If $x$ is random uniform in $\mathbb{Z}^*_N$, $y$ a quadratic non-residue with Jacobi symbol 1, then $x^2y$ is a random QNR with Jacobi 1

61 Views Asked by At

I've encountered the following claim in a paper I'm reading:

If $x$ is random uniform in $\mathbb{Z}^*_N$, and $y$ is an arbitrary quadratic non-residue with Jacobi symbol +1, then $x^2y$ is a random uniform quadratic non-residue with Jacobi symbol +1.

Note that $N=pq$ where $p,q$ are two primes $>2$.

I'm unable to see why this is true (probability is not my strongest suit, so I'm not entirely sure even how one would go about showing something is random uniform if not through directly computing, e.g., $\Pr[X^2y=a]$ for some $a$ in quadratic non-residue with Jacobi +1 and showing it's exactly 1 out of the size of the set).

What am I missing? Perhaps showing there's a bijection between $X^2y$ and NQRs with Jacobi 1?

1

There are 1 best solutions below

3
On BEST ANSWER

If $X$ is drawn uniformly from a finite set, and $f$ is an $n$-to-$1$ map from that set to another, then $f(X)$ is drawn uniformly from the range of $f$. Note that $x\mapsto x^2$ is such a map $\mathbb{Z}_n^\times\to(\mathbb{Z}_n^\times)^2$.

What about the map $x^2\mapsto x^2 y$? This is where it's important $n=pq$ is a semiprime. Then by CRT we can say $\mathbb{Z}_n^\times=\mathbb{Z}_p^\times\times\mathbb{Z}_q^\times$. The pairs of Legendre symbols mod $p$ and $q$ are $(1,1)$ for QRs, are $(-1,-1)$ for QNRs with JS $=1$, and are $(+1,-1)$ or $(-1,+1)$ for QNRs with JS $=-1$. Thus, the QRs are an index two subgroup of the residues JS $=1$, hence multiplying by $y$ (an element of the nontrivial coset) is a bijection between the QRs and the QNRs with JS=1.