(Note: All 
are taken to mean 
, unless indicated otherwise).[edit]The algorithm
Inputs: p, an odd prime. n, an integer which is a quadratic residue (mod p), meaning that the Legendre symbol 
.
Outputs: R, an integer satisfying 
.
- Factor out powers of 2 from p − 1, defining Q and S as:
with Q odd. Note that if 
, i.e. 
, then solutions are given directly by 
. - Select a z such that the Legendre symbol
(that is, z should be a quadratic non-residue modulo p), and set 
. - Let
- Loop:
- If
, return R. - Otherwise, find the lowest i,
, such that 
; e.g. via repeated squaring. - Let
, and set 
and 
.
- If
Once you have solved the congruence with R the second solution is p − R.
Example
Solving the congruence 
. It is clear that 
is odd, and since 
, 10 is a quadratic residue (by Euler's criterion).
- Step 1: Observe
so 
, 
.
- Step 2: Take
as the quadratic nonresidue (2 is a quadratic nonresidue since 
(again, Euler's criterion)). Set 
- Step 3:
- Step 4: Now we start the loop:
so 
; i.e. 
- Let
, so 
. - Set
. Set 
, and 
- We restart the loop, and since
we are done, returning 
- Let
Indeed, observe that 
and naturally also 
. So the algorithm yields two solutions to our congruence.
Proof
First write . Now write 
and 
, observing that 
. This latter congruence will be true after every iteration of the algorithm's main loop. If at any point, 
then 
and the algorithm terminates with 
.
If 
, then consider 
, a quadratic non-residue of 
. Let 
. Then 
and 
, which shows that the order of 
is 
.
Similarly we have 
, so the order of 
divides . Suppose the order of is 
. Since 
is a square modulo , is also a square, and hence 
.
Now we set 
and with this 
, 
and 
. As before, 
holds; however with this construction both and 
have order . This implies that 
has order 
with 
.
If 
then 
, and the algorithm stops, returning 
. Else, we restart the loop with analogous definitions of 
, 
, 
and 
until we arrive at an 
that equals 0. Since the sequence of S is strictly decreasing the algorithm terminates.