A Little Bit About "Numbers" and "Mathematics"

PendingNearly slopmathematics
Last reviewed13 min read

During my self-study of pure mathematics, I have long wanted to write about how number systems such as the natural numbers N\mathbb N, the integers Z\mathbb Z, the rational numbers Q\mathbb Q, and the real numbers R\mathbb R are constructed, and particularly how they relate to one another.

One thing I find elegant about mathematics is that familiar rules can be built from a few simple assumptions. For example, why is a(b+c)=ab+aca(b+c)=ab+ac true? Most of us learned to use the distributive law at school; here, I want to see how we can eventually prove it from definitions.

Most of this note follows Terence Tao’s Analysis I [Tao, 2022]. It is an excellent book, though somewhat challenging for a self-learner like me. For now I will only cover N\mathbb N and Z\mathbb Z; the rational and real numbers can wait until I understand these first two properly (Tao is hard enough already LOL).

To read this note, pretend to forget what you know about negative numbers and subtraction. Those ideas do not exist yet. If we use them to construct the integers, we will have argued in a circle.

1. Natural Numbers

1.1. The Peano Axioms

The natural numbers will be our starting point. We are not constructing them out of absolutely nothing: words such as “set,” “object,” and “operation” already belong to the surrounding mathematics. What we can do is state the properties we need and then refuse to use any arithmetic rule until we have defined or proved it.

To describe counting, we begin with a distinguished object 00 and a successor operation SS. The axioms below tell us how they behave. They are usually called the Peano axioms.

Axiom 1.1.00 is a natural number Some books begin N\mathbb N at 11 instead. This is a convention. In this note, 0N0\in\mathbb N because it is our starting object and will be the base case for recursive definitions..

Axiom 1.2.If nn is a natural number, then S(n)S(n) is a natural number. We call S(n)S(n) the successor of nn—intuitively, the next number after nn.

Definition 1.3: Numerals.We define 1S(0)1\coloneqq S(0), 2S(S(0))2\coloneqq S(S(0)), 3S(S(S(0)))3\coloneqq S(S(S(0))), and so on. These symbols name the objects reached by finitely many applications of SS.

The first two axioms let us produce:

0,S(0),S(S(0)),0, S(0), S(S(0)), \ldots

but they do not yet say that these are all the objects in our system. That distinction is important: closure under successor is not the same as saying that every object is generated from 00. For example, what if we can sneak 0.50.5 into our system?

To make sure these tiny axioms are already doing something, try proving the next statement before opening the proof. At this point we are allowed to use only the two axioms and the definition above—no smuggling ordinary arithmetic through the back door!

Lemma (Example 1.4).33 is a natural number.

Proof.

By Definition 1.3, 3S(S(S(0)))3\coloneqq S(S(S(0))). Axiom 1.1 says that 00 is a natural number. Applying Axiom 1.2 three times tells us that S(0)S(0), then S(S(0))S(S(0)), and finally S(S(S(0)))S(S(S(0))) are natural numbers. Therefore, 33 is a natural number.

However, the first two axioms are not enough. Consider the system {0,1,2,3}\{0,1,2,3\} with

S(0)=1,S(1)=2,S(2)=3,S(3)=0.S(0)=1,\qquad S(1)=2,\qquad S(2)=3,\qquad S(3)=0.

It satisfies both axioms, but after reaching 33 it wraps around to 00. That is not the counting system we want, so we need another axiom.

Axiom 1.5.00 is not the successor of any natural number: S(n)0S(n)\neq 0 for every nNn\in\mathbb N.

Are three axioms enough? Still no. Consider {0,1,2,3,4}\{0,1,2,3,4\} with the expected successors until S(3)=4S(3)=4, but let S(4)=4S(4)=4. This system never returns to 00, so it satisfies Axiom 1.5. It gets stuck at 44 instead: every supposed numeral after 44 names the same object. We rule this out by requiring different inputs to have different successors.

Axiom 1.6.The successor operation is injective: if S(n)=S(m)S(n)=S(m), then n=mn=m.

We have excluded wrap-arounds and fixed points, but the axioms still allow unrelated successor chains. To see this, look temporarily at the following subset of the real numbers:

K={0,0.5,1,1.5,2,2.5,},S(x)=x+1.K=\{0, 0.5, 1, 1.5, 2, 2.5, \ldots\},\qquad S(x)=x+1.

Here S(x)=x+1S(x)=x+1 describes this example from the outside; it is not the addition that we will define in the next section. The elements 0,1,2,0,1,2,\ldots form one successor chain, while 0.5,1.5,2.5,0.5,1.5,2.5,\ldots form another. The axioms so far cannot tell us that the second chain is unwanted.

Axiom 1.7: Induction.If a subset ANA\subseteq\mathbb N contains 00 and is closed under successor, then A=NA=\mathbb N. Equivalently, if a property PP holds for 00 and P(n)P(S(n))P(n)\Rightarrow P(S(n)) for every nn, then PP holds for every natural number.

How does induction exclude KK? Take

A={0,1,2,}K.A=\{0,1,2,\ldots\}\subset K.

We have 0A0\in A, and xAx\in A implies S(x)AS(x)\in A. Therefore, AA contains the starting point and is closed under successor. If KK satisfied Axiom 1.7, we would have to conclude that A=KA=K, but 0.5K0.5\in K and 0.5A0.5\notin A. Therefore, KK does not satisfy induction.

For the rest of this note, N\mathbb N means a natural-number system satisfying these axioms. I am using the subset form of induction followed by Tao. A formal treatment of Peano arithmetic requires more care about what counts as a “property,” but that belongs to a note on logic rather than this construction.

1.2. Addition on Natural Numbers

We define addition by recursion on its first argument.

Definition 1.8: Addition.For m,nNm,n\in\mathbb N, 0+mm, S(n)+mS(n+m).0+m\coloneqq m, \ S(n)+m\coloneqq S(n+m).

The recursion and Axiom 1.2 show by induction on nn that n+mNn+m\in\mathbb N. Notice that the definition immediately controls the left argument. To move a successor in the right argument, we need a lemma.

Lemma 1.9: Right zero.For every nNn\in\mathbb N, n+0=nn+0=n.

Proof.

The base case is 0+0=00+0=0. If n+0=nn+0=n, then S(n)+0=S(n+0)=S(n).S(n)+0=S(n+0)=S(n). Induction on nn proves the claim.

Lemma 1.10: Right successor.For all n,mNn,m\in\mathbb N, n+S(m)=S(n+m)n+S(m)=S(n+m).

Proof.

Fix mm and induct on nn. For n=0n=0, 0+S(m)=S(m)=S(0+m).0+S(m)=S(m)=S(0+m). If n+S(m)=S(n+m)n+S(m)=S(n+m), then S(n)+S(m)=S(n+S(m))=S(S(n+m))=S(S(n)+m).S(n)+S(m)=S(n+S(m))=S(S(n+m))=S(S(n)+m). This is precisely the required statement with S(n)S(n) in place of nn.

In particular, because 1=S(0)1=S(0),

n+1=n+S(0)=S(n+0)=S(n).n+1=n+S(0)=S(n+0)=S(n).

Proposition 1.11: Commutativity of addition.For all n,mNn,m\in\mathbb N, n+m=m+nn+m=m+n.

Proof.

Fix mm and induct on nn. The base case is 0+m=m=m+00+m=m=m+0 by Definition 1.8 and Lemma 1.9. If n+m=m+nn+m=m+n, then S(n)+m=S(n+m)=S(m+n)=m+S(n).S(n)+m=S(n+m)=S(m+n)=m+S(n). The first equality is Definition 1.8, the middle equality uses the induction hypothesis, and the last is Lemma 1.10.

Proposition 1.12: Associativity of addition.For all a,b,cNa,b,c\in\mathbb N, (a+b)+c=a+(b+c)(a+b)+c=a+(b+c).

Proof.

Fix b,cb,c and induct on aa. For a=0a=0, both sides equal b+cb+c. If (a+b)+c=a+(b+c)(a+b)+c=a+(b+c), then:

(S(a)+b)+c=S((a+b)+c)=S(a+(b+c))=S(a)+(b+c).(S(a)+b)+c=S((a+b)+c)=S(a+(b+c))=S(a)+(b+c).

Each outer equality follows from Definition 1.8.

Lemma 1.13: Cancellation for addition.If a+b=a+ca+b=a+c, then b=cb=c.

Proof.

Induct on aa. When a=0a=0, the equality is b=cb=c. For the induction step, S(a)+b=S(a)+cS(a)+b=S(a)+c becomes S(a+b)=S(a+c)S(a+b)=S(a+c). Injectivity of SS gives a+b=a+ca+b=a+c, and the induction hypothesis gives b=cb=c.

Definition (Positive natural numbers).A natural number is positive if and only if it is not equal to 00.

This may feel exhausting—we already “know” that addition is commutative, yet we have spent several proofs earning the right to say it.

1.3. Multiplication on Natural Numbers

Multiplication is recursion on its first argument, just as addition was.

Definition 1.14: Multiplication.For m,nNm,n\in\mathbb N, 0m0,S(n)mnm+m.0m\coloneqq0,\qquad S(n)m\coloneqq nm+m.

Here we can see the hierarchy of the construction: multiplication is built from addition, and addition was built from successor. Later, exponentiation will be built from multiplication.

To prove commutativity, we again need right-hand versions of the defining equations.

Lemma 1.15: Right zero.For every nNn\in\mathbb N, n0=0n0=0.

Proof.

The base case 00=000=0 follows from Definition 1.14. If n0=0n0=0, then S(n)0=n0+0=0+0=0.S(n)0=n0+0=0+0=0.

Lemma 1.16: Right successor.For all n,mNn,m\in\mathbb N, nS(m)=nm+nnS(m)=nm+n.

Proof.

Fix mm and induct on nn. For n=0n=0, both sides are 00. If nS(m)=nm+nnS(m)=nm+n, then S(n)S(m)=nS(m)+S(m)=(nm+n)+S(m)=(nm+m)+S(n)=S(n)m+S(n).S(n)S(m)=nS(m)+S(m)=(nm+n)+S(m)=(nm+m)+S(n)=S(n)m+S(n). The third equality uses associativity, commutativity, and n+S(m)=S(n)+m=S(n+m)n+S(m)=S(n)+m=S(n+m).

Proposition 1.17: Commutativity of multiplication.For all n,mNn,m\in\mathbb N, nm=mnnm=mn.

Proof.

Fix mm and induct on nn. The base case is 0m=0=m00m=0=m0 by Definition 1.14 and Lemma 1.15. If nm=mnnm=mn, then S(n)m=nm+m=mn+m=mS(n),S(n)m=nm+m=mn+m=mS(n), where the last equality is Lemma 1.16.

Proposition 1.18: Distributivity.For all a,b,cNa,b,c\in\mathbb N, a(b+c)=ab+ac.a(b+c)=ab+ac. Consequently, (b+c)a=ba+ca(b+c)a=ba+ca by commutativity of multiplication.

Proof.

Fix b,cb,c and induct on aa. For a=0a=0, both sides are 00. If a(b+c)=ab+aca(b+c)=ab+ac, then S(a)(b+c)=a(b+c)+(b+c)=(ab+ac)+(b+c)=(ab+b)+(ac+c)=S(a)b+S(a)c.S(a)(b+c)=a(b+c)+(b+c)=(ab+ac)+(b+c)=(ab+b)+(ac+c)=S(a)b+S(a)c. We used associativity and commutativity of addition to regroup the middle expression.

The same kind of induction proves associativity, (ab)c=a(bc)(ab)c=a(bc), and the identity law 1a=a=a11a=a=a1. We will use these established natural-number laws when checking the integer construction below; a full development appears in Tao [Tao, 2022].

1.4. Arithmetic and Computation

Kurt Gödel
Kurt Gödel, whose incompleteness theorems exposed limits of formal arithmetic.

Arithmetic is expressive enough to encode finite strings of symbols and proofs as natural numbers. Gödel used such encodings to prove a precise limitation: any consistent, effectively axiomatized theory with enough arithmetic is incomplete. In particular, no such theory proves every sentence that is true in the standard natural numbers. This statement is about formal theories such as Peano arithmetic, not about the strong subset form of induction used above [Gödel, 1931].

Alan Turing
Alan Turing, whose machine model made computability mathematically precise.

Turing gave a mathematical model of an algorithm and proved that the halting behavior of arbitrary machines cannot itself be decided by one machine. This does not mean that computers can solve nothing difficult; it means that some precisely specified decision problems are undecidable [Turing, 1937]. Computability theory asks what can be computed at all. Complexity theory asks how much time, memory, or other resources computable problems require. They are related questions, but Gödel’s theorem does not collapse them into one result.

If this detour sounds interesting, Sipser’s Introduction to the Theory of Computation is a wonderful next stop—or you can wait for me to write notes about it someday 😳.

2. Integers

Natural-number addition cannot always undo itself. For example, there is no xNx\in\mathbb N satisfying 3+x=13+x=1. We want a larger number system in which every equation

b+x=ab+x=a

has a solution. We cannot call that solution aba-b yet, because subtraction is exactly what we are trying to construct.

The same enlargement instinct will appear again later. For example, R\mathbb R has no solution to x2+1=0x^2+1=0, while C\mathbb C does. That analogy explains the motivation, not the whole construction.

2.1. Formal Differences

Begin with ordered pairs (a,b)N×N(a,b)\in\mathbb N\times\mathbb N. Think of (a,b)(a,b) as a formal difference: the first coordinate records a positive contribution and the second a negative contribution. This is motivation, not subtraction already performed.

Different pairs should sometimes describe the same future integer. For example, adding the same natural number to both coordinates should change nothing. We therefore define

(a,b)(c,d)a+d=c+b.(a,b)\sim(c,d)\quad\Longleftrightarrow\quad a+d=c+b.

This definition uses only addition on N\mathbb N.

Definition 2.1: Equivalence relation.A relation \sim on a set SS is an equivalence relation when, for all x,y,zSx,y,z\in S, it is reflexive (xxx\sim x), symmetric (xyx\sim y implies yxy\sim x), and transitive (xyx\sim y and yzy\sim z imply xzx\sim z).

Proposition 2.2.The relation \sim on N×N\mathbb N\times\mathbb N is an equivalence relation.

Proof.

Reflexivity: a+b=a+ba+b=a+b, so (a,b)(a,b)(a,b)\sim(a,b).

Symmetry: if a+d=c+ba+d=c+b, then c+b=a+dc+b=a+d, so (c,d)(a,b)(c,d)\sim(a,b).

Transitivity: suppose (a,b)(c,d)(a,b)\sim(c,d) and (c,d)(e,f)(c,d)\sim(e,f). Thus

a+d=c+b,c+f=e+d.a+d=c+b,\qquad c+f=e+d.

Adding these equalities and rearranging gives

(c+d)+(a+f)=(c+d)+(e+b).(c+d)+(a+f)=(c+d)+(e+b).

Lemma 1.13 cancels c+dc+d, leaving a+f=e+ba+f=e+b. Hence (a,b)(e,f)(a,b)\sim(e,f).

Definition 2.3: Integers.

The equivalence class of (a,b)(a,b) is

[(a,b)]{(c,d)N2:(c,d)(a,b)}.[(a,b)]\coloneqq\{(c,d)\in\mathbb N^2:(c,d)\sim(a,b)\}.

We define

Z(N×N)/,\mathbb Z\coloneqq(\mathbb N\times\mathbb N)/\sim,

the set of all such equivalence classes.

An integer is thus a class of formal differences, not a pair that secretly solves an equation in a pre-existing number system.

2.2. Operations and Well-Definedness

When an operation is written using representatives, we must prove that replacing a representative by an equivalent one does not change the resulting class.

Example (Why representatives can betray us)

Suppose we try to define f:ZNf:\mathbb Z\to\mathbb N by taking the first coordinate:

f([(a,b)])a.f([(a,b)])\coloneqq a.

The pairs (2,1)(2,1) and (3,2)(3,2) are equivalent because 2+2=3+12+2=3+1. They therefore represent the same integer, but the proposed rule gives 22 from one representative and 33 from the other. So ff is not well-defined. An equivalence class lets us choose a representative for computation, but it does not let the answer depend on which representative happened to be chosen.

Definition 2.4: Integer operations.For x=[(a,b)]x=[(a,b)] and y=[(c,d)]y=[(c,d)], define x+y[(a+c,b+d)],x[(b,a)],x+y\coloneqq[(a+c,b+d)],\qquad -x\coloneqq[(b,a)], xyx+(y),xy[(ac+bd,ad+bc)].x-y\coloneqq x+(-y),\qquad xy\coloneqq[(ac+bd,ad+bc)].

Why is the multiplication formula so cumbersome? If we temporarily use the familiar subtraction notation only as motivation, then

(ab)(cd)=acadbc+bd=(ac+bd)(ad+bc).(a-b)(c-d)=ac-ad-bc+bd=(ac+bd)-(ad+bc).

This predicts the pair (ac+bd,ad+bc)(ac+bd,ad+bc): same-sign terms enter the first coordinate, while mixed terms enter the second. The displayed expansion helps us discover the definition, but the pair formula itself uses only natural-number addition and multiplication.

Proposition 2.5: Addition and negation are well-defined.Equivalent representatives give equivalent sums and equivalent negations.

Proof.

Suppose (a,b)(a,b)(a,b)\sim(a',b') and (c,d)(c,d)(c,d)\sim(c',d'). Then

a+b=a+b,c+d=c+d.a+b'=a'+b,\qquad c+d'=c'+d.

Adding and rearranging yields

(a+c)+(b+d)=(a+c)+(b+d),(a+c)+(b'+d')=(a'+c')+(b+d),

which says (a+c,b+d)(a+c,b+d)(a+c,b+d)\sim(a'+c',b'+d').

For negation, a+b=a+ba+b'=a'+b can be rearranged as b+a=b+ab+a'=b'+a. Hence (b,a)(b,a)(b,a)\sim(b',a'). Since subtraction is defined from addition and negation, it is well-defined too.

Proposition 2.6: Multiplication is well-defined.Equivalent representatives give equivalent products.

Proof.

It is enough to replace one factor at a time. Suppose (a,b)(a,b)(a,b)\sim(a',b'), so a+b=a+ba+b'=a'+b, and keep (c,d)(c,d) fixed. Distributivity gives ac+bc=ac+bc,ad+bd=ad+bd.ac+b'c=a'c+bc,\qquad ad+b'd=a'd+bd. Add the first equality to the reverse of the second and rearrange: (ac+bd)+(ad+bc)=(ac+bd)+(ad+bc).(ac+bd)+(a'd+b'c)=(a'c+b'd)+(ad+bc). Therefore (ac+bd,ad+bc)(ac+bd,ad+bc).(ac+bd,ad+bc)\sim(a'c+b'd,a'd+b'c). The pair formula is symmetric in (a,b)(a,b) and (c,d)(c,d) by commutativity in N\mathbb N, so the same argument replaces the second factor. Replacing first one factor and then the other proves the claim.

2.3. Seeing the Natural Numbers Inside the Integers

Define

ι:NZ,ι(n)=[(n,0)].\iota:\mathbb N\longrightarrow\mathbb Z,\qquad \iota(n)=[(n,0)].

Proposition 2.7: The natural-number embedding.The map ι\iota is injective and preserves 00, 11, addition, and multiplication.

Proof.

If ι(n)=ι(m)\iota(n)=\iota(m), then (n,0)(m,0)(n,0)\sim(m,0), so n+0=m+0n+0=m+0 and therefore n=mn=m. Thus ι\iota is injective.

Also,

ι(0)=[(0,0)],ι(1)=[(1,0)],\iota(0)=[(0,0)],\qquad \iota(1)=[(1,0)],

and

ι(n)+ι(m)=[(n+m,0+0)]=ι(n+m),ι(n)ι(m)=[(nm+0,n0+0m)]=[(nm,0)]=ι(nm).\begin{aligned} \iota(n)+\iota(m)&=[(n+m,0+0)]=\iota(n+m),\\ \iota(n)\iota(m)&=[(nm+0,n0+0m)]=[(nm,0)]=\iota(nm). \end{aligned}

Because ι\iota is injective and respects the arithmetic, we may identify nNn\in\mathbb N with [(n,0)]Z[(n,0)]\in\mathbb Z. Only now is it safe to compute

[(a,0)][(b,0)]=[(a,0)]+[(0,b)]=[(a,b)][(a,0)]-[(b,0)]=[(a,0)]+[(0,b)]=[(a,b)]

and use the abbreviation

[(a,b)]=ab.[(a,b)]=a-b.

It summarizes the construction; it was not used to define it. Likewise, n-n abbreviates [(0,n)][(0,n)].

2.4. Integer Arithmetic

Let

0Z[(0,0)],1Z[(1,0)].0_{\mathbb Z}\coloneqq[(0,0)],\qquad 1_{\mathbb Z}\coloneqq[(1,0)].
Proposition 2.8: Additive laws.

For all x,y,zZx,y,z\in\mathbb Z,

x+y=y+x,(x+y)+z=x+(y+z),x+0Z=x,x+y=y+x,\qquad (x+y)+z=x+(y+z),\qquad x+0_{\mathbb Z}=x,

and x+(x)=0Zx+(-x)=0_{\mathbb Z}.

Proof.

Choose representatives x=[(a,b)]x=[(a,b)], y=[(c,d)]y=[(c,d)], and z=[(e,f)]z=[(e,f)]. Commutativity and associativity follow coordinatewise from the corresponding laws in N\mathbb N. The identity law is [(a,b)]+[(0,0)]=[(a+0,b+0)]=[(a,b)].[(a,b)]+[(0,0)]=[(a+0,b+0)]=[(a,b)]. Finally, x+(x)=[(a+b,b+a)][(0,0)]x+(-x)=[(a+b,b+a)]\sim[(0,0)] because (a+b)+0=0+(b+a)(a+b)+0=0+(b+a). Thus every integer has an additive inverse.

Proposition 2.9: Multiplicative laws.

For all x,y,zZx,y,z\in\mathbb Z,

xy=yx,(xy)z=x(yz),1Zx=x,xy=yx,\qquad (xy)z=x(yz),\qquad 1_{\mathbb Z}x=x,

and

x(y+z)=xy+xz.x(y+z)=xy+xz.
Proof.

Commutativity follows immediately from the symmetry of

[(ac+bd,ad+bc)][(ac+bd,ad+bc)]

and commutativity in N\mathbb N. The identity calculation is

[(1,0)][(a,b)]=[(a,b)].[(1,0)][(a,b)]=[(a,b)].

For associativity, the representative of (xy)z(xy)z has coordinates

(ace+bde+adf+bcf,  acf+bdf+ade+bce),\bigl(ace+bde+adf+bcf,\; acf+bdf+ade+bce\bigr),

while the representative of x(yz)x(yz) has the same terms, possibly in a different order. Associativity and commutativity in N\mathbb N make the pairs equal.

For distributivity, direct expansion gives both x(y+z)x(y+z) and xy+xzxy+xz the representative

(ac+ae+bd+bf,  ad+af+bc+be).\bigl(ac+ae+bd+bf,\; ad+af+bc+be\bigr).

Because the operations are well-defined, these representative calculations prove laws about the equivalence classes themselves.

We have now obtained a commutative ring: addition forms an abelian group, multiplication is associative and commutative with identity, and multiplication distributes over addition.

2.5. Two Directions from Here

Congruence modulo a positive integer nn is another equivalence relation, this time on Z\mathbb Z:

ab(modn)a\equiv b\pmod n

when nn divides aba-b. Its equivalence classes form the residue-class ring Z/nZ\mathbb Z/n\mathbb Z. This is modular arithmetic. Elliptic-curve cryptography is more specific than “elliptic curves over Zn\mathbb Z_n”: it commonly uses elliptic curves over finite fields [Standards for Efficient Cryptography Group, 2010].

Integer-solution problems lead in another direction. A Diophantine equation is a polynomial equation for which integer solutions are sought. The equation a2+b2=c2a^2+b^2=c^2 has solutions such as (3,4,5)(3,4,5). Fermat’s Last Theorem says that for every integer exponent n>2n>2, the equation

an+bn=cna^n+b^n=c^n

has no solution in positive integers a,b,ca,b,c. Andrew Wiles’s corrected proof was completed in 1994 and published in 1995 [Wiles, 1995].

This is where we stop for now. The next question is natural: how can we enlarge Z\mathbb Z so that an equation bx=abx=a can be solved when b0b\neq0? Following that question will lead us to the rational numbers.


  1. [Tao, 2022]
    Analysis I[DOI]
    Tao, Terence, 2022. Springer.
  2. [Gödel, 1931]
    Über formal unentscheidbare Sätze der Principia Mathematica und verwandter Systeme I[DOI]
    Gödel, Kurt, 1931. Monatshefte für Mathematik und Physik, vol. 38, pp. 173--198
  3. [Turing, 1937]
    On Computable Numbers, with an Application to the Entscheidungsproblem[DOI]
    Turing, Alan M., 1937. Proceedings of the London Mathematical Society, vol. s2-42, pp. 230--265
  4. [Standards for Efficient Cryptography Group, 2010]
    SEC 2: Recommended Elliptic Curve Domain Parameters[PDF]
    Standards for Efficient Cryptography Group, 2010.
  5. [Wiles, 1995]
    Modular Elliptic Curves and Fermat's Last Theorem[DOI]
    Wiles, Andrew, 1995. Annals of Mathematics, vol. 141, pp. 443--551