Let $p$ be prime and $g,n$ integers.
Define $a(n)=(g^n \mod p)^{p-1} \mod p^2$
Some properties of $a(n)$:
- $a(n)$ is periodic with period divisor of $p-1$.
- The multiplicative order of $a(n)$ modulo $p^2$ is $p$.
- Let $D(n)$ be the discrete logarithm of $a(n)$, i.e. given $p,g,a(n)$ we have $g^{D(n)} \mod p^2=a(n)$. We can efficiently compute $D(n)=k(p-1)$ via p-adic logarithms.
- Let $g=2$. Experimentally with high probability we have $D(n) \mod p=D(n+1)+1 \mod p$.
Q1 Are there other functional relations between $g,n,a(n),D(n)$?
Q2 For $g=2$, when do we have $D(n) \mod p=D(n+1)+1 \mod p$?
Q3 What is the intuition for efficiently computing $D(n)$ for period divisor of $p-1$?
sagemath code follows, one can run it in a browser:
def seqanp2(p,g,n):
"""
a(n)=(g^n mod p)^(p-1) mod p^2
"""
try: g=lift(g)
except: pass
r1=lift((Integers(p)(g))**n)
K2=Integers(p**2)
res=K2(r1)**((p-1))
return res
def solveseqan(p,g,a):
"""
g^res =a(n) mod p^2
"""
try: g=lift(g)
except: pass
try: a=lift(a)
except: pass
K=Qp(p,2)
t=lift(K(a).log()/K(g).log() )
res=(p-1)*(p-t%p)
return res
set_random_seed(1)
p=next_prime(10**20);
K2=Integers(p**2);
g=K2(2)
n0=randint(2,p-2)
r1=seqanp2(p,g,n0);r2=seqanp2(p,g,n0+1);
s1=solveseqan(p,g,r1);s2=solveseqan(p,g,r2)
print(g**s1==r1,g**s2==r2,seqanp2(p,g,n0)==seqanp2(p,g,n0+p-1)) #True True True