For example: $$7x \equiv 1 \pmod{31} $$ In this example, the modular inverse of $7$ with respect to $31$ is $9$. How can we find out that $9$? What are the steps that I need to do?

If I have a general modulo equation:
$$5x + 1 \equiv 2 \pmod{6}$$

What is the fastest way to solve it? My initial thought was: $$5x + 1 \equiv 2 \pmod{6}$$ $$\Leftrightarrow 5x + 1 - 1\equiv 2 - 1 \pmod{6}$$ $$\Leftrightarrow 5x \equiv 1 \pmod{6}$$

Then solve for the inverse of $5$ modulo 6. Is it a right approach?


  1. One method is simply the Euclidean algorithm: \begin{align*} 31 &= 4(7) + 3\\\ 7 &= 2(3) + 1. \end{align*} So $ 1 = 7 - 2(3) = 7 - 2(31 - 4(7)) = 9(7) - 2(31)$. Viewing the equation $1 = 9(7) -2(31)$ modulo $31$ gives $ 1 \equiv 9(7)\pmod{31}$, so the multiplicative inverse of $7$ modulo $31$ is $9$. This works in any situation where you want to find the multiplicative inverse of $a$ modulo $m$, provided of course that such a thing exists (i.e., $\gcd(a,m) = 1$). The Euclidean Algorithm gives you a constructive way of finding $r$ and $s$ such that $ar+ms = \gcd(a,m)$, but if you manage to find $r$ and $s$ some other way, that will do it too. As soon as you have $ar+ms=1$, that means that $r$ is the modular inverse of $a$ modulo $m$, since the equation immediately yields $ar\equiv 1 \pmod{m}$.

  2. Another method is to play with fractions Gauss's method: $$\frac{1}{7} = \frac{1\times 5}{7\times 5} = \frac{5}{35} = \frac{5}{4} = \frac{5\times 8}{4\times 8} = \frac{40}{32} = \frac{9}{1}.$$ Here, you reduce modulo $31$ where appropriate, and the only thing to be careful of is that you should only multiply and divide by things relatively prime to the modulus. Here, since $31$ is prime, this is easy. At each step, I just multiplied by the smallest number that would yield a reduction; so first I multiplied by $5$ because that's the smallest multiple of $7$ that is larger than $32$, and later I multiplied by $8$ because it was the smallest multiple of $4$ that is larger than $32$. Added: As Bill notes, the method may fail for composite moduli.

Both of the above methods work for general modulus, not just for a prime modulus (though Method 2 may fail in that situation); of course, you can only find multiplicative inverses if the number is relatively prime to the modulus.

Update. Yes, your method for general linear congruences is the standard one. We have a very straightforward method for solving congruences of the form $$ax \equiv b\pmod{m},$$ namely, it has solutions if and only if $\gcd(a,m)|b$, in which case it has exactly $\gcd(a,m)$ solutions modulo $m$.

To solve such equations, you first consider the case with $\gcd(a,m)=1$, in which case $ax\equiv b\pmod{m}$ is solved either by finding the multiplicative inverse of $a$ modulo $m$, or as I did in method $2$ above looking at $\frac{b}{a}$.

Once you know how to solve them in the case where $\gcd(a,m)=1$, you can take the general case of $\gcd(a,m) = d$, and from $$ax\equiv b\pmod{m}$$ go to $$\frac{a}{d}x \equiv \frac{b}{d}\pmod{\frac{m}{d}},$$ to get the unique solution $\mathbf{x}_0$. Once you have that unique solution, you get all solutions to the original congruence by considering $$\mathbf{x}_0,\quad \mathbf{x}_0 + \frac{m}{d},\quad \mathbf{x}_0 + \frac{2m}{d},\quad\ldots, \mathbf{x}_0 + \frac{(d-1)m}{d}.$$

  • 1
    $\begingroup$ @Arturo Magidin: Thanks, it's a lot of work :(. I thought it's just a simple calculation. $\endgroup$ – Chan Mar 6 '11 at 23:38
  • 5
    $\begingroup$ @Chan: Your definition of "a lot of work" needs revising, if you plan on studying more number theory and maths. The above is surprising little work, in my estimation... $\endgroup$ – Arturo Magidin Mar 6 '11 at 23:40
  • 2
    $\begingroup$ @Arturo Magidin: Thanks for the advice. However, I have many other things that I want to study. I like Number Theory, but also Geometry, Computer Graphics, Algorithm, C++, Ruby, Compiler, AI..., plus my school classes. I wish a day could have 48 hours. $\endgroup$ – Chan Mar 6 '11 at 23:43
  • 1
    $\begingroup$ @Chan: Trust me, you aren't the only one making that wish. But I really don't know what it is you think that the above methods are "a lot of work". Even the Euclidean algorithm method works, in this case, in two simple steps. Did you hope that just a sum and a product would do it every time? $\endgroup$ – Arturo Magidin Mar 6 '11 at 23:45
  • 2
    $\begingroup$ the euclidean algorithm is simple and easily programed... $\endgroup$ – yoyo Mar 6 '11 at 23:48

We know that $(7,31) = 1$. So you can use the extended Euclidean algorithm. In particular, you can find two integers $s,t$ such that $7s+31t = 1$. So $7s \equiv 1 \pmod {31}$.


A hint: Try to use Fermats Little theorem:

$a^{p-1}=1 \mod p$ for $p$ prime, and all $a\in \mathbb{Z}$.

  • 3
    $\begingroup$ 7^29 mod 31 certainly works in this case, but for larger numbers it might be a bit of an effort compared with the Euclidean algorithm, and it would get more complicated by involving Euler's totient function for a non-prime modulus. $\endgroup$ – Henry Mar 6 '11 at 23:57

We can visualize the solution to $7x \equiv 1 \pmod{31}$ as the intersection of the two "lines"

$\ \ \ \ \ y \equiv 7x \pmod{31}$ and $y \equiv 1 \pmod{31}$.

The first line is closed under addition and subtraction, since it passes through the origin. If $(x_1, y_1)$ and $(x_2, y_2)$ are points on the line $y \equiv 7x \pmod{31}$, then so are $(x_1+x_2, y_1+y_2)$ and $(x_1-x_2, y_1-y_2)$.

To find a point where the lines intersect, we start with the two points $(1, 7)$ and $(0,31)$ on the first line, and repeatedly subtract one point from another until the $y$-coordinate is 1.

$\ \ \ \ \ (0,31) - (1,7) = (-1, 24)$

$\ \ \ \ \ (-1, 24) - (1,7) = (-2, 17)$

$\ \ \ \ \ (-2, 17) - (1, 7) = (-3, 10)$

$\ \ \ \ \ (-3, 10) - (1, 7) = (-4, 3)$

$\ \ \ \ \ (1,7) - (-4, 3) = (5, 4)$

$\ \ \ \ \ (5,4) - (-4, 3) = (9,1)$

Therefore, $x \equiv 9 \pmod{31}$.

You can speed up this procedure by subtracting a multiple of one point from another point instead. This leads to the Euclidean algorithm.


There are many methods available, e.g. the extended Euclidean algorithm, $ $ or a special case of Euclid's algorithm that computes inverses modulo primes that I call Gauss's algorithm. $ $ The calculations are usually simpler using modular fraction arithmetic e.g. see here, and here and here for circa $20$ motley worked examples via a handful of methods (and see the sidebar "Linked" questions lists there for many more).

Or $ $ by Euler $\rm\ (a,m)=1 \Rightarrow\ a^{-1} \equiv a^{\phi(m)-1}\pmod{\! m},\,$ quickly computable by repeated squaring.

Remark $ $ The latter yields a simple closed form for CRT (Chinese Remainder Theorem)

$\quad$ if $\rm\,\ (m,n)=1\,\ $ then $\rm\quad \begin{eqnarray}\rm x\!&\equiv&\rm a\ \ (mod\ m)\\ \rm x\!&\equiv&\rm b\ \ (mod\ n)\end{eqnarray} \iff\ x\equiv a\,n^{\phi(m)}\!+b\,m^{\phi(n)}\ \ (mod\ mn)$

More generally see the Peirce decomposition.

  • $\begingroup$ @BillDubuque can we invert if totient is unknown? $\endgroup$ – T.... Sep 1 '17 at 1:10
  • $\begingroup$ @777 Yes, see the other two methods I mentioned above. $\endgroup$ – Bill Dubuque Sep 1 '17 at 2:45
  • $\begingroup$ @BillDubuque which ones? all seems to use factorization of $m$ or $\phi(m)$ and nothing avoids these. $\endgroup$ – T.... Sep 1 '17 at 2:51
  • $\begingroup$ @777 The extended Euclidean algorithm and Gauss's algorithm do not use factorization. Follow the links to learn these methods. $\endgroup$ – Bill Dubuque Sep 1 '17 at 3:13
  • $\begingroup$ @BillDubuque so both these methods do not need factorization of $m$ or knowledge of $\phi(m)$. Then doesn't that help to get decryption key $d$ in RSA from encryption key $e$? $\endgroup$ – T.... Sep 1 '17 at 22:47

An alternative way to solve would be to use the fast powering algorithm.

$a^{-1}≡a^{p-2} \mod p$ for $p$, $a\in \mathbb{Z}$.

$7^{-1} \mod 31 = 7^{29} \mod 31 ≡ 9 \mod 31$

According to An Introduction to Mathematical Cryptography by Hoffstein et al, in practice this is about the same time complexity as the extended Euclidean algorithm given in other answers.

Before using the fast powering algorithm I would first check to see if a and p are relatively prime, so that you know an inverse exists before performing the calculation.


The Arithmetical Progression f(n) = a + (n-1)d has only a finite number of terms for any modulus d and where a is the "initial" value, f(1), even when n is allowed to range over ℤ, so no holds barred trying negative values to quickly reach a coefficient of 1 or a -1.

In this example all moduli are to 31, starting from coefficient 7 one possibility is:

7x ≡ 1

⇒ -24x ≡ 32 (subtracting the modulus on the left and adding the modulus to the right)
⇒  -3x ≡ 4 (∵ gcd (12, 31) = 1)
⇒ -30x ≡ 40
⇒   1x ≡ 9

The above is an application of congruence article in the chapter on theory of numbers in Higher Algebra By H.S. Hall and S.R. Knight May 1887 (pdf probably available online).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.