bernoulli, Israel J. Math. 17
A974), 162-168. MR 49 #10856
728. , Dynamical properties of quasihyperbolic toral automorphisms, Ergodic Theory Dy-
Dynamical Systems 2 A982), no. 1, 49-68. MR 84g:28017
729. , Applications of ergodic theory and sofic systems to cellular automata, Phys. D 10
A984), no. 1-2, 36-44. MR 86g:68128
730. D. Lind and B. Marcus, An introduction to symbolic dynamics and coding, Cambridge
University Press, Cambridge, 1995. MR 97a:58050
731. D. Lind, K. Schmidt, and T. Ward, Mahler measure and entropy for commuting automor-
automorphisms of compact groups, Invent. Math. 101 A990), no. 3, 593-629. MR 92j:22013
732. D. Lind and T. Ward, Automorphisms of solenoids and p-adic entropy, Ergodic Theory
Dynam. Systems 8 A988), no. 3, 411-419. MR 90a:28031
733- U. V. Linnik, On the least prime in an arithmetic progression. I. The basic theorem, Rec.
Math. [Mat. Sbornik] N.S. 15E7) A944), 139-178. MR 6,260b
734. L. Lipshitz, The diagonal of a D-finite power series is D-finite, J. Algebra 113 A988),
no. 2, 373-378. MR 89c:13027
735. , , D-finite power series, J. Algebra 122 A989), no. 2, 353-373. MR 90g:13032
736. L. Lipshitz and A. J. van der Poorten. Rational functions, diagonals, automata and arith-
arithmetic, Number theory (Banff, AB, 1988), de Gruyter, Berlin, 1990, pp. 339-358. MR
93b:11095
737. L. Lipshitz and L. A. Rubel, A gap theorem for power series solutions of algebraic differ-
differential equations, Amer. J. Math. 108 A986), no. 5, 1193-1213. MR 87m:12008
738. B. Litow and Ph. Dumas, Additive cellular automata and algebraic series, Theoret. Comput.
Sci. 119 A993), no. 2, 345-354. MR 94f:68141
739. F. Lorenz, Normal bases of units, Number theory, Vol. II (Budapest, 1987), North-Holland,
Amsterdam, 1990, pp. 851-869. MR 91h:11119
740. J. H. Loxton, Automata and transcendence, New advances in transcendence theory
(Durham, 1986), Cambridge Univ. Press, Cambridge, 1988, pp. 215-228. MR 90b:11068

BIBLIOGRAPHY 285
741. J. H. Loxton and A. J. van der Poorten, Arithmetic properties of certain functions in several
variables. Ill, Bull. Austral. Math. Soc. 16 A977), no. 1, 15-47. MR 81g:10046
742. , On the growth of recurrence sequences, Math. Proc. Cambridge Philos. Soc. 81
A977), no. 3, 369-376. MR 56 #8480
743. , Arithmetic properties of the solutions of a class of functional equations, J. Reine
Angew. Math. 330 A982), 159-172. MR 83i:10046
744. , Multiplicative dependence in number fields, Acta Arith. 42 A983), no. 3, 291-302.
MR 86b:11052
745. , Arithmetic properties of automata: regular sequences, J. Reine Angew. Math. 392
A988), 57-69. MR 90a:11082
746. A. Lubotzky, Subgroup growth and congruence subgroups, Invent. Math. 119 A995). no. 2,
267-295. MR 95m:20054
747. A. de Luca and S. Varricchio, Some combinatorial properties of the Thue-Morse sequence
and a problem in semigroups, Theoret. Com put. Sci. 63 A989), no. 3, 333-348. MR
90k:68090
748. F. Luca, Products of factorials in binary recurrence sequences, Rocky Mountain J. Math.
29 A999), no. 4, 1387-1411. MR 2000k:11086
749. , Distinct digits in base b expansions of linear recurrence sequences, Quaest. Math.
23 B000), no. 4, 389-404. MR 2001i:11014
750. , Divisibility properties of binary recurrent sequences, Indag. Math. (N.S.) 12 B001),
no. 3, 353-367. MR 2003e:11011
751. , Multiply perfect numbers in Lucas sequences with odd parameters, Publ. Math.
Debrecen 58 B001), no. 1-2, 121-155. MR 2002a:11005
752. , On the greatest common divisor of two Cullen numbers, Preprint, 2002.
753. , Arithmetic properties of members of a binary recurrence sequence, Acta Arith.
109 B003), 81-107.
754. , Palindromes in Lucas sequences, Monatsh. Math. 138 B003), 209-223.
755. F. Luca and I. E. Shparlinski, Arithmetical functions with linear recurrence sequences,
Preprint, 2002.
756. , Average multiplicative orders of elements modulo n. Acta Arith. (to appear).
757. F. Luca and P. G. Walsh, Squares in Lehmer sequences and some Diophantine applications,
Acta Arith. 100 B001), no. 1, 47-62. MR 2002h:11024
758. , The product of like-indexed terms in binary recurrences, J. Number Theory 96
B002), 152-173.
759. L. G. Lucht, Arithmetical aspects of certain functional equations, Acta Arith. 82 A997),
no. 3, 257-277. MR 98m:11005
760. , Arithmetical sequences and systems of functional equations, Aequationes Math.
53 A997), no. 1-2, 73-90. MR 98h:11007
761. , Recurrent and almost-periodic sequences, Arch. Math. (Basel) 68 A997), no. 1,
22-26. MR 97k:11116
762. L. G. Lucht and C. Methfessel, Recurrent sequences and endomorphisms of Euclidean
spaces, Arch. Math. (Basel) 63 A994), no. 1, 92-96. MR 95i:11010
763. , Recurrent sequences and affine functional equations, J. Number Theory 57 A996),
no. 1, 105-113. MR 96k:11014
764. L. G. Lucht and M. Peter, On the characterization of exponential polynomials, Arch. Math.
(Basel) 71 A998), no. 3, 201-210. MR 99e:11019
765. W. F. Lunnon, P. A. B. Pleasants, and N. M. Stephens, Arithmetic properties of Bell
numbers to a composite modulus. I, Acta Arith. 35 A979), no. 1, 1-16. MR 80k:05006
766. R. C. Lyness, Notes 1581, 1847 and 2952, Math. Gaz. 26, 29, 45 A942. 1945, 1961), 62,
231, 201.
767. F. J. MacWilliams and N. J. A. Sloane, The theory of error-correcting codes. I, North-
Holland Publishing Co., Amsterdam, 1977. MR 57 #5408a
768. , The theory of error-correcting codes. II, North-Holland Publishing Co., Amster-
Amsterdam, 1977. MR 57 #5408b
769. K. Mahler, Bine arithmetische Eigenschaft der rekurrierenden Reihen, Mathematika 3
A934), 1-4.
770. , Bine arithmetische Eigenschaft der Taylor Koeffizienten rationaler Funktionen,
Proc. Akad. Wet. Amsterdam 38 A935), 51-60.

286 BIBLIOGRAPHY
771. On the Taylor coefficients of rational functions, Proc. Cambridge Philos. Soc. 52
A956), 39-48, Addendum: 53 A957), 544. MR 17,597c
772. . A remark on recursive sequences, J. Math. Sci. 1 A966), 12-17. MR 35 #2853
773. . An unsolved problem on the powers of 3/2, J. Austral. Math. Soc. 8 A968), 313-
321. MR 37 #2694
774. , Arithmetical properties of the digits of the multiples of an irrational number, Bull.
Austral. Math. Soc. 8 A973), 191-203. MR 47 #8448
775. J. L. Malouf, An integer sequence from a rational recursion, Discrete Math. 110 A992),
no. 1-3, 257-261. MR 93m:11011
776. A. Manning, Axiom A diffeomorphisms have rational zeta functions, Bull. London Math.
Soc. 3 A971), 215-220. MR 44 #5982
777. M. Margenstern and Y. V. Matiyasevich, A binomial representation of the 3a; + 1 problem,
Acta Arith. 91 A999), no. 4, 367-378. MR 2001g:11015
778. G. Marsaglia, The mathematics of random number generators, The unreasonable effec-
effectiveness of number theory (Orono, ME, 1991), Amer. Math. Soc, Providence, RI, 1992,
pp. 73-90. MR 94a:11119
779..G. Martin, The least prime primitive root and the shifted sieve, Acta Arith. 80 A997),
no. 3, 277-288. MR 98c:11101
780. O. Martin, A. M. Odlyzko, and S. Wolfram, Algebraic properties of cellular automata,
Comm. Math. Phys. 93 A984), no. 2, 219-258. MR 86a:68073
781. R. C. Mason, The study of Diophantine equations over function fields, New advances in
transcendence theory (Durham, 1986), Cambridge Univ. Press, Cambridge, 1988, pp. 229-
247. MR 90e:11047
782. D. W. Masser, Counting points of small height on elliptic curves, Bull. Soc. Math. France
117 A989), no. 2, 247-265. MR 90k:11068
783. Mixing and equations over groups in positive characteristic, Preprint, 2002.
784. J. L. Massey and S. Sercpnek, Linear complexity of periodic sequences: a general the-
theory, Advances in cryptology—CRYPTO '96 (Santa Barbara, CA), Springer, Berlin, 1996.
pp. 358-371. MR 98i:94015
785. T. Matala-aho and M. Prevost, Irrationality measures for the series of reciprocals from
recurrence sequences, J. Number Theory 96 B002), 275-292.
786. Y. V. Matiyasevich, Hilbert's tenth problem, MIT Press, Cambridge, MA, 1993. MR
94m:03002b
787. K. Matsumoto, C*-algebras associated with cellular automata, Math. Scand. 75 A994),
no. 2. 195-216. MR 96a:46120
788. H. Matsumura, Commutative ring theory, second ed., Cambridge University Press, Cam-
Cambridge, 1989. MR 90i:13001
789. K. R. Matthews, Some Borel measures associated with the generalized Collatz mapping.
Colloq. Math. 63 A992), no. 2, 191-202. MR 93i:11090
790. The generalized 3x + 1 problem, Preprint, 1995.
791. R. Matthews, Strong pseudoprimes and generalized Carmichael numbers, Finite fields: the-
theory, applications, and algorithms (Las Vegas, NV, 1993), Amer. Math. Soc, Providence,
RI, 1994. pp. 227-233. MR 95g:11125
792. C. Mauduit and A. Sarkozy, On finite pseudorandom binary sequences. II. The Charn-
pernowne, Rudin-Shapiro, and Thue-Morse sequences, a further construction, J. Number
Theory 73 A998), no. 2, 256-276. MR 99m:11084
793. J. E. Maxfield, Normal k-tuples, Pacific J. Math. 3 A953), 189-196. MR 14,851b
794. G. L. Mayhew and S. W. Golomb, Linear spans of modified deBruijn sequences, IEEE
Trans. Inform. Theory 36 A990), 1166-1167,
795. J. Mazoyer and I. Rapaport, Additive cellular automata over Zp and the bottom of
(CA, <), Mathematical foundations of computer science, 1998 (Brno), Springer, Berlin,
1998, pp. 834-843. MR 2OOOb:68163
796. K. S. McCurley, Odds and ends from cryptology and computational number theory, Cryptol-
Cryptology and computational number theory (Boulder, CO, 1989), Amer. Math. Soc, Providence,
RI, 1990, pp. 145-166. MR 92j:11149
797. W. L. McDaniel and P. Ribenboim. Square-classes in Lucas sequences having odd parame-
parameters, J. Number Theory 73 A998), no. 1, 14-27. MR 99j:11017

BIBLIOGRAPHY 287
798. I. McFarlane and S. G. Hoggar, ¦jCombinatorics for faster fractal pictures. Number-theoretic
and algebraic methods in computer science (Moscow, 1993), World Sci. Publishing, River
Edge, NJ, 1995, pp. 95-124. MR 97f:68191
799. M. D. Mcllroy, Number theory in computer graphics, The unreasonable effectiveness of
number theory (Orono, ME, 1991), Amer. Math. Soc, Providence. RI, 1992, pp. 105-121.
MR94a:11199
800. J. F. McKee, Families of Pisot numbers with negative trace, Acta Arith. 93 B000), no. 4,
373-385. MR 2001b:11096
801. J. F. McKee. P. Rowlinson, and C. J. Smyth, Salem numbers and Pisot numbers from stars,
Number theory in progress, Vol. 1 (Zakopane-Koscielisko, 1997), de Gruyter, Berlin, 1999,
pp. 309-319. MR 2000d:11127
802. W. Meidl and H. Niederreiter, Counting functions and expected values for the k-error linear
complexity, Finite Fields Appl. 8 B002), 142-154.
803. , Linear complexity, k-error linear complexity and the discrete Fourier transform,
J. Complexity 18 B002), 87-103.
804. W. Meidl and A. Winterhof, Lower bounds on the linear complexity of the discrete logarithm
in finite fields. IEEE Trans. Inform. Theory 47 B001), no. 7, 2807-2811. MR 2003b:94079
805. , On the linear complexity profile of explicit nonlinear pseudorandom numbers, In-
Inform. Process. Lett. 85 B003), no. 1, 13-18. MR 1 950 157
806. W. Meier and O. Staffelbach, The self-shrinking generator, Advances in cryptology—
EUROCRYPT '94 (Perugia), Springer, Berlin, 1995, pp. 205-214.
807. D. Meiri, Entropy and uniform distribution of orbits in Td, Israel J. Math. 105 A998),
155-183. MR 99f:58129
808. M. Mendes France, The depth of a rational number, Topics in number theory (Proc. Colloq.,
Debrecen, 1974), North-Holland, Amsterdam, 1976, pp. 183-194. Colloq. Math. Soc. Janos
Bolyai, Vol. 13. MR 55 #12625
809. , The Rudin-Shapiro sequence, Ising chain, and paperfolding. Analytic number the-
theory (Allerton Park, IL, 1989), Birkhauser Boston, Boston, MA, 1990, pp. 367-382. MR
92e:11154
810. , Remarks and problems on finite and periodic continued fractions, Enseign. Math.
B) 39 A993). no. 3-4, 249-257. MR 94i:11045
811. M. Mendes France and A. J. van der Poorten, Arithmetic and analytic properties of paper
folding sequences, Bull. Austral. Math. Soc. 24 A981), no. 1, 123-131. MR 83b:10040
812. , Automata and the arithmetic of formal power series, Acta Arith. 46 A986), no. 3,
211-214. MR 88a:11064
813. A. J. Menezes, P. C. van Oorschot, and S. A. Vanstone, Handbook of applied cryptography,
CRC Press Series on Discrete Mathematics and its Applications, CRC Press, Boca Raton,
FL, 1997, With a foreword by Ronald L. Rivest. MR 99g:94015
814. L. Merel, Bornes pour la torsion des courbes elliptiques sur les corps de nombres, Invent.
Math. 124 A996), no. 1-3, 437-449. MR 96i:11057
815. C. Methfessel, Multiplicative and additive recurrent sequences, Arch. Math. (Basel) 63
A994), no. 4: 321-328. MR 95e:11018
816. , Rekurrente Folgen mit lokal gleichmdfiig beschrdnkter Primteileranzahl, Acta
Arith. 70 A995), no. 1, 1-7. MR 95k:11012
817. F. Mignosi, On a generalization of the 3x + 1 problem, J. Number Theory 55 A995), no. 1,
28-45. MR 96m:11016
818. M. Mignotte, A note on linear recursive sequences, J. Austral. Math. Soc. 20 A975), no. 2,
242-244. MR 52 #5581
819. , Une extension du theoreme de Skolem-Mahler, C. R. Acad. Sci. Paris Ser. A-B
288 A979), no. 4, A233-A235. MR 80b:10013
820. , Une extension de theoreme de Skolem-Mahler, Noncommutative structures in al-
algebra and geometric combinatorics (Naples, 1978), CNR, Rome, 1981, pp. 97-100. MR
83k: 10020
821. , Determination des repetitions d'une certaine suite recurrente lineaire, Publ. Math.
Debrecen 33 A986), no. 3-4, 297-306. MR 88h:llO12
822. , Proprietes arithmetiques des suites recurrentes lineaires. Theorie des nombres,
Annee 1988/89, Fasc. 1, Univ. Franche-Comte. Besancon, 1989, p. 30. MR 91g:11012

288 BIBLIOGRAPHY
823. M. Mignotte, T. N. Shorey, and R. Tijdeman, The distance between terms of an algebraic
recurrence sequence, J. Reine Angew. Math. 349 A984), 63-76. MR 85f:11007
824. M. Mignotte and N. Tzanakis, Arithmetical study of recurrence sequences, Acta Arith. 57
A991), no. 4, 357-364. MR 92c:11013
825. M. Mihaljevic, Y. Zheng, and H. Imai, A fast cryptographic hash function based on linear
cellular automata, Proc. IFIP 14th Intern. Inform. Security Conf., Vienna, 1998, Chapman
and Hall, to appear.
826. P. Mihailescu, Primary cyclotomic units and a proof of Catalan's conjecture, draft, Preprint,
2002.
827. A. V. Mikhalev and A. A. Nechaev, Linear recurring sequences over modules, Acta Appl.
Math. 42 A996), no. 2, 161-202. MR 97j:16031
828. G. L. Miller, Riemann's hypothesis and tests for primality, Seventh Annual ACM Sympo-
Symposium on Theory of Computing (Albuquerque, N.M., 1975), Assoc. Comput. Mach., New
York, 1975, pp. 234-239. MR 58 #470b
829. D. A. Mit'kin, Estimates and asymptotic formulas for rational trigonometric sums that are
nearly complete, Mat. Sb. (N.S.) 122A64) A983), no. 4, 527-545. MR 85c:11074
830. I. Miyamoto and M. Ram Murty, Elliptic pseudoprimes, Math. Comp. 53 A989), no. 187,
415-430. MR 89j:11055
831. H. L. Montgomery, Distribution of small powers of a primitive root, Advances in number
theory (Kingston, ON, 1991), Oxford Univ. Press, New York, 1993, pp. 137-149. MR
832. F. Montoya Vitini, J. Mufioz Masque, and A. Peinado Dominguez, Maximum cycles of qua-
quadratic functions in GFBn), XXX National Congress of the Mexican Mathematical Society
(Spanish) (Aguascalientes, 1997), Soc. Mat. Mexicana, Mexico, 1998, pp. 125-130.
833. , Linear complexity of the x2 mod p orbits, Inform. Process. Lett. 72 A999), no. 1-2,
3-7.
834. F. Morain, Pseudoprimes: a survey of recent results, Eurocode '92 (Udine, 1992), Springer,
Vienna, 1993, pp. 207-215. MR 95d:11172
835. W. Moran and A. D. Pollington, Metrical results on normality to distinct bases, J. Number
Theory 54 A995), no. 2, 180-189. MR 96i:11084
836. , The discrimination theorem for normality to non-integer bases, Israel J. Math.
100 A997), 339-347. MR 98h:11097
837. W. More, The LD probable prime test, Finite fields: theory, applications, and algo-
algorithms (Waterloo, ON, 1997), Amer. Math. Soc, Providence, RI, 1999, pp. 185-191. MR
99h:11145
838. P. Moree, On the prime density of Lucas sequences, J. Theor. Nombres Bordeaux 8 A996),
no. 2, 449-459. MR 98f:11127
839. , On a conjecture of Rodier on primitive roots, Abh. Math. Sem. Univ. Hamburg
67 A997), 165-171. MR 98i:11081
840. __, On the divisors of ak +bk, Acta Arith. 80 A997), no. 3, 197-212. MR 98e:11105
841. , Counting divisors of Lucas numbers, Pacific J. Math. 186 A998), no. 2, 267-284.
MR99m:110l3
842. , Improvement of an estimate of H. Mutter involving the order of 2 (mod u), Arch.
Math. (Basel) 71 A998), no. 3, 197-200. MR 99m:lllll
843. , On some sums connected with primitive roots,
www. mpim-bonn.mpg.de/html/preprints/preprints.html, 1998.
844. , On some sums involving primitive roots, 2,
www.mpim-bonn.mpg.de/html/preprints/preprints.html, 1998.
845. , On primes in arithmetic progression having a prescribed primitive root, J. Number
Theory 78 A999), no. 1, 85-98. MR 2001i:11118
846. Uniform distribution of primes having a prescribed primitive root, Acta Arith. 89
A999), no. 1, 9-21. MR 2000d:11121
847. , Approximation of singular series and automata, Manuscripta Math. 101 B000),
no. 3, 385-399, With an appendix by Gerhard Niklasch. MR 2001f:11204
848. , Asymptotically exact heuristics for (near) primitive roots, J. Number Theory 83
B000), no. 1, 155-181. MR 2001m:lll61
849. P. Moree and P. Stevenhagen, Prime divisors of Lucas sequences, Acta Arith. 82 A997),
no. 4, 403-410. MR 98i:11098

BIBLIOGRAPHY 289
850. , A two-variable Artin conjecture, J. Number Theory 85 B000), no. 2. 291-304. MR
2001k:11188
851. , Prime divisors of the Lagarias sequence, J. Theor. Nombres Bordeaux 13 B001),
no. 1, 241-251, 21st Journees Arithmetiques (Rome, 2001). MR 2002c:11016
852. M. D. Morgan, The distribution of second order linear recurrence sequences mod2m, Acta
Arith. 83 A998), no. 2, 181-195. MR 99e:11021
853. M. Morii and M. Kasahara, Perfect staircase profile of linear complexity for finite sequences,
Inform. Process. Lett. 44 A992), no. 2, 85-89. MR 93j:68081
854. K. Morita, Reversible simulation of one-dimensional irreversible cellular automata, Theo-
ret. Comput. Sci. 148 A995), no. 1, 157-163. MR 96h:68139
855. G. Morris and T. Ward, Entropy bounds for endomorphisms commuting with K actions,
Israel J. Math. 106 A998), 1-11. MR 99m:28042
856. P. Morton, Connections between binary patterns and paperfolding, Sem. Theor. Nombres
Bordeaux B) 2 A990), no. 1, 1-12. MR 91i:11010
857. , Arithmetic properties of periodic points of quadratic maps, Acta Arith. 62 A992),
no. 4, 343-372. MR 93k:12004
858. , Characterizing cyclic cubic extensions by automorphism polynomials, J. Number
Theory 49 A994), no. 2, 183-208. MR 95j:12006
859. , On certain algebraic curves related to polynomial maps, Compositio Math. 103
A996), no. 3, 319-350. MR 97m:14030
860. , Periods of maps on irreducible polynomials over finite fields, Finite Fields Appl. 3
A997), no. 1, 11-24. MR 98d:11075
861. , Arithmetic properties of periodic points of quadratic maps. II, Acta Arith. 87
A998), no. 2, 89-102. MR 2000c:11103
862. P. Morton and W. J. Mourant, Paper folding, digit patterns and groups of arithmetic
fractals, Proc. London Math. Soc. C) 59 A989), no. 2, 253-293. MR 91c:11007
863. P. Morton and P. Patel, The Galois theory of periodic points of polynomial maps, Proc.
London Math. Soc. C) 68 A994), no. 2, 225-263. MR 94i:11090
864. P. Morton and J. H. Silverman, Rational periodic points of rational functions, Internat.
Math. Res. Notices 2 A994), 97-110. MR 95b:11066
865. , Periodic points, multiplicities, and dynamical units, J. Reine Angew. Math. 461
A995), 81-122. MR 96b:11090
866. P. Morton and F. Vivaldi, Bifurcations and discriminants for polynomial maps. Nonlinearity
8 A995), no. 4, 571-584. MR 96k:11028
867. P. Moss, Algebraic realizability problems, Ph.D. thesis, The University of East Anglia, 2004.
868. M. J. Mossinghoff, Polynomials with small Mahler measure, Math. Comp. 67 A998),
no. 224, 1697-1705, S11-S14. MR 99a:11119
869. M. J. Mossinghoff, C. G. Pinner, and J. D. Vaaler, Perturbing polynomials with all their
roots on the unit circle, Math. Comp. 67 A998), no. 224, 1707-1726. MR 99b:26024
870. J. Mufioz Masque, F. Montoya Vitini, and A. Peinado Dominguez, Iterated quadratic func-
functions in F2n , Int. J. Appl. Math. 5 B001). no. 1, 65-83. MR 2002i:94045
871. J. Mueller, S-unit equations in function fields via the abc-theorem, Bull. London Math. Soc.
32 B000), no. 2, 163-170. MR 2001a:11053
872. G. L. Mullen and I. E. Shparlinski, Values of linear recurring sequences of vectors over
finite fields, Acta Arith. 65 A993), no. 3. 221-226. MR 94m:11144
873. G. L. Mullen and T. P. Vaughan, Cycles of linear permutations over a finite field, Linear
Algebra Appl. 108 A988), 63-82. MR 89m:11118
874. H. Muller, Uber eine Klasse 2-adischer Funktionen im Zusammenhang mit dem x + 1"-
Problem, Abh. Math. Sem. Univ. Hamburg 64 A994), 293-302. MR 95e:11032
875. , Eine Bemerkung uber die Ordnungen von 2 (mod u) bei ungeradem u, Arch. Math.
(Basel) 69 A997), no. 3, 217-220. MR 98i:11072
876. S. Muller. A note on strong Dickson pseudoprim.es, Appl. Algebra Engrg. Comm. Comput.
9 A998), no. 3, 247-264. MR 99J-.11008
877. , Carrnichael numbers and Lucas tests. Finite fields: theory, applications, and algo-
algorithms (Waterloo, ON, 1997), Amer. Math. Soc, Providence, RI, 1999, pp. 193-202. MR
99m:11008
878. , On the combined Ferrnat/Lucas probable prime test, Cryptography and coding
(Cirencester, 1999), Springer, Berlin, 1999. pp. 222-235. MR 2002h:11141

290 BIBLIOGRAPHY
879. , On the rank of appearance of Lucas sequences, Applications of Fibonacci numbers,
Vol. 8 (Rochester. NY. 1998), Kluwer Acad. Publ., Dordrecht, 1999, pp. 259-275. MR
2000j:11018
880. , On probable prime testing and the computation of square roots mod n, Algorithmic
number theory (Leiden, 2000), Springer, Berlin, 2000, pp. 423-437. MR 2002h:11140
881. , On QF-pseudoprimes and second-order recurrence sequences, Contributions to
general algebra, 12 (Vienna, 1999). Heyn, Klagenfurt, 2000, pp. 299-310. MR 2001e:11016
882. , On the rank of appearance and the number of zeros of the Lucas sequences over
Fq, Finite fields and applications (Augsburg, 1999), Springer, Berlin, 2001, pp. 390-408.
MR 2002e:11177
883. , A probable prime test with very high confidence for n = 1 mod 4, Lect. Notes in
Comp. Sci. 2248 B001), 87-106.
884. , Some remarks on primality testing based on Lucas functions, Number Theory for
the Millennium, Vol.Ill, A. K. Peters, Natick, MA, 2002, pp. 1-22.
885. W. B. Miiller and A. Oswald, Generalized Fibonacci pseudoprimes and probable primes,
Applications of Fibonacci numbers, Vol. 5 (St. Andrews, 1992), Kluwer Acad. Publ., Dor-
Dordrecht, 1993, pp. 459-464. MR 95f:11105
886. L. Murata. On the magnitude of the least primitive root, Asterisque 198-200 A991), 253-
257 A992). MR93b:11127
887. . , A problem analogous to Artin's conjecture for primitive roots and its applications,
Arch. Math. (Basel) 57 A991), no. 6, 555-565. MR 93c:11071
888. M. Ram Murty, On Artin's conjecture, J. Number Theory 16 A983), no. 2, 147-168. MR
86f: 11087
889. , An analogue of Artin's conjecture for abelian extensions. J. Number Theory 18
A984), no. 3, 241-248. MR 85j:11161
890. , Finitely generated groups (mod p), Proc. Amer. Math. Soc. 122 A994). no. 1,
37-45."MR94k:11113
891. , Artin's conjecture and elliptic analogues, Sieve methods, exponential sums, and
their applications in number theory (Cardiff, 1995), Cambridge Univ. Press, Cambridge,
1997, pp. 325-344. MR 2000a:11098
892. M. Ram Murty, V. Kumar Murty, and T. N. Shorey, Odd values of the Rarnanujan r-
function. Bull. Soc. Math. France 115 A987), no. 3, 391-395. MR 89c:11071
893. M. Ram Murty, M. Rosen, and J. H. Silverman, Variations on a theme of Romanoff,
Internat. J. Math. 7 A996), no. 3, 373-391. MR 97d:11093
894. M. Ram Murty and Wong S., The abc conjecture and prime divisors of the Lucas and
Lehmer sequences, Number Theory for the Millennium, Vol.Ill, A. K. Peters, Natick, MA,
2002, pp. 43-54.
895. M. Ram Murty and S. Srinivasan, Some remarks on Artin's conjecture, Canad. Math. Bull.
30 A987), no. 1, 80-85. MR 88e:11094
896. G. Myerson, A combinatorial problem in finite fields. I, Pacific J. Math. 82 A979), no. 1,
179-187. MR 80i:05010
897. , A combinatorial problem in finite fields. II, Quart. J. Math. Oxford Ser. B) 31
A980), no. 122, 219-231. MR 81i:05014
898. , An arithmetic property of certain rational powers, Preprint, 1997.
899. G. Myerson and A. J. van der Poorten, Some problems concerning recurrence sequences,
Amer. Math. Monthly 102 A995), no. 8, 698-705. MR 97a:11029
900. I. T. Nabney. Growth functions for groups and recurrence sequences, Proc. London Math.
Soc. C) 63 A991), no. 2, 315-343. MR 92f:20030
901. H. Nakada, Metrical theory for a class of continued fraction transformations and their
natural extensions, Tokyo J. Math. 4 A981), no. 2, 399-426. MR 83k:10095
902. T. Nakahara, On a periodic solution of some congruences, Rep. Fac. Sci. Engrg. Saga Univ.
Math. 14 A986), 1-5. MR 87e: 11004
903. K. Nakamula and A. Petho, Squares in binary recurrence sequences, Number theory (Eger,
1996), de Gruyter, Berlin, 1998, pp. 409-421. MR 99g:11020
904. S. Nandi, B. K. Kar, and P. Pal Chaudhuri, Theory and applications of cellular automata
in cryptography, IEEE Trans. Comput. 43 A994), no. 12, 1346-1357. MR 95k:94023
905. M. Naor and O- Reingold, Number-theoretic constructions of efficient pseudo-random func-
functions, Proc. 38th IEEE Symp. on Foundations of Comp. Sci., IEEE, 1997, pp. 458-467.

BIBLIOGRAPHY 291
906. W. Narkiewicz, Classical problems in number theory, Paristwowe Wydawnictwo Naukowe
(PWN), Warsaw, 1986. MR 90e:11002
907. , A note on Artin's conjecture in algebraic number fields, J. Reine Angew. Math.
381 A987), 110-115. MR89a:11007
908. . Units in residue classes, Arch. Math. (Basel) 51 A988), no. 3, 238-241. MR
89k:11097
909. , Elementary and analytic theory of algebraic numbers, second ed., Springer-Verlag,
Berlin, 1990. MR 91h:11107
910. , Polynomial mappings, Springer-Verlag, Berlin, 1995. MR 97e:11037
911. W. Narkiewicz and T. Pezda, Finite polynomial orbits in finitely generated domains,
Monatsh. Math. 124 A997), no. 4, 309-316. MR 99b:11117
912. V. I. Necaev, The group of non-singular matrices over a finite field, and recurrent sequences,
Dokl. Akad. Nauk SSSR 152 A963), 275-277. MR 27 #5748
913. . Linear recurrent congruences with periodic coefficients, Mat. Zametki 3 A968),
625-632. MR 38 #3241
914. , Recurrent sequences, Algebra and number theory, Moskov. Gos. Ped, Inst. Ucen.
Zap. 375 A971), 103-123. MR 48 #5983
915. . Trigonometric sums for recurrent sequences of elements of a finite field, Mat.
Zametki 11 A972), 597-607. MR 48 #3893
916. V. I. Necaev and L. L. Stepanova, The distirbution of nonresidues and primitive roots in
recurrence sequences over a field of algebraic numbers, Uspehi Mat. Nauk 20 A965), no. 3
A23), 197-203. MR 33 #115
917. A. A. Nechaev, Linear recurrent sequences over commutative rings, Diskret. Mat. 3 A991),
no. 4, 105-127. MR 93b: 13028
918. , Cycle types of linear maps over finite commutative rings, Mat. Sb. 184 A993),
no. 3, 21-56. MR 94e:15028
919. , Linear codes and polylinear recurrences over finite rings and quasi-Frobenius mod-
modules, Dokl. Akad. Nauk 345 A995), no. 4, 451-454.
920. Yu. V. Nesterenko, Estimates for the number of zeros of functions of certain classes, Acta
Arith. 53 A989), no. 1, 29-46. MR 91d:11078
921. Yu. V. Nesterenko and T. N. Shorey, On an equation of Goormaghtigh. Acta Arith. 83
A998). no. 4, 381-389. MR 98m:11022
922. S.-H. Ng and E. J. Taft, Quantum convolution of linearly recursive sequences, J. Algebra
198 A997), no. 1, 101-119. MR 98k: 16055
923. P. Q. Nguyen and I. E. Shparlinski, The insecurity of the digital signature algorithm with
partially known nonces, J. Cryptology 15 B002), no. 3, 151-176. MR 1 927 452
924. The insecurity of the elliptic curve Digital Signature Algorithm with partially
known nonces, Design, Codes and Cryptography (to appear).
925. H. Niederreiter, Quasi-Monte Carlo methods and pseudo-random numbers, Bull. Amer.
Math. Soc. 84 A978), no. 6, 957-1041. MR 80d:65016
926. , Distribution properties of feedback shift register sequences, Problems Control In-
Inform. Theory/Problemy Upravlen. Teor. Inform. 15 A986), no. 1, 19-34. MR 87m:94029
927. On a problem of Kodama concerning the Hasse- Witt matrix and the distribution
of residues, Proc. Japan Acad. Ser. A Math. Sci. 63 A987), no. 9, 367-369. MR 90a:11007
928. . Rational functions with partial quotients of small degree in their continued fraction
expansion, Monatsh. Math. 103 A987), no. 4, 269-288. MR 88h:12002
929. , Sequences with almost perfect linear complexity profile, Lect. Notes in Comp. Sci.
304 A988), 37-51.
930. . The serial test for digital k-step pseudorandom numbers, Math. J. Okayama Univ.
30 A988), 93-119. MR 90g:65011
931. , Some new cryptosystems based on feedback shift register sequences, Math. J.
Okayama Univ. 30 A988), 121-149. MR 90a:94039
932. . A combinatorial approach to probabilistic results on the linear-complexity profile
of random sequences, J. Cryptology 2 A990), no. 2, 105-112. MR 91g:94018
933. , Keystream sequences with a good linear complexity profile for every starting point,
Advances in cryptology—EUROCRYPT '89 (Houthalen, 1989), Springer, Berlin, 1990:
pp. 523-532.

292 BIBLIOGRAPHY
934. , The linear complexity profile and the jump complexity of keystream sequences, Ad-
Advances in cryptology—EUROCRYPT '90 (Aarhus, 1990), Springer, Berlin, 1991, pp. 174-
188.
935. , Recent trends in random number and random vector generation, Ann. Oper. Res.
31 A991), no. 1-4, 323-345. MR 92h:65010
936. , Random number generation and quasi-Monte Carlo methods, Society for Industrial
and Applied Mathematics (SIAM), Philadelphia, PA, 1992. MR 93h:65008
937. , Finite fields and cryptology, Finite fields, coding theory, and advances in commu-
communications and computing (Las Vegas, NV, 1991), Dekker, New York, 1993, pp. 359-373.
MR 93m:11133
938. , New developments in uniform pseudorandom number and vector generation, Monte
Carlo and quasi-Monte Carlo methods in scientific computing (Las Vegas, NV, 1994),
Springer, New York, 1995, pp. 87-120. MR 97k:65019
939. , Pseudorandom vector generation by the multiple-recursive matrix method, Math.
Comp. 64 A995), no. 209, 279-294. MR95j:65006
940. , Some computable complexity measures for binary sequences, Sequences and their
applications (Singapore, 1998), Springer, London, 1999, pp. 67-78. MR 2002j:94045
941. H. Niederreiter and H. Paschinger, Counting functions and expected values in the stability
theory of stream ciphers, Sequences" and their applications (Singapore, 1998), Springer,
London, 1999, pp. 318-329. MR 2002f:94041
942. H. Niederreiter and I. E. Shparlinski, On the distribution and lattice structure of nonlinear
congruential pseudorandom numbers, Finite Fields Appl. 5 A999), no. 3, 246-253. MR
2000i:11126
943. , Exponential sums and the distribution of inversive congruential pseudorandom
numbers with prime-power modulus, Acta Arith. 92 B000), no. 1, 89-98. MR 2001g:11127
944. , On the distribution of pseudorandom numbers and vectors generated by inver-
inversive methods, Appl. Algebra Engrg. Comm. Comput. 10 B000), no. 3, 189-202. MR
2001f:11130
945. , On the distribution of inversive congruential pseudorandom numbers in parts of
the period, Math. Comp. 70 B001), no. 236, 1569-1574. MR 2002e:11104
946. , On the average distribution of inversive pseudorandom numbers, Finite Fields and
Their Appl. 8 B002), 491-503.
947. , Recent advances in the theory of nonlinear pseudorandom number generators,
Proc. Conf. on Monte Carlo and Quasi-Monte Carlo Methods, 2000, Springer. Berlin, 2002,
pp. 86-102.
948. , Dynamical systems generated by rational functions, Lect. Notes in Comp. Sci. 2643
B003).
949. , On the distribution of power residues and primitive elements in some nonlinear
recurring sequences, Bull. London Math. Soc. (to appear).
950. H. Niederreiter and M. Vielhaber, Tree complexity and a doubly exponential gap between
structured and random sequences, J. Complexity 12 A996), no. 3, 187-198. MR 97g:94025
951. , Linear complexity profiles: Hausdorff dimensions for almost perfect profiles and
measures for general profiles, J. Complexity 13 A997), no. 3, 353-383. MR 99f:94012
952. , Simultaneous shifted continued fraction expansions in quadratic time, Appl. Alge-
Algebra Engrg. Comm. Comput. 9 A998), no. 2, 125-138. MR 99k:11195
953. , An algorithm for shifted continued fraction expansions in parallel linear time.
Theoret. Comput. Sci. 226 A999), no. 1-2, 93-104. MR 2001m:94048
954. H. Niederreiter and A. Winterhof, Incomplete exponential sums over finite fields and their
applications to new inversive pseudorandom number generators, Acta Arith. 93 B000),
no. 4, 387-399. MR 2001d:11120
955. , On a new class of inversive pseudorandom numbers for parallelized simulation
methods, Period. Math. Hungar. 42 B001), no. 1-2, 77-87. MR 2002b:65011
956. , On the distribution of compound inversive congruential pseudorandom numbers,
Monatsh. Math. 132 B001), no. 1, 35-48. MR 2002g:11113
957. , On the lattice structure of pseudorandom numbers generated over arbitrary finite
fields, Appl. Algebra Engrg. Comm. Comput. 12 B001), no. 3, 265-272. MR 2002f:11102
958. G. Niklasch, Counting exceptional unite, Collect. Math. 48 A997), no. 1-2, 195-207. MR
98g:11124

BIBLIOGRAPHY 293
959. G. Niklasch and R. Queme, An improvement of Lenstra's criterion for Euclidean number
fields: the totally real case, Acta Arith. 58 A991), no. 2, 157-168. MR 92f:11149
960. K. Nishioka, Mahler functions and transcendence, Springer-Verlag, Berlin, 1996. MR
98d:11084
961. , Algebraic independence of reciprocal sums of binary recurrences, Monatsh. Math.
123 A997), no. 2, 135-148. MR 98a:11095
962. , Algebraic independence of reciprocal sums of binary recurrences, II, Monatsh.
Math. 136 B002), 123-141. MR 2003c:11083
963. J.-S. No, H. Chung, H.-Y. Song, K. Yang, J.-D. Lee, and T. Helleseth, New construction
for binary sequences of period pm — 1 with optimal autocorrelation'using (z +.l)d + azd -\-b,
IEEE Trans. Inform. Theory 47 B001), no. 4, 1638-1644. MR 2002f:94078
964. J.-S. No, H. Chung, and M.-S. Yun, Binary pseudorandom sequences of period 2m — 1 with
ideal autocorrelation generated by the polynomial zd + (z + l)d, IEEE Trans. Inform. Theory
44 A998), no. 3, 1278-1282. MR 99c:94021
965. J.-S. No, S. VV. Golomb, G. Gong, H.-K. Lee, and P. Gaal, Binary pseudorandom sequences
of period 2n — 1 with ideal autocorrelation, IEEE Trans. Inform. Theory 44 A998), no. 2,
814-817.
966. J.-S. No, K. Yang, H. Chung, and H.-Y. Song, New construction for families of binary
sequences with optimal correlation properties, IEEE Trans. Inform. Theory 43 A997), no. 5,
1596-1602. MR98f:11134
967. D. G. Northcott, Periodic points on an algebraic variety, Ann. of Math. B) 51 A950),
167-177. MR 11,615c
968. G. H. Norton, On the minimal realizations of a finite sequence, J. Symbolic Comput. 20
A995), no. 1, 93-115. MR 97h:13027
969. , On minimal realization over a finite chain ring, Des. Codes Cryptogr. 16 A999),
no. 2, 161-178. MR 2000f:13048
970. , On shortest linear recurrences, J. Symbolic Comput. 27 A999), no. 3, 325-349.
MR 2000i:13033
971. W.-G. Nowak and R. F. Tichy, An improved estimate on the distribution mod 1 of powers
of real matrices, Compositio Math. 49 A983), no. 2, 283-289. MR 84m:10044
972. R. W. K. Odoni, A conjecture of Krishnamurthy on decimal periods and some allied prob-
problems, J. Number Theory 13 A981), no. 3, 303-319. MR 83a:10098
973. , The Galois theory of iterates and composites of polynomials, Proc. London Math.
Soc. C) 51 A985), no. 3, 385-414. MR 87c:12005
974. , On the prime divisors of the sequence wn+i = 1 + u>i • • • wn, J- London Math. Soc.
B) 32 A985), no. 1, 1-11. -MR 87b:11094
975. , On the Galois groups of iterated generic additive polynomials, Math. Proc. Cam-
Cambridge Philos. Soc. 121 A997), no. 1, 1-6. MR 98g:12004
976. T. Oliveira e Silva, Maximum excursion and stopping time record-holders for the 3x-)-l prob-
problem: computational results, Math. Comp. 68 A999), no. 225, 371-384. MR 2000g:11015
977. F. Pappalardi, On Hooley's theorem with weights, Rend. Sem. Mat. Univ. Politec. Torino
53 A995). no. 4, 375-388. MR 98c:11102
978. , On minimal sets of generators for primitive roots, Canad. Math. Bull. 38 A995),
no. 4, 465-468. MR 96k:11120
979. , On the order of finitely generated subgroups of Q* (mod p) and divisors ofp — 1,
J. Number Theory 57 A996), no. 2, 207-222. MR 97d:11141
980. F. Pappalardi and I. E. Shparlinski, On Artin's conjecture over function fields, Finite Fields
Appl. 1 A995): no. 4, 399-404. MR 97g:11132
981. W. Parry, An analogue of the prime number theorem for closed orbits of shifts of finite type
and their suspensions, Israel J. Math. 45 A983), no. 1, 41-52. MR 85c:58089
982. W. Parry and M. Pollicott, An analogue of the prime number theorem for closed orbits of
Axiom A flows, Ann. of Math. B) 118 A983), no. 3, 573-591. MR 85i:58105
983. , Zeta functions and the periodic orbit structure of hyperbolic dynamics, Asterisque
187-188 A990), 268. MR 92f:58141
984. K. G. Paterson, Root counting, the DFT and the linear complexity of nonlinear filtering,
Des. Codes Cryptogr. 14 A998), no. 3, 247-259. MR 2000j:94008
985. K. G. Paterson and P. J. G. Lothian, Bounds on partial correlations of sequences, IEEE
Trans. Inform. Theory 44 A998), no. 3, 1164-1175. MR 99c:94022

294 BIBLIOGRAPHY
986. A. Peinado Domi'nguez, F. Montoya Vitini, J. Munoz Masque, and A. J. Yuste. Maximal
periods of x2 +c in Fq, Lect. Notes in Comp. Sci. 2227 B001), 219-228.
987. A. Perelli and U. Zannier, Arithmetic properties of certain recurrence sequences, J. Austral.
Math. Soc. Ser. A 37 A984), no. 1, 4-16. MR 85i:11016
988. A. Petho, Perfect powers in second order linear recurrences, J. Number Theory 15 A982),
no. 1, 5-13. MR 84f:10024
989. . Divisibility properties of linear recursive sequences, Number theory, Vol. II (Bu-
(Budapest, 1987), North-Holland, Amsterdam, 1990, pp. 899-916. MR 91i: 11019
990. . Diophantine properties of linear recursive sequences. I, Applications of Fibonacci
numbers, Vol. 7 (Graz, 1996), Kluwer Acad. Publ, Dordrecht, 1998, pp. 295-309.
991. A. Petho and R. F. Tichy, S-unit equations, linear recurrences and digit expansions, Publ.
Math. Debrecen 42 A993), no. 1-2, 145-154. MR 94a:11013
992. A. Petho and H. G. Zimmer, Lineare rekurrente Folgen auf elliptischen Kurven, Sem.
Theor. Nombres Bordeaux B) 2 A990), no. 1, 217-227. MR 91k:11044
993. T. Pezda, Cycles of polynomial mappings in several variables, Manuscripta Math. 83 A994),
no. 3-4r 279-289. MR 95f: 11094
994. . Polynomial cycles in certain local domains, Acta Arith. 66 A994), no. 1, 11-22.
MR 95a: 11102
995^ , Cycles of polynomials in algebraically closed fields of positive chracteristic. II,
Colloq. Math. 71 A996), no. 1, 23-30. MR 97g: 11026
996. , Cycles of rational mappings in algebraically closed fields of positive characteristics,
Ann. Math. Sil. 12 A998), 15-21, Number theory (Cieszyn, 1998). MR 99m:11024
997. . Cycles of polynomial mappings in several variables over rings of integers in finite
extensions of the rationals, Acta Arith. 108 B003), no. 1, 127-146.
998. T. Pheidas, An effort to prove that the existential theory of Q is undecidable, Hilbert's
tenth problem: relations with arithmetic and algebraic geometry (Ghent, 1999), Contemp.
Math., vol. 270, Amer. Math. Soc, Providence, RI, 2000, pp. 237-252. MR 2001m:03085
999. B. M. Phong. On generalized Lehmer sequences, Acta Math. Hungar. 57 A991). no. 3-4.
201-211. MR92m:11021
1000. T. A. Pierce, Numerical factors of the arithmetic forms YYI=1{1 ± aT)< Ann- of Math. 18
A917), 53-64.
1001. R. G. E. Pinch, Recurrent sequences modulo prime powers, Cryptography and coding. Ill
(Cirencester. 1991), Oxford Univ. Press, New York, 1993, pp. 297-310. MR 95b:11019
1002. A. Pinter, Exponential Diophantine equations over function fields, Publ. Math. Debrecen
41 A992), no. 1-2, 89-98. MR 93i:11039
1003. P. Piret. An upper bound on the weight distribution of some systematic codes, IEEE Trans.
Inform. Theory 31 A985), no. 4, 520-521. MR 86i:94054
1004. I. M. Pjatetski-Shapiro, On the distribution of franction parts of exponential functions.
Proc. Moscow State Pedagogical Inst. 108 A957), 317-322.
1005. V. Pless, P. Sole, and Z. Qian, Cyclic self-dual Z^-codes, Finite Fields Appl. 3 A997), no. 1.
48-69. With an appendix by P. Moree. MR 97m:94036
1006. M. Poe. On distribution of solutions of S-unit equations, J. Number Theory 62 A997),
no. 2, 221-241. MR 97k:11043
1007. A. M. Polosuev, The structure of the solutions of linear recurrent congruences with coeffi-
coefficients that are periodic modulo a prime, Vestnik Moskov. Univ. Ser. I Mat. Meh. 27 A972),
no. 1. 57-61. MR 46 #7145 .
1008. G. Polya, Arithmetische eigenschaften der Reihenentwicklungen rationaler Funktionen, J.
Reiue Angew. Math. 151 A920), 1-31.
1009. G. Polya and G. Szego, Problevis and theorems in analysis. I, German ed., Springer-Verlag,
Berlin, 1978. MR 81e:00002
1010. C. Pomerance, J. M. Robson, and J. Shallit, -Automaticity. II. Descriptional complexity in
the unary case, Theoret. Comput. Sci. 180 A997), no. 1-2, 181-201. MR 99a:11026
1011. A. J. van der Poorten, Generalizing Turdn's main theorems on lower bounds for sums of
powers, Acta Math. Acad. Sci. Hungar. 24 A973), 93-96. MR 47 #2038
1012. . A note on recurrence sequences, J. Proc. Roy. Soc. New South Wales 106 A973),
no. 3-4, 115-117 A974). MR 52 #14740
1013. • Herrnite interpolation and p-adic exponential polynomials, J. Austral. Math. Soc.
Ser. A 22 A976), no. 1, 12-26. MR 56 #5453

BIBLIOGRAPHY 295
1014. , On the distribution of zeros of exponential polynomials, Math. Slovaca 26 A976).
no. 4, 299-307. MR 55 #3226
1015. , Zeros of p-adic exponential polynomials, Nederl. Akad. Wetensch. Proc. Ser. A 79
= Indag. Math. 38 A976), no. 1, 46-49. MR 53 #5543
1016. , Effectively computable bounds for the solutions of certain Diophantine equations,
Acta Arith. 33 A977), no. 3, 195-207. MR 56 #8491
1017. , Linear forms in logarithms in the p-adic case, Transcendence theory: advances and
applications (Proc. Conf., Univ. Cambridge, Cambridge, 1976), Academic Press, London,
1977, pp. 29-57. MR 58 #16544
1018. , On the number of zeros of functions. Enseignement Math. B) 23 A977), no. 1-2,
19-38. MR 57 #16221
1019. , The growth conditions for recurrence sequences, Macquarie University Mathemat-
Mathematical Reports 41 A982), 27pp.
1020. , Identification of rational functions: lost and regained, C. R. Math. Rep. Acad. Sci.
Canada 4 A982), no. 5, 309-314. MR 84c:10009
1021. , Hadamard operations on rational functions, Study group on ultrametric analysis,
10th year: 1982/83, No. 1, Inst. Henri Poincare, Paris, 1984, pp. Exp. No. 4. 11. MR
85k:11050
1022. , p-adic methods in the study of Taylor coefficients of rational functions, Bull. Aus-
Austral. Math. Soc. 29 A984). no. 1, 109-117. MR 86g:11073
1023. , Some problems of recurrent interest, Topics in classical number theory, Vol. I, II
(Budapest. 1981), North-Holland, Amsterdam. 1984, pp. 1265-1294. MR 86h:11015
1024. ,-Remarks on automata, functional equations and transcendence, Semin. de Theorie
des Nombres de Bordeaux 27 A988), 1-11.
1025. , Solution de la conjecture de Pisot sur le quotient de Hadamard de deux fractions
rationnelles. C. R. Acad. Sci. Paris Ser. I Math. 306 A988), no. 3. 97-102. MR 89c:11153
1026. , Some facts that should be better known, especially about rational functions, Number
theory and applications (Banff, AB, 1988), Kluwer Acad. Publ., Dordrecht, 1989, pp. 497-
528. MR92k:11011
1027. , Notes on -continued fractions and recurrence sequences. Number theory and cryp-
cryptography (Sydney, 1989). Cambridge Univ. Press, Cambridge. 1990. pp. 86-97. MR
91e:11079
1028. , Recurrence sequences, continued fractions, and the Hadamard Quotient Theorem,
Macquarie Math. Report 92-109, Macquarie Univ., 1992.
1029. , Continued fractions of formal power series, Advances in number theory (Kingston,
ON, 1991), Oxford Univ. Press, New York, 1993, pp. 453-466. MR 97a: 11017
1030. , Power series representing algebraic functions, Seminaire de Theorie des Nombres,
Paris, 1990-91, Birkhauser Boston, Boston. MA, 1993, pp. 241-262. MR 95d:13030
1031. , Explicit formulas for units in certain quadratic number fields, Algorithmic number
theory (Ithaca, NY, 1994), Springer, Berlin, 1994, pp. 194-208. MR 96b:11146
1032. , Factorisation in fractional powers. Acta Arith. 70 A995), no. 3. 287-293. MR
96c:12001
1033. , .4 note on Hadamard roots of rational functions, Rocky Mountain J. Math. 26
A996), no. 3, 1183-1197. MR 98b:11009
1034. , Notes on Fermat's last theorem, John Wiley & Sons Inc., New York, 1996. MR
98c:11026
1035. A. J. van der Poorten and R. S. Rurnely, Zeros of p-adic exponential polynomials. II, J.
London Math. Soc. B) 36 A987), no. 1, 1-15. MR 88m:11103
1036. A. J. van der Poorten and H. P. Schlickewei, A Diophantine problem in harmonic analysis,
Math. Proc. Cambridge Philos. Soc. 108 A990), no. 3, 417-420. MR 91j:11052
1037. , Additive relations infields, J. Austral. Math. Soc. Ser. A 51 A991). no. 1, 154-170.
MR 93d:11036
1038. , Zeros of recurrence sequences, Bull. Austral. Math. Soc. 44 A991), no. 2, 215-223.
MR93d:11017
1039. A. J. van der Poorten and J. Shallit, Folded continued fractions, J. Number Theory 40
A992), no. 2, 237-250. MR 93a:11008

296 BIBLIOGRAPHY
1040. A. J. van der Poorten and I. E. Shparlinski, On the number of zeros of exponential poly-
polynomials and related questions, Bull. Austral. Math. Soc. 46 A992), no. 3, 401-412. MR
931:11041
1041. , On sequences of polynomials defined by certain recurrence relations, Acta Sci.
Math. (Szeged) 61 A995), no. 1-4, 77-103. MR 97j:11007
1042. , On linear recurrence sequences with polynomial coefficients, Glasgow Math. J. 38
A996), no. 2, 147-155. MR97b:11013
1043. A. J. van der Poorten and R. Tijdeman, On common zeros of exponential polynomials,
Enseignement Math. B) 21 A975), no. 1, 57-67. MR 52 #292
1044. A. G. Postnikov, A solution of a set of simultaneous difference equations corresponding to
the Dirichlet problem by means of a normal sequence of digits, Dokl. Akad. Nauk SSSR
123 A958), 407-409. MR 21 #3043
1045. , Arithmetic modeling of random processes, Trudy Mat. Inst. Steklov. 57 A960), 84.
MR 26 #6146
1046. , Ergodic problems in the theory of congruences and of Diophantine approximations,
American Mathematical Society, Providence, R.I., 1967. MR 35 #5409
1047. L. P. Postnikova and A. Sincel', Primitive divisors of the expression an — bn in algebraic
number fields, Mat. Sb. (N.S.) 75 A17) A968), 171-177. MR 36 #6378
1048. C. Powell, Bounds for multiplicative cosets over fields of prime order, Math. Comp. 66
A997), no. 218, 807-822. MR 97f:11005
1049. K. Prachar, Primzahlverteilung, Springer-Verlag, Berlin, 1978. MR 81k:10060
1050. C. E. Praeger, Primitive prime divisor elements in finite classical groups, Groups St.
Andrews 1997 in Bath, II, Cambridge Univ. Press, Cambridge, 1999, pp. 605-623. MR
2000h:20090
1051. V. R. Pratt, Every prime has a succinct certificate, SIAM J. Comput. 4 A975), no. 3,
214-220. MR 52 #12395 . '
1052. J. Propp, The Somos Sequence Site, www.math.wisc.edu/~propp/somos.html.
1053. Y. Puri, Arithmetic Properties of Periodic Orbits, Ph.D. thesis, The University of East
Anglia, 2000.
1054. Y. Puri and T. Ward, Arithmetic and growth of periodic orbits, J. Integer Seq. 4 B001),
no. 2, Article 01.2.1, 18 pp. MR 2002i:11026
1055. , A dynamical property unique to the Lucas sequence, Fibonacci Quart. 39 B001),
no. 5, 398-402. MR 2002j:37020
1056. L. N. Pushkin. A metric variant of the Cassels-Schmidt theorem, Mat. Zametki 46 A989),
no. 1, 60-66, 124. MR 90h:11067
1057. , Vectors that are Borel normal on a manifold in Mn, Teor. Veroyatnost. i Primenen.
36 A991), no. 2, 372-376. MR 92g:11078
1058. M. van der Put, Reduction modulo p of differential equations, Indag. Math. (N.S.) 7 A996),
no. 3, 367-387. MR 99e: 12009
1059. M. O. Rabin, Computationally hard algebraic problems (extended abstract), 37th Annual
Symposium on Foundations of Computer Science (Burlington, VT, 1996), IEEE Comput.
Soc. Press, Los Alamitos, CA, 1996, pp. 284-289.
1060. C. Radoux, Nombres de Bell, modulo p premier, et extensions de degre p de Fp, C. R.
Acad. Sci. Paris Ser. A-B 281 A975), no. 21, Ai, A879-A882. MR 53 #13105
1061. U. Rausch, Geometrische Reihen in algebraischen Zahlkorpern, Acta Arith. 47 A986),
no. 4, 313-345. MR 89b:11074
1062. , A summation formula in algebraic number fields and applications. I, J. Number
Theory 36 A990), no. 1, 46-79. MR 92b:11082
1063. L. Redei, Lacunary polynomials over finite fields, North-Holland Publishing Co., Amster-
Amsterdam, 1973. MR 50 #4548
1064. B. Reznick, Some binary partition functions, Analytic number theory (Allerton Park, IL,
1989), Birkhauser Boston, Boston, MA, 1990, pp. 451-477. MR 91k:11092
1065. P. Ribenboim, On the factorization ofXn-BX-A, Enseign. Math. B) 37 A991), no. 3-4,
191-200. MR93d:11030
1066. , Catalan's conjecture, Academic Press Inc., Boston, MA, 1994. MR 95a:11029
1067. , The Fibonacci numbers and the Arctic Ocean, Proceedings of the 2nd Gauss Sym-
Symposium. Conference A: Mathematics and Theoretical Physics (Munich, 1993) (Berlin), de
Gruyter, 1995, pp. 41-83. MR 96g:11015

BIBLIOGRAPHY 297
1068. , An algorithm to determine the points with integral coordinates in certain elliptic
curves, J. Number Theory 74 A999), no. 1, 19-38. MR 99j:11028
1069. , Binary recurring sequences and powers. I, Number theory in progress, Vol. 1
(Zakopane-Koscielisko, 1997), de Gruyter, Berlin, 1999, pp. 419-430. MR 2000k:11035
1070. , Binary recurring sequences and powers. II, Publ. Math. Debrecen 54 A999), no. 3-
4, 349-375. MR 2000k: 11036
1071. , On square factors of terms of binary recurring sequences and the ABC conjecture,
Publ. Math. Debrecen 59 B001), no. 3-4, 459-469. MR 2002i: 11033
1072. , The terms Cxh (h > 3) in Lucas sequences: An algorithm and applications to
Diophantine equations, Acta Arith. 106 B002), 105-114.
1073. P. Ribenboirn and W. L. McDaniel, The square terms in Lucas sequences, J. Number Theory
58 A996), no. 1, 104-123. MR 97c:11021
1074. , On Lucas sequence terms of the form kx , Number theory (Turku, 1999), de
Gruyter, Berlin, 2001, pp. 293-303. MR 2002b:11028
1075. P. Ribenboim and P. G. Walsh, The ABC conjecture and the powerful part of terms in
binary recurring sequences, J. Number Theory 74 A999), no. 1, 134-147. MR 99k: 11047
1076. K. A. Ribet. On modular representations of Gal(Q/Q) arising from modular forms, Invent.
Math. 100 A990), no. 2, 431-476. MR 91g:11066
1077. G. J. Rieger, Mischung und Ergodizitdt bei Kettenbruchen nach ndchsten Ganzen, J. Reine
Angew. Math. 310 A979), 171-181. MR 81c:10066
1078. H. J. J. te Riele, Iteration of number-theoretic functions, Nieuw Arch. Wisk. D) 1 A983),
no. 3, 345-360. MR 85e: 11003
1079. H. Riesel, Prime numbers and computer methods for factorization, second ed., Birkhauser
Boston Inc., Boston, MA, 1994. MR 95h:11142
1080. J. F. Ritt. A factorisation theory for functions J2?=i aieC"iZ> Trans. Amer. Math. Soc. 29
A927), 584-596.
1081. , Algebraic combinations of exponentials, Trans. Amer. Math. Soc. 31 A929), 654-
679.
1082. On the zeros of exponential polynomials, Trans. Amer. Math. Soc. 31.A929), 680-
686.
1083. P. Robba. Zeros de suites recurrentes lineaires, Groupe d'Etude d'Analyse Ultrametrique,
5e annee A977/78), Secretariat Math., Paris, 1978, pp. Exp. No. 13, 5. MR 80b:10015
1084. R. M. Robinson, Periodicity of Somos sequences, Proc. Amer. Math. Soc. 116 A992), no.,
613-619. MR 93a:11012
1085. , Numbers having m small mth roots mod p, Math. Comp. 61 A993), no. 203,
393-413. MR 93k:11002
1086. A. M. Rockett, The metrical theory of continued fractions to the nearer integer, Acta Arith.
38 A980/81), no. 2, 97-103. MR 82d:10074
1087. P. Rogers. Topics in elliptic divisibility sequences, M.Phil, thesis, The University of East
Anglia, 2002.
1088. M. Roitman, On Zsigmondy primes, Proc. Amer. Math. Soc. 125 A997), no. 7, 1913-1919.
MR 97i:11005
1089. M. Rosen, Number theory in function fields, Graduate Texts in Mathematics, vol. 210,
Springer-Verlag, New York, 2002. MR 2003d: 11171
1090. H. Roskam. A quadratic analogue of Artin's conjecture on primitive roots. J. Number The-
Theory 81 B000), no. 1, 93-109. MR 2000k:11128
1091. , Prime divisors of linear recurrences and Artin's primitive root conjecture for
number fields, J. Theor. Nombres Bordeaux 13 B001), no. 1, 303-314, 21st Joumees
Arithmetiques (Rome, 2001). MR 2002c:11013
1092. A. Rotkiewicz, On strong Lehmer pseudoprimes in the case of negative discriminant in
arithmetic progressions, Acta Arith. 68 A994), no. 2, 145-151. MR 96h:11008
1093. Z. Rudnick, P. Sarnak, and A. Zaharescu, The distribution of spacings between the fractional
parts ofn2a, Invent. Math. 145 B001), no. 1, 37-57. MR 2002e:11093
1094. Z. Rudnick and A. Zaharescu, The distribution of spacings between small powers of a
primitive root, Israel J. Math. 120 B000), no. part A, 271-287. MR 2003e:11099
1095. R. A. Rueppel, Analysis and design of stream ciphers, Springer-Verlag, Berlin, 1986. MR
88h:94002
1096. , Stream ciphers, Contemporary cryptology, IEEE, New York, 1992, pp. 65-134.

298 BIBLIOGRAPHY
1097. R. A. Rueppel and J. L. Massey, Knapsack as a nonlinear function, IEEE Intern. Symp.
of Inform. Theory, IEEE, 1985, p. 46.
1098. R. A. Rueppel and O. J. Staffelbach, Products of linear recurring sequences with maximum
complexity, IEEE Trans. Inform. Theory 33 A987), 124-131.
1099. R. S. Rumely, Notes on van der Poorten's proof of the Hadamard quotient theorem. I, II,
Seminaire de Theorie des Nombres, Paris 1986-87, Birkhauser Boston, Boston, MA, 1988,
pp. 349-382, 383-409. MR 90d: 11090
1100. R. S. Rumely and A. J. van der Poorten, A note on the Hadamard kth root of a rational
function, J. Austral. Math. Soc. Ser. A 43 A987), no. 3, 314-327. MR 88j:11009
1101. , Remarks on generalised power sums, Bull. Austral. Math. Soc. 36 A987), no. 2,
311-329. MR 88j:11008
1102. I. Z. Ruzsa, Erdos and the integers, J. Number Theory 79 A999). no. 1, 115-163. MR
2002e:11002
1103. N. Saradha and T. N. Shorey, The equation (xn - l)/(x - 1) = yq with x square, Math.
Proc. Cambridge Philos. Soc. 125 A999), no. 1, 1-19. MR 99h:11037
1104. D. Sarwate and M. Pursley, Crosscorrelation properties of pseudorandom and related se-
sequences, Proc. IEEE 68 A980), 593-619.
1105. T. Sato, Decidability for some problems of linear cellular automata over finite commutative
rings, Inform. Process. Lett. 46 A993), no. 3, 151-155. MR 94h:68165
1106. , Group structured linear cellular automata over Zm, J. Comput. System Sci. 49
A994), no. 1, 18-23. MR 96b:68132
1107. , Ergodicity of linear cellular automata overZm, Inform. Process. Lett. 61 A997),
no. 3, 169-172. MR 97m:68148
1108. , Ergodic characterization of linear cellular automata, over Zm, Theoret. Comput.
Sci. 205 A998), no. 1-2, 135-144. MR 2000e:68116
1109. , Surjective linear cellular automata over Zm, Inform. Process. Lett. 66 A998),
no. 2, 101-104. MR 99c:68183
1110. N. P. F. du Sautoy, Finitely generated groups, p-adic analytic groups and Poincare series,
Ann. of Math. B) 137 A993), no. 3. 639-670. MR 94j:20029
1111. , Counting congruence subgroups in arithmetic subgroups, Bull. London Math. Soc.
26 A994), no. 3, 255-262. MR 95k:lllll
1112. , Mersenne primes, irrationality and counting subgroups, Bull. London Math. Soc.
- 29 A997), no. 3, 285-294. MR 98c:11091
1113. J. Schiffer, Discrepancy of normal numbers, Acta Arith. 47 A986). no. 2, 175-186. MR
88d: 11072
1114. A. Schinzel, On two theorems of Gelfond and some of their applications, Acta Arith 13
A967/1968), 177-236. MR 36 #5086
1115. , Primitive divisors'of the expression An — Bn in algebraic number fields, J. Reine
Angew. Math. 268/269 A974), 27-33. MR 49 #8961
1116. Selected topics on polynomials, University of Michigan Press, Ann Arbor, Mich..
1982. MR 84k: 12010
1117. Systems of exponential congruences, Demonstratio Math. 18 A985), no. 1, 377-
394. MR87c:11036
1118. , An extension of the theorem on primitive divisors in algebraic number fields, Math.
Comp. 61 A993), no. 203, 441-444. MR 93k:11107
1119. , Exponential congruences, Number theory and its applications (Kyoto, 1997),
Kluwer Acad. Publ, Dordrecht, 1999, pp. 303-308. MR 2001e:11031
1120. , Polynomials with special regard to reducibility, Cambridge University Press, Cam-
Cambridge, 2000, With an appendix by Umberto Zannier. MR 2001h:11135
1121. H. P. Schlickewei, The number of subspaces occurring in the p-adic subspace theorem in
Diophantine approximation, J. Reine Angew. Math. 406 A990), 44-108. MR 91e:11076
1122. , The quantitative subspace theorem for number fields, Compositio Math. 82 A992),
no. 3, 245-273. MR 93f:11050
1123. , Multiplicities of algebraic linear recurrences, Acta Math. 170 A993), no. 2, 151-
180. MR 94i:11015
1124. , Equations in roots of unity, Acta Arith. 76 A996), no. 2, 99-108. MR 97g:11037
1125. , Multiplicities of recurrence sequences, Acta Math. 176 A996), no. 2, 171-243. MR
97g:11031

BIBLIOGRAPHY 299
1126. , Lower bounds for heights on finitely generated groups, Monatsh. Math. 123 A997)
no. 2, 171-178. MR 98d:11077
1127. , The multiplicity of binary recurrences, Invent. Math. 129 A997), no. 1, 11-36
MR 98k: 11100
1128. , The subspace theorem and applications. Proceedings of the International Con-
Congress of Mathematicians, Vol. II (Berlin, 1998), vol. Extra Vol. II, 1998, pp. 197-205. MR
99h:11075
1129. H. P. Schlickewei and W. M. Schmidt, Equations auln = bul^ satisfied by members of
recurrence sequences, Proc. Amer. Math. Soc. 118 A993), no. 4, 1043-1051. MR 93j:11010
1130. Linear equations in members of recurrence sequences, Ann. Scuola Norm. Sup.
Pisa Cl. Sci. D) 20 A993), no. 2, 219-246. MR 94h:11004
1131. , On polynomial-exponential equations, Math. Ann. 296 A993). no. 2, 339-361. MR
94e:11032
1132. , The intersection of recurrence sequences, Acta Arith. 72 A995). no! 1, 1-44. MR
96g:11011
1133. The number of solutions of polynomial-exponential equations, Compositio Math.
120 B000), no. 2, 193-225. MR 2001b:11022
1134. H. P. Schlickewei, W. M- Schmidt, and M. Waldschmidt, Zeros of linear recurrence se-
sequences, Manuscripta Math. 98 A999), no. 2, 225-241. MR 99m:11034
1135. H. P. Schlickewei, I. E. Shparlinski, and S. A. Stepanov, On the distribution of normal bases
of number fields, Preprint, 1994.
1136. H. P. Schlickewei and S. A. Stepanov, Algorithms to construct normal bases of cyclic number
fields. J. Number Theory 44 A993), no. 1, 30-40. MR 94d:11081
1137. J. Schmeling, Symbolic dynamics for fi-shifts and self-normal numbers. Ergodic Theory
Dynam. Systems 17 A997), no. 3, 675-694. MR 98c:11080
1138. K. Schmidt, On periodic expansions of Pisot numbers and Salem numbers, Bull. London
Math. Soc. 12 A980), no. 4, 269-278. MR 82c:12003
1139. , Mixing automorphisms of compact groups and a theorem by Kurt Mahler, Pacific
J. Math. 137 A989). no. 2, 371-385. MR 90c:28031
1140. , Dynamical systems of algebraic origin, Birkhauser Verlag. Basel, 1995. MR
97c:28041
1141. K. Schmidt and T. Ward, Mixing automorphisms of compact groups and a theorem of
Schlickewei. Invent. Math. Ill A993), no. 1, 69-76. MR 95c:22011
1142. W. M. Schmidt, On normal numbers, Pacific J. Math. 10 A960), 661-672. MR 22 #7994
1143. Simultaneous approximation to algebraic numbers by rationals. Acta Math. 125
A970). 189-201. MR 42 #3028
1144. , Linear forms with algebraic coefficients. I, J. Number Theory 3 A971), 253-277.
MR 46 #7176
1145. , Linearformen mit algebraischen Koeffizienten. II, Math. Ann. 191 A971), 1-20.
MR 46 #7177
1146. , Diophantine approximation, Lecture Notes in Mathematics, vol. 785, Springer,
Berlin. 1980. MR 81j:10038
1147. , Eisenstein's theorem on power series expansions of algebraic functions, Acta Arith.
56 A990), no. 2, 161-179. MR 91m:11021
1148. , The zero multiplicity of linear recurrence sequences, Acta Math. 182 A999), no. 2,
243-282. MR 2000J.-11043
1149. , Zeros of linear recurrence sequences, Publ. Math. Debrecen 56 B000), no. 3-4,
609-630, Dedicated to Professor Kalman Gyory on the occasion of his 60th birthday. MR
200 If: 11051
1150. E. Schmutz, The order of a typical matrix with entries in a finite field. Israel J. Math. 91
A995), no. 1-3, 349-371. MR 97e:15011
1151. F. Schweiger, Normalitat beziiglich zahlentheoretischer Transformationen, J. Number The-
Theory 1 A969), 390-397. MR 40 #2616
1152. , Ergodic theory of fibred systems and metric number theory, The Clarendon Press
Oxford University Press, New York, 1995. MR 97h:11083
1153. C. Seo, S. Lee, Y. Sung, K. Han, and S. Kim, A lower bound on the linear span of an
FCSR, IEEE Trans. Inform. Theory 46 B000), no. 2, 691-693. MR 2000m:94017

300 BIBLIOGRAPHY
1154. G. Seroussi and N. H. Bshouty, Vector sets for exhaustive testing of logic circuits, IEEE
Trans. Inform. Theory 34 A988), no. 3, 513-522. MR 89j:94049
1155. J. Shallit, Real numbers with bounded partial quotients: a survey, Enseign. Math. B) 38
A992), no. 1-2, 151-187. MR 93g:11011
1156. , Numeration systems, linear recurrences, and regular sets, Inform, and Comput.
113 A994). no. 2, 331-347. MR 95g:11007
1157. , Automaticity. IV. Sequences, sets, and diversity. J. Theor. Nombres Bordeaux 8
A996), no. 2, 347-367, Erratum: 9 A997), 247. MR 99a:11027a
1158. , Number theory and formal languages, Emerging applications of number theory
(Minneapolis, MN, 1996), Springer, New York, 1999, pp. 547-570. MR 2000d:68123
1159. , Automaticity and rationality. J. Autom. Lang. Comb. 5 B000), no. 3, 255-268,
Descriptional complexity of automata, grammars and related structures (Magdeburg, 1999).
MR 2001h:68083
1160. J. Shallit and Y. Breitbart, Automaticity. I. Properties of a measure of descriptional com-
complexity, J. Comput. System Sci. 53 A996), no. 1, 10-25. MR 97m:68074
1161. H. N. Shapiro and G. H. Sparer, Composite values of exponential and related sequences,.
Comm. Pure Appl. Math. 25 A972), 569-615. MR 46 #8958
1162. , Extension of a theorem of Mason, Comm. Pure Appl. Math. 47 A994), no. 5,
711-718. MR 95c:11036 -
1163. H. S. Shapiro, The expansion of mean-periodic functions in series of exponentials., Comm.
Pure Appl. Math. 11 A958), 1-21. MR 21 #2157
1164. A. Shields, On quotients of exponential polynomials, Comm. Pure Appl. Math. 16 A963),
27-31. MR 26 #6411
1165. I. Shiokawa, Asymptotic distributions of digits in integers, Number theory, Vol. I (Budapest,
1987), North-Holland, Amsterdam. 1990, pp. 505-525. MR 91g:11082
1166. R. Shipsey, Elliptic divisibility sequences, Ph.D. thesis, Goldsmith's College (University of
London), 2000.
1167. - • , Elliptic divisibility sequences and elliptic curves. Preprint, 2001.
1168. T. N. Shorey, Applications of linear forms in logarithms to binary recursive sequences,
Seminar on number theory, Paris 1981-82 (Paris, 1981/1982), Birkhauser Boston, Boston.
MA, 1983, pp. 287-301. MR 85f:11009
1169. , Divisors of convergents of a continued fraction, J. Number Theory 17 A983),
no. 1, 127-133. MR 85d:11068
1170. , The greatest square free factor of a binary recursive sequence, Hardy-Ramanujan
J. 6 A983), 23-36. MR 85i:11019
1171. , Linear forms in members of a binary recursive sequence, Acta Arith. 43 A984),
no. 4, 317-331. MR 85m:11038
1172. , Ramanujan and binary recursive sequences, J. Indian Math. Soc. (N.S.) 52 A987),
147-157 A988). MR 90e:11033
1173. , Some exponential Diophantine equations. II, Number theory and related topics
(Bombay, 1988), Tata Inst. Fund. Res.. Bombay, 1989, pp. 217-229. MR 98d:11038
1174. , The equation a(xn — l)/(x — 1) = byq with ab > 1, Number theory in progress, Vol.
1 (Zakopane-Koscielisko, 1997), de Gruyter, Berlin, 1999, pp. 473-485. MR 2000d:11045
1175. , Exponential Diophantine equations involving products of consecutive integers and
related equations, Number theory, Birkhauser, Basel, 2000, pp. 463-495. MR 2001g:11045
1176. , Some conjectures in the theory of exponential Diophantine equations, Publ. Math.
Debrecen 56 B000), no. 3-4, 631-641, Dedicated to Professor Kalman Gyory on the occasion
of his 60th birthday. MR 2001i:11038
1177. T. N. Shorey and S. Srinivasan, Metrical results on square free divisors of convergents of
continued fractions, Bull. London Math. Soc. 19 A987), no. 2, 135-138. MR 88e: 11069
1178. T. N. Shorey and C. L. Stewart, On divisors of Fermat, Fibonacci, Lucas and Lehmer
numbers. II, J. London Math. Soc. B) 23 A981), no. 1, 17-23. MR 82m: 10025
1179. , On the Diophantine equation ax2t + bxty + cy2 = d and pure powers in recurrence
sequences, Math. Scand. 52 A983), no. 1, 24-36. MR 84g:10038
1180. , Pure powers in recurrence sequences and some related Diophantine equations, J.
Number Theory 27 A987), no. 3, 324-352. MR 89a: 11024
1181. T. N. Shorey and R. Tijdeman, Exponential Diophantine equations, Cambridge University
Press, Cambridge, 1986. MR 88h:11002

BIBLIOGRAPHY 301
1182. V. Shcfup, Searching for primitive roots in finite fields, Math. Comp. 58 A992), no. 197,
369-380. MR92e:11140
1183. I. E. Shparlinski, Bounds for exponential sums with recurrence sequences and their appli-
applications, Proc. Voronezh State Pedagogical Inst. 197 A978), 74-85.
1184. , Distribution of nonresidues and primitive roots in recurrent sequences, Mat. Za-
metki 24 A978), no. 5, 603-613, 733. MR 80b:10066
1185. , Completely uniform distribution, Zh. Vychisl. Mat. i Mat. Fiz. 19 A979), no. 5,
1330-1333, 1359. MR 81b:10033
1186. , Prime divisors of recurrence sequences, Izv. Vyssh. Uchebn. Zaved. Mat. 4 A980),
100-103. MR 81j:10015
1187. , On the distribution of the fractional parts of recurrent sequences, Zh. Vychisl. Mat.
i Mat. Fiz. 21 A981), no. 6, 1588-1591, 1616. MR 83e:10074
1188. , On some properties of linear cyclic codes, Problemy Peredachi Inform. 19 A983),
106-110.
1189. , A multiplicative pseudo-random number transducer, Zh. Vychisl. Mat. i Mat. Fiz.
24 A984), no. 9, 1406-1408. MR 85m:65006
1190. , The number of prime divisors of recurrence sequences, Mat. Zametki 38 A985),
no. 1, 29-34, 168. MR 87a:11017
1191. , Weight spectra of certain codes, Problemy Peredachi Informatsii 22 A986), no. 2,
43-48. MR 88f:94047
1192. ; , The number of different prime divisors of recurrent sequences, Mat. Zametki 42
A987), no. 4, 494-507, 622. MR 89k:11092
1193. . Residue classes modulo a prime in an algebraic number field, Mat. Zametki 43
A988), no. 4, 433-438, 573. MR 89j:11089
1194. , A sequence of pseudorandom numbers, Avtomat. i Telemekh. 7 A988), 185-188.
MR 90m:65019
1195. , Arithmetic properties of solutions of norm form equations, Uspekhi Mat. Nauk 44
A989), no. 3B67), 183-184. MR 90j-.11028
1196. v Distribution of values of recurrent sequences, Problemy Peredachi Informatsii 25
A989), no. 2, 46-53. MR 90k:11017
1197. , Some arithmetic properties of recurrence sequences, Mat. Zametki 47 A990), no, 6,
124-131. MR 91m:11006
1198. , Estimates for Gauss sums, Mat. Zametki 50 A991), no. 1, 122-130. MR
92m:11082
1199. , On polynomial congruences, Acta Arith. 58 A991), no. 2. 153-156. MR 92h:11078
1200. , On the distribution of values of recurring sequences and the Bell numbers infinite
fields, European J. Combin. 12 A991), no. 1, 81-87. MR 92a:11021
1201. , On exponential sums with sparse polynomials and rational functions, J. Number
Theory 60 A996), no. 2, 233-244. MR 97g: 11089
1202. , -Finite fields: Theory and computation, Kluwer Academic Publishers, Dordrecht,
1999. MR 2001g:11188
1203. , Number theoretic methods in cryptography: Complexity lower bounds, Birkhauser
Verlag, Basel, 1999. MR 2001a:94026
1204. , On the Naor-Reingold pseudo-random function from elliptic curves, Appl. Algebra
Engrg. Comm. Comput. 11 B000), no. 1, 27-34. MR 2001m:65015
1205. On some properties of the shrinking generator, Des. Codes Cryptogr. 23 B001),
no. 2, 147-155. MR 2002d:94036
1206. , On the generalised hidden number problem and bit security of XTR, Lect. Notes
in Comp. Sci. 2227 B001), 268-277.
1207. On the linear complexity of the power generator, Des. Codes Cryptogr. 23 B001),
no. 1, 5-10. MR 2003a: 11095
1208. . On the uniformity of distribution of the Naor-Reingold pseudo-random function,
Finite Fields Appl. 7 B001), no. 2, 318-326. MR 2002b:11104
1209. , Bounds of Gauss sums in finite fields, Proc. Amer. Math. Soc. (to appear).
1210. I. E. Shparlinski and J. H. Silverman. On the linear complexity of the Naor-Reingold pseudo-
pseudorandom function from elliptic curves, Des. Codes Cryptogr. 24 B001), no. 3, 279-289. MR
2002j:11087

302 BIBLIOGRAPHY
1211. V. M. Sidel'nikov, Estimates for the number of appearances of elements on an interval of a
recurrent sequence over a finite field, Diskret. Mat. 3 A991), no. 2, 87-95. MR 92h:11108
1212. L. Sigler, Fibonacci's Liber Abaci, Springer-Verlag, New York, 2002, A Translation into
Modern English of Leonardo Pisano's Book of Calculation.
1213. J. H. Silverman, Lower bound for the canonical height on elliptic curves, Duke Math. J. 48
A981), no. 3, 633-648. MR 82k:14043
1214. , The arithmetic of elliptic curves, Springer-Verlag, New York, 1986. MR87g:11070
1215. , Wieferich's criterion and the abc-conjecture, J. Number Theory 30 A988), no. 2,
226-237. MR 89m: 11027
1216. Integer points, Diophantine approximation, and iteration of rational maps, Duke
Math. J. 71 A993), no. 3, 793-829. MR 95e:11070
1217. , Advanced topics in the arithmetic of elliptic curves, Springer-Verlag, New York,
1994. MR 96b:11074
1218. , The field of definition for dynamical systems on P1, Compositio Math. 98 A995),
no. 3, 269-304. MR 96j:11090
1219. . The space of rational maps on P1, Duke Math. J. 94 A998), no. 1, 41-77. MR
2000m: 14010
1220. S. Kh. Sirazhdinov, T. A. Azlarov, and T. M. Zuparov, Additivnye zadachi s rastushchim
chislom slagaemykh, Izdat. "Fan" Uzbek. SSR, Tashkent, 1975. MR 58 #16554
1221. T. Skolem, Ein Verfahren zur Behandlung gewisser exponentialer Gleichungen, Comptes
rendus du congres des mathematiciens scandinaves, Stockholm, 1934 A935), 163-188.
1222. N. J. A. Sloane, An on-line version of the encyclopedia of integer sequences, Electron.
J. Combin. 1 A994), Feature 1, approx. 5 pp., www.research.att.com/~njas/sequences/.
MR 95b:05001
1223. .N. J. A. Sloane and S. Plouffe, The encyclopedia of integer sequences, Academic Press Inc.,
San Diego, CA, 1995. MR 96a:11001
1224. S. Smale: Differentiable dynamical systems, Bull. Amer. Math. Soc. 73 A967), 747-817.
MR 37 #3598
1225. C. J. Smyth, On the product of the conjugates outside the unit circle of an algebraic integer,
Bull. London Math. Soc. 3 A971), 169-175. MR 44 #6641
1226. I. M. Sobol', Mnogomernye kvadraturnye formuly i funktsii Khaara, Izdat. "Nauka",
Moscow. 1969. MR 54 #10952
1227. L. Somer. Linear recurrences having almost all primes as maximal divisors, Fibonacci
numbers and their applications (Patras, 1984). Reidel, Dordrecht, 1986, pp. 257-272. MR
87i:11027
1228. Divisibility of terms in Lucas sequences by their subscripts, Applications of Fi-
Fibonacci numbers, Vol. 5 (St. Andrews, 1992), Kluwer Acad. Publ., Dordrecht, 1993, pp. 515-
525. MR 94m:11022
1229. Upper bounds for frequencies of elements in second-order recurrences over a finite
field, Applications of Fibonacci numbers, Vol. 5 (St. Andrews, 1992), Kluwer Acad. Publ..
Dordrecht, 1993, pp. 527-546. MR 95c:11021
1230. Periodicity properties of kth order linear recurrences whose characteristic poly-
polynomial splits completely over a finite field. I, Finite fields: theory, applications, and algo-
algorithms (Las Vegas, NV, 1993), Amer. Math. Soc, Providence, RI, 1994, pp. 327-339. MR
95k:11018
1231. Periodicity properties of kth order linear recurrences whose characteristic polyno-
polynomial splits completely over a finite field. II, Finite fields and applications (Glasgow, 1995),
Cambridge Univ. Press, Cambridge, 1996, pp. 333-347. MR 97m:11022
1232. M. Somos, Problem 1470, Crux Mathematicorum 15 A989), 208.
1233. V. G. Sprindzhuk, Klassicheskie diofantovy uravneniya ot dvukh neizvestnykh, "Nauka",
Moscow. 1982. MR85d:11022
1234. V. G. Sprindzuk, Problema Malera v metricheskoiteorii chisel, Izdat. "Nauka i Tehnika",
Minsk, 1967. MR 39 #6832
1235. , Mahler's problem in metric number theory, American Mathematical Society, Prov-
Providence. R.I., 1969. MR 39 #6833
1236. R. P. Stanley, Differentiably finite power series, European J. Combin. 1 A980), no. 2.
175-188. MR 81m:05012

BIBLIOGRAPHY 303
1237. S. A. Stepanov and I. E. Shparlinski, On the construction of a primitive normal basis of a
finite field, Mat. Sb. 180 A989), no. 8, 1067-1072, 1151. MR 90j:12003
1238. , On the construction of primitive elements and primitive normal bases in a finite
field, Computational number theory (Debrecen, 1989), de Gruyter. Berlin, 1991, pp. 1-14.
MR 93a:11102
1239. , On normal bases of algebraic number fields, New trends in probability and statis-
statistics, Vol. 2 (Palanga, 1991), VSP, Utrecht, 1992, pp. 369-378. MR 94a:11177
1240. P. J. Stephens, An average result for Artin's conjecture, Mathematika 16 A969), 178-188.
MR 58 #16565
1241. , Prime divisors of second-order linear recurrences. I, J. Number Theory 8 A976),
no. 3, 313-332. MR 54 #5142
1242. , Prime divisors of second order linear recurrences. II, J. Number Theory 8 A976),
no. 3, 333-345. MR 54 #5143
1243. C. L. Stewart, On divisors of Fermat, Fibonacci, Luca.s, and Lehmer numbers. Proc. Lon-
London Math. Soc. C) 35 A977). no. 3, 425-447. MR 58 #10694
1244. , Primitive divisors of Lucas and Lehmer numbers, Transcendence theory: advances
and applications (Proc. Conf.. Univ. Cambridge, Cambridge, 1976). Academic Press, Lon-
London, 1977, pp. 79-92. MR 57 #16187
1245. , On divisors of terms of linear recurrence sequences, J. Reine Angew. Math. 333
A982), 12-31. MR 83i:10010
1246. , On some Diophantine equations and related linear recurrence sequences, Progress
in Math., vol. 22, Birkhauser Boston, 1982, pp. 317-321.
1247. , On divisors of Fermat, Fibonacci, Lucas and Lehmer numbers. Ill, J. London
Math. Soc. B) 28 A983), no. 2, 211-217. MR 85g:11021
1248. , On the greatest prime factor of terms of a linear recurrence sequence, Rocky
Mountain J. Math. 15 A985): no. 2, 599-608. MR 87h:11017
1249. C. L. Stewart and K. R. Yu, On the abc conjecture, Math. Ann. 291 A991), no. 2, 225-230.
MR 92k:11037
1250. , On the abc conjecture. II, Duke Math. J. 108 B001), no. 1, 169-181. MR
2002e:11046
1251. D. R. Stinsou, Cryptography: Theory and practice, CRC Press, Boca Raton, FL, 1995. MR
96k:94015
1252. M. Stoll, Galois groups overQ of some iterated polynomials, Arch. Math. (Basel) 59 A992),
no. 3, 239-244. MR 93h:12004
1253. , Bounds for the length of recurrence relations for convolutions of P-recursive se-
sequences, European J. Combin. 18 A997), no;..6, 707-712. MR 99f:05007
1254. R. G. Stoneham, A general arithmetic construction of transcendental non-Liouville normal
numbers from rational fractions, Acta Arith. 16 A969/1970), 239-253. MR 42 #207b
1255. , On (j, e)-normality in the rational fractions, Acta Arith. 16 A969/1970), 221-237.
MR 42 #207a
1256. , On absolute (j, e)-normalzty in the rational fractions with applications to normal
numbers, Acta Arith. 22 A972/73), 277-286. MR 47 #6621
1257. , On the uniform s-distribution of residues within the periods of rational fractions
with applications to normal numbers, Acta Arith. 22 A973), 371-389. MR 47 #6640
1258. , On a sequence of (j, s)-normal approximations to 7r/4 and the Brouwer conjecture,
Acta Arith. 42 A983), no. 3, 265-279. MR 85g:11062
1259. R. Stong, The average order of a matrix, J. Combin. Theory Ser. A 64 A993), no. 2,
337-343. MR 94j: 11094
1260. S. Strandt, Quadratic congruential generators with odd composite modulus, Monte Carlo
and quasi-Monte Carlo methods 1996 (Salzburg), Springer, New York, 1998, pp. 415-426.
MR 99d-.65024
1261. R. Strassmann, Uber den wertevorrat von Potenzreihen im gebiet der p-adischen Zahlen,
J. Reine Angew. Math. 159 A928), 13-28.
1262. O. Strauch, On distribution functions of ?C/2)" mod 1, Acta Arith. 81 A997), no. 1,
25-35. MR 98c:11075
1263. M. Strauss, Normal numbers and sources for BPP, Theoret. Comput. Sci. 178 A997),
no. 1-2, 155-169. MR 98a:68077

304 BIBLIOGRAPHY
1264. W. Sun. A. Klapper, and Y. X. Yang, On correlations of a family of generalized geometric
sequences. IEEE Trans. Inform. Theory 47 B001), no. 6, 2609-2618. MR 2002m:94046
1265. Z.-W. Sun. A congruence for primes, Proc. Amer. Math. Soc. 123 A995), no. 5, 1341-1346.
MR 95f: 11003
1266. , On the sum J2k=r (mod m) (fc) and related congruences, Israel J. Math. 128 B002),
135-156. MR 2003d:11026
1267. Z.-W. Sun and M.-H. Le, Integers not of the form cBa + 26) + pa, Acta Arith. 99 B001),
no. 2, 183-190. MR 2002e:11043
1268. C. S. Swart, Elliptic divisibility sequences, Ph.D. thesis, Royal Holloway (University of
London), 2003.
1269- E. Szemeredi, On sets of integers containing no k elements in arithmetic progression, Acta
Arith. 27 A975), 199-245. MR 51 #5547
1270- , Integer sets containing no arithmetic progressions, Acta Math. Hungar. 56 A990),
no. 1-2, 155-158. MR 92c:11100
1271. P. Szusz and B. Volkmann, A combinatorial method for constructing normal numbers,
Forum Math. 6 A994), no. 4, 399-414. MR 95f:11053
1272. E. J. Taft, Hadamard invertibility of linearly recursive sequences in several variables, Dis-
Discrete Math. 139 A995), no. 1-3, 393-397. MR 96f:16048
1273. S. Takahashi, Cellular automata, fractals and multifractals: space-time patterns and di-
dimension spectra of linear cellular automata, Chaos in Australia (Sydney, 1990), World Sci.
Publishing, River Edge, NJ, 1993, pp. 173-195. MR 96f:58084
1274. T. Tapsoba, Automates calculant la complexity de suites automatiques, J. Theor. Nombres
Bordeaux 6 A994), no. 1, 127-134. MR 95i:11017
1275. R. Taylor and A. Wiles, Ring-theoretic properties of certain Hecke algebras, Ann. of Math.
B) 141 A995), no. 3, 553-572. MR 96d:11072
1276. S. Tezuka, The k-dimensional distribution of combined GFSR sequences, Math. Comp. 62
A994), no. 206, 809-817. MR 94i:65014
1277. , Uniform random numbers, Kluwer, Dordrecht, 1996.
1278. R. F. Tichy, Stability of a class of nonuniform random number generators, J. Math. Anal.
Appl. 181 A994), no. 2, 546-561. MR 94m:65018
1279- , • Diophantine properties of digital expansions, Number theory (Eger, 1996). de
Gruyter, Berlin, 1998, pp. 501-522. MR 99g:11016
1280. , Three examples of triangular arrays with optimal discrepancy and linear recur-
recurrences, Applications of Fibonacci numbers, Vol. 7, Kluwer Acad. Publ., Dordrecht, 1998,
pp. 415-421.
1281. R. Tijdeman, On the number of zeros of general exponential polynomials, Nederl. Akad.
Wetensch. Proc. Ser. A 74 = Indag. Math. 33 A971), 1-7. MR 44 #4193
1282. , Note on Mahler's 3/2-problem, Det Kong. Norske Vidensk. Selsk. 16 A972), 1-4.
1283- , On the maximal distance between integers composed of small primes, Compositio
Math. 28 A974)T 159-162. MR 49 #10646
1284. , Multiplicities of binary recurrences, Seminar on Number Theory, 1980-1981 (Tal-
ence, 1980-1981), Univ. Bordeaux I, Talence, 1981, pp. Exp. No. 29, 11. MR 83f:10014
1285. , Exponential Diophantine equations 1986-1996, Number theory (Eger, 1996), de
Gruyter, Berlin, 1998, pp. 523-539. MR 99f:11046
1286. , Some applications of Diophantine approximation, Number Theory for the Millen-
Millennium, Vol.Ill, A. K. Peters, Natick. MA, 2002, pp. 261-284.
1287. J. Tits, Appendix to: "Groups of polynomial growth and expanding maps" [Inst. Hautes
Etudes Sci. Publ. Math. No. 53 A981), 53-73] by M. Gromov, Inst. Hautes Etudes Sci.
Publ. Math. 53 A981), 74-78. MR 83b:53042
1288. M. Tompa, Lecture notes on probabilistic algorithms and pseudorandom generators, Tech-
Technical Report 91-07-05, Dept. of Comp. Sci. and Engin., Univ. of Washington, 1991. '
1289- Th. Topfer, Simultaneous approximation measures for functions satisfying generalized func-
functional equations of Mahler type, Abh. Math. Sem, Univ. Hamburg 66 A996), 177-201, MR
97k:11108
1290. J. Tromp and J. Shallit, Subword complexity of a generalized Thue-Morse word, Inform.
Process. Lett. 54 A995), no. 6, 313-316. MR 96d:68170
1291. P. Turan, Eine Extremalaufgabe aus der Graphentheorie, Mat. Fiz. Lapok 48 A941), 436-
452. MR 8,284j

BIBLIOGRAPHY 305
1292. P. Udaya and M. U. Siddiqi, Optimal and suboptimal quadriphase sequences derived from
maximal length sequences overly, Appl. Algebra Engrg. Comm. Comput, 9 A998), no. 2
161-191. MR 2000j:94021
1293. , Optimal large linear complexity frequency hopping patterns derived from polyno-
polynomial residue class rings, IEEE Trans. Inform. Theory 44 A998), no. 4. 1492-1503. MR
2000e:94003
1294. E. Ugalde, An alternative construction of normal numbers, J. Theor. Nombres Bordeaux
12 B000), no. 1, 165-177. MR 2002b:11101
1295. R. Vaidyanathaswamy, The theory of multiplicative arithmetic functions. Trans. Amer.
Math. Soc. 33 A931), no. 2, 579-662.
1296. M. Vajaitu and A. Zaharescu, A finiteness theorem for a class of exponential congruences,
Proc. Amer. Math. Soc. 127 A999), no. 8, 2225-2232. MR 99j:11003
1297. R. C. Vaughan, On the distribution of ap modulo 1, Mathematika 24 A977). no. 2, 135-141.
MR 57 #12423
1298. G. Venturing Iterates of number-theoretic functions with periodic rational coefficients (gen-
(generalization of the 3x + 1 problem), Stud. Appl. Math. 86 A992), no. 3T 185-218. MR
93b:11102
1299. , On a generalization of the 3x + 1 problem, Adv. in Appl. Math. 19 A997), no. 3,
295-305. MR 98j:11013
1300. N. K. Vereshchagin, Zeros of linear recursive sequences, Dokl. Akad. Nauk SSSR 278 A984),
no. 5, 1036-1039. MR 86c:68064
1301. , The problem of the appearance of a zero in a linear recursive sequence, Mat.
Zametki 38 A985), no. 2, 177-189, 347. MR 87b:11018
1302. , Effective upper bounds for the number of zeros of a linear recurrence sequence,
Vestnik Moskov. UniV. Ser. I Mat. Mekh. 1 A986), 25-30, 92. MR 87d:11016
1303. I. M. Vinogradov, A new estimation of a trigonometric sum involving primes, Bull. Acad.
Sc. URSS Ser. Math. 2 A938), 1-13.
1304. F. Vivaldi. Dynamics over irreducible polynomials, Nonlinearity 5 A992). no. 4, 941-960.
MR 93i:11152
1305. . Geometry of linear maps over finite fields, Nonlinearity 5 A992). no. 1, 133—147.
MR93c:lllll
1306. , Cellular automata and finite fields, Phys. D 79 A994), no. 2-4. 115-131. MR
95k:11159
1307. F. Vivaldi and S. Hatjispyros, Galois theory of periodic orbits of rational maps, Nonlinearity
5 A992), no. 4, 961-978. MR 93i:11153
1308. J. F. Voloch. Diagonal equations over .function fields, Bol. Soc. Brasil. Mat. 16 A985),
no. 2, 29-39. MR 87g:11157
1309. , The equation ax + by = 1 in characteristic p, J. Number Theory 73 A998), no. 2,
195-200. MR 2000b:11029
1310. , On some subgroups of the multiplicative group of finite rings, Preprint, 2003.
1311- B. Voorhees. A note on injectivity of additive cellular automata, Complex Systems 8 A994),
no. 3, 151-159. MR 96d:68158
1312. M. Voorhoeve, On the oscillation of exponential polynomials, Math. Z. 151 A976), no. 3,
277-294. MR 55 #3224
1313. , Zeros of exponential polynomials, Rijksuniversiteit te Leiden, Leiden, 1977, Doc-
Doctoral dissertation, University of Leiden, Leiden. MR 56 #3263
1314. M. Voorhoeve and A. J. van der Poorten, Wronskian determinants and the zeros of certain
functions, Nederl. Akad. Wetensch. Proc. Ser. A 78 = Indag. Math. 37 A975), no. 5,
417-424. MR 53 #3275
1315. M. Voorhoeve, A. J. van der Poorten, and R. Tijdeman, On the number of zeros of certain
functions, Nederl. Akad. Wetensch. Proc. Ser. A 78 = Indag. Math. 37 A975), no. 5,
407-416. MR 53 #3274
1316. P. M. Voutier. Primitive divisors of Lucas and Lehmer sequences. Math. Comp. 64 A995),
no. 210, 869-888. MR 95f:11022
1317. , Primitive divisors of Lucas and Lehmer sequences. II, J. Theor. Nombres Bordeaux
8 A996), no. 2, 251-274. MR 98h:11037
1318. , Primitive divisors of Lucas and Lehmer sequences. III. Math. Proc. Cambridge
Philos. Soc. 123 A998), no. 3, 407-419. MR 99b:11027

306 BIBLIOGRAPHY
1319. M. A. Vsemirnov, Diophantine representations of linear recurrent sequences. I. Zap.
Nauchn. Sem. S.-Peterburg. Otdel. Mat. Inst. Steklov. (POMI) 227 A995), no. Voprosy
Teor. Predstav. Algebr i Grupp. 4. 52-60, 156-157. MR 97b:11015
1320. , Diophantine representations of linear recurrent sequences. II, Zap. Nauchn. Sem.
S.-Peterburg. Otdel. Mat. Inst. Steklov. (POMI) 241 A997), no. Issled. po Konstr. Mat. i
Mat. Log. X, 5-29, 150. MR 2000k:11019
1321. S. S. Wagstaff, Jr., Pseudoprim.es and a generalization of Artin's conjecture, Acta Arith.
41 A982), no. 2, 141-150. MR 83m:10004
1322. , Divisors of Mersenne numbers, Math. Comp. 40 A983), no. 161, 385-397. MR
84j:10052
1323. , Aurifeuillian factorizations and the period of the Bell numbers modulo a prime,
Math. Comp. 65 A996), no. 213, 383-391. MR 96f:11033
1324. M. Waldschmidt, Introduction to recent results in transcendental number theory, Preprint
of the Math. Sci. Inst., Berkeley, MSRI 074-93, 1993.
1325. , Diophantine approximation on linear algebraic groups, Grundlehren der Math-
ematischen Wissenschaften [Fundamental Principles of Mathematical Sciences], vol. 326,
Springer-Verlag. Berlin, 2000, Transcendence properties of the exponential function in sev-
several variables. MR 2001c:11075
1326. J. T.-Y. Wang. A note on Wronskians and the ABC theorem in function fields of prime
characteristic, Manuscripta Math. 98 A999), no. 2, 255-264. MR 2000d:11086
1327. M. Z. Wang. Linear complexity profiles and jump complexity, Inform. Process. Lett. 61
A997), no. 3, 165-168. MR 98a:94016
1328. M. Ward, The arithmetical theory of linear recurring series, Trans. Amer. Math. Soc. 35
A933), no. 3,_600-628.
1329. — , The law of repetition of primes in an elliptic divisibility sequence, Duke Math. J.
15 A948), 941-946. MR 10,283e
1330. , Memoir on elliptic div.isibility sequences, Amer. J. Math. 70 A948), 31-74. MR
9,332j
1331. , Prime divisors of second order recurring sequences, Duke Math. J. 21 A954),
• 607-614. MR 16,221f
1332. , The laws of apparition and repetition of primes in a cubic recurrence, Trans. Amer.
Math. Soc. 79 A955), 72-90. MR 16,906d
1333. , The linear p-adic recurrence of order two, Illinois J. Math. 6 A962), 40-52. MR
25 #2028
3334. T. Ward, Additive relations infields: an entropy approach, J. Number Theory 53 A995),
no. 1, 137-143. MR 97d:11126
1335. , Three results on mixing shapes, New York J. Math. 3A A997/98), no. Proceedings
of the New York Journal of Mathematics Conference, June 9-13, 1997, 1-10. MR 99e:28031
1336. , Almost all S-integer dynamical systems have many periodic points, Ergodic Theory
Dynam. Systems 18 A998), no. 2, 471-486. MR 99k:58152
1337. , Additive cellular automata and volume growth, Entropy 2 B000), 142-167.
1338. T. Washio and T. Kodama, Hasse-Witt matrices of hyper elliptic function fields, Sci, Bull.
Fac. Ed. Nagasaki Univ. 37 A986), 9-15. MR 87k:11064
1339. , A note on a supersingular function field, Sci. Bull. Fac. Ed. Nagasaki Univ. 37
A986), 17-21. MR87m:14034
1340. B. Weiss, Single orbit dynamics, American Mathematical Society, Providence, RI, 2000.
MR 2000k:37001
1341. H. Weyl, Uber die Gleichverteilung von Zahlen mod Eins, Math. Ann. 77 A916), 313-352.
1342. M. J. Wiener, Cryptanalysis of short RSA secret exponents, IEEE Trans. Inform. Theory
36 A990), no. 3, 553-558. MR 91f:94018
1343. K. Wiertelak, On the density of some sets'of primes.. I, Acta Arith. 34 A977/78), no. 3,
183-196. MR 58 #5554a
1344. , On the density of some sets of primes. II, Acta Arith. 34 A977/78), no. 3, 197-210.
MR 58 #5554b
1345. , On the density of some sets of primes. Ill, Funct. Approx. Comment. Math. 10
A981), 93-103. MR84i:10045
1346. , On the density of some sets of primes. Ill, Studies in pure mathematics,
Birkhauser, Basel, 1983, pp. 761-773. MR 87c:11082

BIBLIOGRAPHY 307
1347. , On the density of some sets of primes. IV, Acta Arith. 43 A984), no. 2, 177-190.
MR 86e:11081
1348. , On the density of some sets of integers, Funct. Approx. Comment. Math. 19 A990),
71-76. MR 92d:11099
1349. , On the density of some sets of primes p. for which (ordp b, n) = d, Funct. Approx.
Comment. Math. 21 A992), 69-73. MR 95f:11069
1350. , On the distribution of the smallest natural numbers having order mod p not coprime
with a given integer, Acta Math. Hungar. 80 A998), no. 4, 271-284. MR 99h:11112
1351. , On the density of some sets of primes p, for which n \ ordpa, Funct. Approx.
Comment. Math. 28 B000), 237-241, Dedicated to Wlodzimierz Stas on the occasion of his
75th birthday. MR 2003a:11120
1352. A. Wiles, Modular elliptic curves and Fermat's last theorem, Ann. of Math. B) 141 A995),
no. 3, 443-551. MR 96d:11071
1353. H. C. Williams, Some generalizations of the Sn sequence of Shanks, Acta Arith. 69 A995),
no. 3, 199-215. MR 96a:11118
1354. , Edouard Lucas and primality testing, Canadian Mathematical Society Series of
Monographs and Advanced Texts, vol. 22, John Wiley & Sons Inc., New York, 1998, A
Wiley-Interscience Publication. MR 2000b: 11139
1355. H. C. Williams and J. Shallit, Factoring integers before computers, Mathematics of Com-
Computation 1943-1993: a half-century of computational mathematics (Vancouver, BC. 1993),
Amer. Math. Soc, Providence, RI, 1994, pp. 481-531. MR 95m:11143
1356. S. Williams. Zeros in nth order linear recurrence sequences, Master's thesis, Macquarie
University (Honours Thesis), 1994.
1357. G. J. Wirsching, The dynamical system generated by the 3n + 1 function. Springer-Verlag,
Berlin, 1998. MR 99g:11027
1358. S. Wolfram. Random sequence generation by cellular automata, Adv. in Appl. Math. 7
A986), no. 2, 123-169. MR 87i:68057
1359. S. Wolfram (ed.), Theory and applications of cellular automata, World Scientific Publishing
Co., Singapore, 1986. MR 87j:68007
1360. J. W. Wrench, Jr., Evaluation of Artin's constant and the twin-prime constant, Math.
Comp. 15 A961), 396-398. MR 23 #A1619
1361. C. Xing, H. Niederreiter, K. Y. Lam, and C. Ding, Constructions of sequences with almost
perfect linear complexity profile from curves over finite fields, Finite Fields Appl. 5 A999),
no. 3, 301-313. MR 2000g:94027
1362. J. Xu and A. Klapper, Feedback with carry shift registers over Z/(N), Sequences and their
applications (Singapore, 1998), Springer, London, 1999, pp. 379-392. MR 2002f:94035
1363. A. A. Yacobson, Bounds for exponential sums with recurring sequences and their applica-
applications, Proc. Voronezh State Pedagogical Inst. 197 A978), 86-91.
1364. Y. X. Yang. New binary sequences with perfect staircase profile of linear complexity, Inform.
Process. Lett. 46 A993), no. 1, 27-29. MR 94e:94011
1365. K. Yokoyama, Z. Li, and I. Nemes, Finding roots of unity among quotients of the roots of
an integral polynomial, Proc. Intern. Symp. on Symb. and Algebraic Comp. A995), 85-89.
1366. K. R. Yu, Linear forms in p-adic logarithms, Acta Arith. 53 A989), no. 2. 107-186. MR
90k: 11093
1367. , Linear forms in p-adic logarithms. II, Compositio Math. 74 A990). no. 1, 15-113,
Erratum: 76 A990), 307. MR 91h:11065a
1368- , Linear forms in p-adic logarithms. Ill, Compositio Math. 91 A994); no. 3, 241-
276. MR 95f:11050
1369. K, R. Yu and L.-K. Hung, On binary recurrence sequences, Indag. Math. (N.S.) 6 A995),
no. 3, 341-354. MR 96i:11081
1370. L. Yu and M. Le, On the Diophantine equation (xm - l)/(x - 1) = yn. Acta Arith. 73
A995), no. 4, 363-366. MR 96m: 11023
1371. A. Zaharescu, Small values ofn2a (mod 1), Invent. Math. 121 A995). no. 2, 379-388. MR
96d: 11079
1372. , Correlation of fractional parts ofn2a, Forum Math. 15 B003). no. 1. 1-21. MR
1 957 276
1373. U. Zannier, Some remarks on the S-unit equation in function fields, Acta Arith. 64 A993),
no. 1, 87-98. MR 94c:lllll

Index
*-», 4 h(p), 105
I-Ip. 12 H(U,q),198
abs,2Z6 Ia<XiP(N,H),2U
A(d,m,a), 155 . 7m,/m(a), 103
a0 6, 67 Ja(h), 228
A(K,q), 196 J(q,n,A), 253
a_(z),93 Kera,m, 232
a+(z),93 K2{W},140
ars, 234 ?, 231
A(S,M,N), 98 Ca{k,h), 230
a * 6, 66 Aq., 196
as(z), 71 Aq, 196
atm, 234 M^), 248
<8ft, 198 ?(/),2
BfciS(a@),A,M)!224 ?'(/),2
Bn, 187 L(K, q), 196
C, vii L{m,g), 238
Ca,\,p(N)> 244 ^x , 99
Cp, vii Ln(T), 181
A(a), 107 Inx, vii
tfij. v» ?a, 226
ep(x), 233 ?•, 226
?i v'i Logx, vii
F, vii log x, vii
Fixn(T), 180 L+, 99
/~.6 Lp(./V), 198
F^, vii Jp(iV), 198
F<j,vii ' M(a), 26
F(S,N), 218 m(a), 26
f(S,N), 218 m(a,c), 26
/A, 70 Mj(m,p), 208
/), 4 E(M,k,s), 225
CE.F), 140 Af(K,V), 201
m), 55 M(K,V,q), 201
, 49 M(/), 60
201 M.(n), 31
), 201 Mp, 93
), 54 M(i?), 30
5(p). 54 ^(fc), vii
Gr{E,F), 140 juo(n,ft), /*(n,W), 26
H{f), vii N, vii
h{Q), 168 iV(n),31
-^m> 3 ./V(p), 55
Hm,P{a), 208
309

310
INDEX
), 68
Np(s,n), 67
Nq(a), 196
i/(fc), vii
i/*(m), 208
u(M,N), 95
w(JV), 95
fi(a), 135
fi(fc), 109
w(fc), 109
ws(A,M), 215
On(T), 181
ordp z, vii
P, vii
Pa{N), 93
per(/), 46
tp(k), vii
7ra(A0, 105
tt(x), vii
P(k), vii
p(A), 51
Q, vii
Qa(N), 62
), 120
QP,
vii
R, vii
TZ, vii
B.at9tP(N,H), 122
p.(A,M), 214
fin (9), 141
rs(f,m,p), 212
R(t,p,a), 203
R(U,q,h), 198
vii
], vii
o-(fc), vii
a{z), 165
S(A,A0, 85
Sx, 147, 191
TQGV,A), 149
r(k), vii
Tjfastg), 202
), 50
Tm(N,X), 120
Tn{t,q), 205
T(p,s,g), 202
r(p,a,5), 202
), 58
), 248
VKm, 231
WaF,M),2lQ
XORr 217
Z. vii
C/B), 60
Zk, vii
Zp. vii
Z+, vii
¦^S.t.Ct: 135
^t,o, 134
a6c-conjecture, 22, 98
absolutely normal number, 127
almost all reals, 128
explicit construction, 131
Ackerman's function, 11, 255
add-with-carry sequence, 56, 217
period, 56
additive function, 71
aliquot sequence, 63, 255
arbitrarily long, 63
almost all, viii
almost periodic sequence, 235
anomalous prime, 170
finitely many, 172
arithmetic progression, 5, 26, 34
of zeros, 25
primes, 51, 206
primitive root in, 51
Art in
conjecture, 49-52, 157, 189, 196, 199, 200,
224
elliptic analogue, 51
for function fields, 52
for function fields on elliptic curves, 52
in number fields, 52, 107
. on average, 50
on CM curves, 52
on elliptic curves, 52
constant, 50
integers, 195
Artin-Schreier polynomial. 152, 194
autocorrelation function, 251
automaton
accepted word, 231
cellular, 240
circular shape, 239
finite. 232
binomial coefficients, 241
m-, 231
language, 231
minimal size, 237
to compute a function, 237
Aztec diamonds, 178
backward prediction, 220
cellular automata, 241
power, exponential generator, 222
Baker's Theorem, 16, 20
Baum-Sweet sequence, 234, 236
generating function, 235
BCH-code, 253

INDEX
311
Bell numbers, 150
index of entry, 152
modulo composites, 156
recurrent congruence, 151
Berlekamp-Massey algorithm, 222, 226, 247
Bernoulli
denominators, 188, 255
normal sequence, 218
numbers, 187
Kummer congruences, 187
realizable, 187
numerators, 188, 255
polynomials. 153
Berstel's sequence, 28, 31, 38, 255
bilinear
recurrence sequence, 9, 11
binary, ternary, 11
binary length sequence, 233, 255
binary partition sequences, 153, 255
birthday paradox, 244
black-box, 144
Blahut algorithm, 222, 226
Blum, Blum and Shub generator, 58, 221,
223
Boolean functions, 245
Borel's Theorem, 14
canonical height, 9, 42
analogue of Lehmer problem, 173, 174
functoriality. 168
global, 168
Lang's conjecture, 174
local, 168
sum of local heights, 168
Carmichael number, 241, 242
Catalan
conjecture, 255
equation, 157, 159
cellular automata, 231, 238
as 2-dimensional recurrence, 239
backward prediction, 241
boundary rule, 239
class membership, 240
fractal orbit portraits, 241
generating function, 241
higher-dimensional, 241
initial configuration, 239
linear, 239
probabilistic, 241
reachability problem, 240
time, vertical generating function, 239
transition rule, 239
character
multiplicative, 86
of Fq, 75
quadratic, 51
theory (Pontryagin), 187
character sums, 75, 76
over C, 85
upper bounds
algebraic number fields, 76
finitely generated groups, 76
incomplete sums, 77
multiplicative characters, 86
on average, 83
positive characteristic, 75
rationals, 77
Weil bound, 143
characteristic polynomial, xi, 1, 16
M-sequence, 46
and rational functions, 6
Berstel's sequence, 28
discriminant, 36
matrix powers, 6
minimal length, 1
possible linear recurrence sequences, 2
product of sequences, 2
sequence of traces, 3
unique dominating root, 5
checking polynomial, 247, 249
Chinese Remainder Theorem, 49, 139
class number
minus part, 202
code-words, 247
bound for number. 249
minimum weight, 250
number of different weights, 252
coefficient ring, 1
Collatz sequence, 8, 61
generalization, 62
periodic structure, 45
completely uniformly distributed, 127
complexity profile
jump, 228
linear, 226, 229 . .
d-almost perfect, 230
perfect, 228
composition
and Bell numbers, 150
of exponential polynomials, 102
of functions, 180
of linear recurrence sequences, 66
continued fraction, 8, 91, 101, 137, 145, 146
almost every real, 8
bounded partial quotients, 148
Fibonacci sequence, 148
Gauss measure, 149
length, 146
multiples of irrationals, 137
normal expansion, 149
normal numbers. 132, 149
numerators and denominators, 145
of power series, 147
over field of formal Laurent series, 228
quadratic irrational, 145
convolution
of linear recurrence sequences, 67

312
INDEX
quantum, 67
sequences with polynomial coefficients, 67
coordinate sequence, 56, 67
order, 68
period, 56
correlation
cyclic linear code, 251
function, 251
non-linear recurrence sequences, 251
small, 251
cryptography, 216, 247
timed-release, 247
Cullen numbers, 94, 255
cycles
polynomial, 201
cyclic linear code, 247
checking polynomial, 247
code-words, 247
covering radius, 251
generating polynomial, 247
Hamming weight, 248
Lee weight, 248
redundancy, 248
density
asymptotic, 34, 53, 62, 197
of prime ideals, 52
of primitive roots, 242
of set of prime divisors, 74, 93, 105, 106
of set of prime maximal divisors, 107
of super-singular primes, 206
of unit bits, 228
positive, 62, 94, 100, 137
primitive divisors, 104
Dickson polynomial, ix
difference
operator, 3
sequence, 63
sets, 105
differential equations, 8
algebraic, 7
Grothendieck conjecture, 238
homogeneous, 71, 146
linear, 39
polynomial coefficients, 41
Skolem-Mahler-Lech Theorem, 41
Taylor coefficients, 1, 7
p-adic, 40
partial, 218
polynomial, 66
rationality
decidability, 232
differential operators, 68
Diffie-Hellman key-exchange, 247
Digital Signature Algorithm, 247
Diophantine
approximation, 17, 167, 196
equations, ix, 139, 151, 157-159, 161
linear recurrence sequences, 157, 161
discrepancy, 86, 125, 127, 211
discrete logarithm, 229
discrete logarithm problem, 222, 246
for elliptic curves, 164
discrete root problem, 222
divisibility sequence, 70, 188
characterization, 71
elliptic, 71
division polynomials, 165
dominating roots, 5
dual
basis, 157
(character theory), 189
sequence, 104
dynamical zeta function, ix, 61
for /^-transformations, 60
hyperbolic systems, 61
edge shift, 181
realizable by, 182
effective constant, viii
Egyptian fraction equation, 161
Eisenstein Theorem, 14, 103
bound,103
elliptic curve, 165
canonical global height, 168
canonical local height, 168
discriminant, 167
division polynomial, 165
generalised Weierstrass equation, 166
periods, 165
singular reduction, 168
with cyclic reduction infinitely often, 52
elliptic divisibility sequence, 163, 255
and CC), 168
and discrete logarithms, 164
and Somos sequence, 9
defines a point on a curve, 167
generated by a point on a curve, 166
growth rate, 167
not realizable, 183
periodic behaviour, 165
prime apparition, 169
prime apparition heuristics, 172
proper, 164
rank of apparition, 164
singular, 163, 167
Zsigmondy's Theorem, 169
elliptic division polynomials, 166
elliptic Lehmer problem, 174
Encyclopedia of Integer Sequences, xii, 12,
255
Erdos-Turan inequality, 204
ergodic
toral automorphism, 189
continued fraction map, 8
matrix, 129
theorem, 127

INDEX
313
Euclidean algorithm, 13, 146, 200
Euclidean property, 196
Euler
binary partition sequence, 154, 234
constant, 54, 95, 205
criterion for quadratic residues, 242
factors, 94, 172
-Fermat Theorem, 94
function, vii, 196
pseudo-prime, 242, 243
exceptional units, 194
expansive toral automorphism, 189
exponential
linear complexity, 219
equations, 157
generator, 221
linear complexity, 227
polynomial
divisibility, 140
generalized, 7
greatest common divisor, 140
ideal, 141
unique factorization, 140
Falting
product theorem, 21
Fermat
congruence, 241
equation, 159
Little Theorem, 242
number, 94
primality test, 242
number, prime, 93, 100, 255
sequence, 95
Fibonacci, 177
sequence, 73, 146, 148, 255
and graph matchings, 177
and periodic points, 181
even terms, bisection, 93, 255
locally realizable, 187
not realizable, 181
prime terms, 95
realizable subspace, 184
squares and cubes in, 114
figures of merit, 213
finite automata, 226, 240, 241
reachability problem, 240
forward prediction, 220, 222
1/M generator, 223
Berlekamp-Massey algorithm, 222
Boyar procedure, 223
linear recurrence, 222
non-linear recurrence sequence, 223
polynomial recurrence equation, 223
power, exponential generator, 221
quadratic generator, 223
truncation, 224
full shift, 189
functional equation, 7, 232
analogue of Grothendieck conjecture, 238
Baum-Sweet sequence, 235
m-automatic power series, 232
Rudin-Shapiro sequence, 234
technique, 74
Thue-Morse sequence, 234
fundamental units, 191, 194, 197
multiplicative group, 198
multiplicatively independent, 201
positive, 158
g-ary expansion, 132, 202
normal numbers, 218
Gauss
map, 8
invariant measure, 8, 149
Gaussian
period, 195, 203
algebraic number fields, 195
finite fields, 51
generates a normal basis, 195
polynomial, 205
sums, 75-77
generalized exponential polynomial, 7
Generalized Lindelof Hypothesis, 122
generalized power sums, 1, 3
characteristic roots, 3
Generalized Riemann Hypothesis, 50-52, 54,
55, 94, 105, 108, 112, 195, 243
generating
function, 146, 231, 234, 239
Baum-Sweet sequence, 235
cellular automata, 241
groups, 156
rationality, 156
Rudin-Shapiro sequence, 234
time, 239
vertical, 239
polynomial
cyclic code, 247
power series, 231
globally realizable, 187, 188
Golomb sequence, 255
graph matchings
Fibonacci sequence, 177
Somos-4 sequence, 179
graphical condensation, 178
greatest common divisor
algebraic, analytic, 140
Hadamard, 140
Ritt, 140
Grothendieck conjecture, 238
group automorphism
entropy and Lehmer's problem, 30
periodic points, 188, 189
realizable by, 182
group structure of recurrence sequences, 4
growth rate

314
INDEX
elliptic divisibility sequence, 167
linear recurrence sequence, 16, 32
periodic points, 189
Hadamard
fc-th Root Problem, 69
greatest common divisor, 140
inequality, 207
inversion, 70
operation, 65
product, 65
multi-variate, 66
quotient, 15
Quotient Problem, 15, 69
Root Problem. 69
Hamming weight, 248
Hardy, 12
and Wright, 95
Hasse's Theorem, 172
height
algebraic number, 16
canonical, 9
naYve, vii
of a polynomial, vii, 89
Heilbronn's conjecture, 77
Hermite constant, 216
impulse sequences, 2
index of entry, 103
Bell numbers, 152
elliptic analogue, 164
Lucas numbers, 104
inhomogeneous recurrence relation, 2
initial values, 2
interlacing sequences, 67
inversive sequence, 57
discrepancy, 217
lattice test, 218
maximal period, 57
irregularity index, 68
Jacobsthal-Lucas sequence, 180, 255
jump complexity profile, 228
Kodama's question, 205
K ronecker-Hankel
determinant, 6
matrix, 15
Lang, 36
conjecture, 18, 170, 174
Las Vegas algorithm, 242
lattice test, 217
inversive generator, 218
s-dimensional, 217
least period, 181, 202
Lee weight, 248
Legendre symbol, 9
Lehmer
example of small Mahler measure, 30
generator, 214
discrepancy, 216
homogeneous, 214
multiplier, 214
numbers, 23, 98, 99
primality test, 242, 243
problem, 30, 32, 174
elliptic, 170, 174
Lehmer-Pierce sequence, 30, 93, 95,180,182
Leopoldt conjecture, 37
linear complexity, 72, 224, 226
and continued fractions, 229
k-error, 230
self-shrunken M-sequence, 226
linear complexity profile, 226
d-almost perfect, 229
perfect, 228
linear congruencial generator, 214
discrepancy, 216
elliptic analogue, 221
homogeneous, 214
linear forms in logarithms, xi, 15, 18, 32, 33,
96, 133
multiplicative form. 16
linear recurrence relation
homogeneous, 1
order, 1
linear recurrence sequence, 1, 226
affine equations in, 71
and linear differential equations, 7
and rational functions, 6
and traces, 3
arithmetic subsequence, 5
as a generalized power sum, 3
binary, ternary, 2
character sums, 75
characteristic polynomial, 1
degenerate, non-degenerate, 5
density of prime divisors, 105
density of prime maximal divisors, 107
divisors, 4
exceptional, 38
group structure, 4
double root, 4
torsion, 106
growth, 16, 32
Hadamard operation, 66
initial values, 2
many variables, 10
matrix powers, 6
minimal polynomial, 1
multipliers, 49
number of zeros, 87
order, 1
periodic structure, 46
powers in, 113
prime divisors, 93
reduction to non-degenerate, 5

INDEX
315
restricted period, 49
set of solutions, 2
squares and cubes in, 114
sum and product, 65
zeros, 31
linearized polynomial, 57
Linnik
constant, 243
Theorem, 59
Liouville
number, 133
Theorem, 147
locally realizable, 186
everywhere, 187
LIlr-nets, 220
Lucas
numbers, 23, 98, 99, 103, 106, 111, 112,
115, 163, 180, 184, 255
and periodic points, 180
index of entry, 104
primitive divisors, 104
primitive power divisors, 104
pseudo-prime. 243
Lyness sequence, 9
Mahler
3/2-problem, 61, 134, 206
measure, 29, 30, 168
entropy, 30
smallest known, 30
m-functions, 232
matrix
almost integer, 129
ergodic, 129
m-automatic, 231
algebraic irrationals are not, 232 -
sequences over finite fields, 232
m-automaton, 231
acceptance set, 231
initial state, 231
language, 231
max sequence, 63
maximal divisor, 107
maximal period
construction of sequences, 47
modulo composites, 52
modulo prime powers, 47
of matrices, 47
MergeSort algorithm
complexity, 234
Mersenne
number, 100, 149
prime, 53, 93, 156, 189, 255
sequence, 180
prime heuristics, 94
Merten's Theorem, 95, 172
(m, #)-automatic, 238
real number, 238
minimal
non-mixing shapes. 141
polynomial, 1
quadratic residue. 55
mixing for Zd-actions. 43, 141. 157
m-kernel, 232
finiteness characterizes m-automatic, 232
Mobius function, vii
modulus
of a linear cellular automata, 49
of a pseudo-random number generator, 211
Monte Carlo method. 220
M-sequences, 45
in residue rings, 47
over finite fields. 46
over Galois rings, 46
shrinking generator. 72
multiplication-with-carry sequence, 217
multiplicative
character, 86
order, 86
function, 71
order, 45
multiplicity, 26
low order sequences, 27
lower bounds, 28
non-uniform bounds. 29
total, 26, 38
uniform bounds, 27
multipliers, 49
group of, 49
Naor-Reingold pseudo-random number gen-
generator, 85
near-Euclidean property, 196
non-linear recurrence relations, 8
correlation, 251
nondegeneracy, 5
norm of a polynomial, 142
Norm-form equation, 157, 158
normal
basis, 191
extension, 191
number, 86
absolutely, 127
to base g, 102
periodic systems, 130
sequences of signs. 218
normality, 127
NP-hard problem, 245
n-sparse polynomials, 139
n-sparse rational functions, 139
Orbit Problem, 246
for linear recurrences, 240
for matrix groups, 246
over Q, 246
over a finite field. 246
order

316
INDEX
of a character, 86
of a linear recurrence sequence, 1
p-adic, vii
p-adic
analytic function, 13
convergence, 12
differential equations, 40
expansion, 12
logarithms, 25
meromorphic function, 13
metric, 12
rationals, 12
subspace theorem, 20
valuation, 12
Weierstrass Preparation Theorem, xi, 13
Painleve equation, 8
paper-folding sequence, 235 "
2-automatic, 235
Fourier transform, 236
pattern counting function, 236
pattern sequence, 235
associated trigonometric polynomial, 236
p-binomial coefficients, 70
perfect matching, 177
' Aztec diamonds, 178
Somos-4 sequence, 179
perfectly cyclic, 59
period, 50
in finitely generated groups, 53
modulo p, 50
modulo p, lower bounds on average, 53
of m-dimensional sequences, 59
of a polynomial, 46
of a sequence, 45
of add-with-carry sequence, 56
of doubly exponential sequence, 55
of matrices, 47
of shrunken sequences, 55
relation to linear recurrence sequence, 54
periodic points, 179
automorphism of solenoid, 189
edge shifts, 181
Fibonacci sequence, 181
for quadratic polynomials, 59
group endomorphism, 188
group endomorphisms, 189
growth rate, 189
in dynamical systems, 177
Jacobsthal-Lucas sequence, 180
Lucas sequence, 180
Mersenne sequence, 180
readability in rate, 189
realizable in rate, 189
toral automorphism, 189
permutation polynomial, 218
Pillai equation, 160
Pisot sequence, 255
Pisot-Varadarajan number, 60
Pollard's p-method, 244
polynomial
Artin-Schreier, 152, 194
as linear recurrence, 139
Bernoulli, 153
black-box, 144
cycles, 201
division, 164, 165
factorization, 139
Gaussian period, 205
irreducible in the strong sense, 141
multi-variate factorization, 140
never realizable, 183
reciprocal, 93
sparse, 75, 141
positive unit, 158
power generator, 85, 217, 221
p-part of a sequence, 186
predictability problem, 220
primality test, 241
certifying, 242
deterministic, 153, 242, 243
Fermat's Little Theorem, 242
Lehmer, 242
Mersenne numbers, 243
Prime Number Theorem, x, 94, 188
dynamical analogue, 61
prime terms
elliptic divisibility sequence, 169
Fibonacci sequence, 95
in linear recurrences, 93
primitive
divisor, 93, 100, 103, 104
composite, 104
elliptic divisibility sequence, 169
Lucas and Lehmer sequence, 104
matrix, 182
normal basis, 191
polynomial, 57
power divisors, 104
root, 51, 139, 202, 242
analogues for composite modulus, 52
in arithmetic progression, 51
least, 54
modulo prime powers, 47
unconditional results, 51
product formula, 12, 14
pseudo-prime
Euler, 242
Lucas, 243
strong to the base a, 243
to the base a, 241
pseudo-random
number generator, 211
complexity, 220
Naor-Reingold, 85, 221
numbers, 226
sequence of digits, 218

INDEX
317
purely periodic, 59
sequence, 45
PV-number, 60, 129
special, 60
totally positive, 135
Polya operator, 68
^-generalizations, 7
quadratic
generator
discrepancy, 217
forward prediction, 223
irrationality, 101
continued fraction, 8, 145
period of continued fraction, 147
number fields
fundamental units, 191
polynomial
iteration, 58
periodic points, 59
residue, 59
Euler's criterion, 242
sequence, 124
maximal period, 57
sequences, 56
quantum convolution, 67
quasi-random number, 219
Lllr-nets, 220
quasihyperbolic toral automorphism, 189
QuickSort algorithm, 244
Rabin primes, 222
Ramanujan, 170
r-function, 150, 255
recurrence equation, 150
rank of apparition, 164
rational function, vii
differential operator, 68
dynamical zeta function, 61
Eisenstein Theorem, 103
linear recurrence sequence, 6
modulo composites, 56
periodic points, 59
power series, 6
recognizing, 14
several variable, 10
REACH, 179
realizable sequence, 181
algebraically, 188
binary recurrence, 184
globally, 187
in rate, 189
locally, 186
prime appearance, 188
sum and product, 182
reciprocal polynomial, 6, 93
Mahler measure, 30
recurrence
relation
elliptic, 9, 163
inhomogeneous, 2
non-linear, 8
sequence
^-generalization, 7, 102
elliptic, 163
group structure, 4
growth, 31
on elliptic curves, 42
shrinking, 71
transcendence theory. 72
zeros, 31
zeros in a segment, 34
recurrence sequence
bilinear, 11
regular numeration system, 238
regular sequences, 233
restricted period, 49
over finite rings, 49
Riesel number, 255
Riesz-Raikov Theorem, 136
Ritt greatest common divisor, 140
(R,, m)-regular sequences. 232
Robinson's question, 207
Roth Theorem, 17, 32, 95. 114, 147
p-adic, 32
RSA-cryptosystem, 222
continued fractions, 222
cycling attack, 246
Rudin-Shapiro sequence, 234, 235, 255
and trigonometric polynomial. 236
pseudo-random properties, 237
Salem number, 36, 60, 102
selector sequence, 71
self-shrinking generator, 71, 72
Selfridge's problem, 108
sequences of maximal period, 47
Shanks sequence, 147, 191
shrinkage, 71
shrinking generator, 71, 219
output rate, 219
shrunken sequence, 55, 71, 219
Sierpinksi number, 255
Skolem-Mahler-Lech Theorem, 5, 25, 26, 29,
88, 157
and growth of sequences, 31
for ^-recurrence sequences, 42
history, 26
linear differential equations, 41
positive characteristic, 42
questions, 26
requires zero characteristic, 42
S-norm, 19
S-number, 130
Somos
-4 sequence, 9, 164, 179, 255
and graph matchings, 179

318
INDEX
-7 sequence, 95, 255
sequence, 10
Sophie Germain prime, 188
sparse polynomial, 75
linear factors, 141
number of zeros, 141
powers, 141
type, 141
spectral conjecture, 182
sphere complexity, 230
stability of distribution, 129
Stern sequence, 153, 155, 255
Strassmann's Theorem, xi, 13
subshift of finite type, 188
subspace theorem, 20
p-adic, 20
substitutions
sequences realized as fixed points, 235
subtract-with-borrow sequence, 56, 217
5-unit, 5, 19-22
average value of sums, 36
equation, 19, 21-23, 27, 41, 133
in positive characteristic, 41
over function fields, 142
linear equation in, 22
sums in function fields, 42
super-singular hyperelliptic curves, 206
Sylvester sequence, 255
Szemeredi Theorem, 34, 35, 43, 102, 248
cyclic linear codes, 248
effective, 248
Tausworthe generator, 212
taxi-cab equation, 170
Tchebotarev Density Theorem, 29, 105-108
Tchebychev polynomial, ix
tee shirt, 179
Thue equation, 157
Thue-Morse sequence, 234, 237, 255
palindromic patterns, 237
pseudo-random properties, 237
T-number, 130
toral automorphism
ergodic, 189
expansive, 189
quasihyperbolic, 189
transcendental number
constructions, 72
tribonacci sequence, 186, 255
Turan's Theorem, 34
type of a polynomial, 141
uniform boundedness conjecture, 59
uniformly distributed, 127
completely, 127, 128, 130
Weyl criterion, 129
van der Corput sequence. 233
Vandermonde
determinant, 49
matrix, 4, 249
Waring problem, 201
Weierstrass
.equation, 166, 173
p-adic Preparation Theorem, xi
a-function, 163, 165
periodicity, 165
Weil
bound, 77, 81, 143
Theorem, 59
Weyl criterion, 129
Wieferich numbers, 62
Woodall number, 255
Z-numbers, 134
zeta-function
algebraic variety, ix, 156
dynamical, 61
/^-transformation, 60
hyperbolic systems, 61
polynomial mappings, 156
Zsigmondy's Theorem, 93. 103
algebraic number fields, 104
for elliptic curves, 169
Zs,t,a-numbers, 135
Zt)Q-numbers, 134

Titles in This Series
104 Graham Everest, Alf van der Poorten, Igor Shparlinski, and Thomas Ward
Recurrence sequences, 2003
103 Octav Cornea, Gregory Lupton, John Oprea, and Daniel Tanre,
Lusternik-Schnirelmann category, 2003
102 Linda Rass and John Radcliffe, Spatial deterministic epidemics, 2003
101 Eli Glasner, Ergodic theory via joinings, 2003
99 Philip S. Hirschhorn, Model categories and their localizations, 2003
98 Victor Guillemin, Viktor Ginzburg, and Yael Karshon, Moment maps,
cobordisms, and Hamiltonian group actions, 2002
97 V. A. Vassiliev, Applied Picard-Lefschetz theory, 2002
96 Martin Markl, Steve Shnider, and Jim Stasheff, Operads in algebra, topology and
physics, 2002
95 Seiichi Kamada, Braid and knot theory in dimension four, 2002
94 Mara D. Neusel and Larry Smith, Invariant theory of finite groups, 2002
93 Nikolai K. Nikolski, Operators, functions, and systems: An easy reading. Volume 2:
Model operators and systems, 2002
92 Nikolai K. Nikolski, Operators, functions, and systems: An easy reading. Volume 1:
Hardy, Hankel. and Toeplitz, 2002
91. Richard Montgomery, A tour of subriemannian geometries, their geodesies and
applications. 2002
90 Christian Gerard and Izabella Laba, Multiparticle quantum scattering in constant
magnetic fields, 2002
89 Michel Ledoux, The concentration of measure phenomenon, 2001
88 Edward Frenkel and David Ben-Zvi, Vertex algebras and algebraic curves, 2001
87 Bruno Poizat, Stable groups, 2001
86 Stanley N. Burris, Number theoretic density and logical limit laws, 2001
85 V. A. Kozlov, V. G. Maz'ya, and J.Rossmann, Spectral problems associated with
corner singularities of solutions to elliptic equations, 2001
84 Laszlo Puchs and Luigi Salce, Modules over non-Noetherian domains, 2001
83 Sigurdur Helgason, Groups and geometric analysis: Integral geometry, invariant
differential operators, and spherical functions, 2000
82 Goro Shimura, Arithmeticity in the theory of automorphic forms, 2000
81 Michael E. Taylor, Tools for PDE: Pseudodifferential operators, paradifferential
operators, and layer potentials, 2000
80 Lindsay N. Childs, Taming wild extensions: Hopf algebras and local Galois module
theory, 2000
79 Joseph A. Cima and William T. Ross, The backward shift on the Hardy space, 2000
78 Boris A. Kupershmidt, KP or mKP: Noncommutative mathematics of Lagrangian,
Hamiltonian. and integrable systems, 2000
77 Pumio Hiai and Denes Petz, The semicircle law, free random variables and entropy,
2000
76 Frederick P. Gardiner and Nikola Lakic, Quasiconformal Teichmiiller theory, 2000
75 Greg Hjorth, Classification and orbit equivalence relations, 2000
74 Daniel W. Stroock, An introduction to the analysis of paths on a Riemannian manifold,
2000
73 John Locker, Spectral theory of non-self-adjoint two-point differential operators, 2000
72 Gerald Teschl, Jacobi operators and completely integrable nonlinear lattices, 1999
71 Lajos Pukanszky, Characters of connected Lie groups, 1999

TITLES IN THIS SERIES
70 Carmen Chicone and Yuri Latushkin, Evolution semigroups in dynamical systems
and differential equations, 1999
69 C. T. C. Wall (A. A. Ranicki, Editor), Surgery on compact manifolds, second edition,
1999
68 David A. Cox and Sheldon Katz, Mirror symmetry and algebraic geometry, 1999
67 A. Borel and N. Wallach, Continuous cohomology, discrete subgroups, and
representations of reductive groups, second edition, 2000
66 Yu. Ilyashenko and Weigu Li, Nonlocal bifurcations, 1999
65 Carl Faith, Rings and things and a fine array of twentieth century associative algebra,
1999
64 Rene A. Carmona and Boris Rozovskii, Editors, Stochastic partial differential
equations: Six perspectives, 1999
63 Mark Hovey, Model categories, 1999
62 Vladimir I. Bogachev, Gaussian measures, 1998
61 W. Norrie Everitt and Lawrence Markus, Boundary value problems and symplectic
algebra for ordinary differential and quasi-differential operators, 1999
60 Iain Raeburn and Dana P. Williams, Morita equivalence and continuous-trace
C*-algebras, 1998
59 Paul Howard and Jean E. Rubin, Consequences of the axiom of choice, 1998
58 Pavel I. Etingof, Igor B. Frenkel, and Alexander A. Kirillov, Jr., Lectures on
representation theory and Knizhnik-Zamolodchikov equations, 1998
57 Marc Levine, Mixed motives, 1998
56 Leonid I. Korogodski and Yan S. Soibelman, Algebras of functions on quantum
groups: Part I, 1998
55 J. Scott Carter and Masahico Saito, Knotted surfaces and their diagrams, 1998
54 Casper Goffman, Togo Nishiura, and Daniel Waterman, Horneomorphisms in
analysis, 1997
53 Andreas Kriegl and Peter W. Michor, The convenient setting of global analysis, 1997
52 V. A. Kozlov, V. G. Maz'ya, and J. Rossmann, Elliptic boundary value problems in
domains with point singularities, 1997
51 Jan Maly and William P. Ziemer, Fine regularity of solutions of elliptic partial
differential equations, 1997
50 Jon Aaronson, An introduction to infinite ergodic theory, 1997
49 R. E. Showalter, Monotone operators in Banach space and nonlinear partial differential
equations, 1997
48 Paul-Jean Cahen and Jean-Luc Chabert, Integer-valued polynomials, 1997
47 A. D. Elmendorf, I. Kriz, M. A. Mandell, and J. P. May (with an appendix by
M. Cole), Rings, modules, and algebras in stable homotopy theory, 1997
46 Stephen Lipscomb, Symmetric inverse semigroups, 1996
45 George M. Bergman and Adam O. Hausknecht, Cogroups and co-rings in
categories of associative rings, 1996
44 J. Amoros, M. Burger, K. Corlette, D. Kotschick, and D. Toledo, Fundamental
groups of compact Kahler manifolds, 1996
For a complete list of titles in this series, visit the
AMS Bookstore at www.ams.org/bookstore/.