The double exponential runtime is tight for 2-stage stochastic ILPs

Abstract

We consider fundamental algorithmic number theoretic problems and their relation to a class of block structured Integer Linear Programs (ILPs) called 2-stage stochastic. A 2-stage stochastic ILP is an integer program of the form $\min \{c^T x \mid {\mathcal {A}} x = b, \ell \le x \le u, x \in {\mathbb {Z}}^{r + ns} \}$ where the constraint matrix ${\mathcal {A}} \in {\mathbb {Z}}^{nt \times r +ns}$ consists of n matrices $A_i \in {\mathbb {Z}}^{t \times r}$ on the vertical line and n matrices $B_i \in {\mathbb {Z}}^{t \times s}$ on the diagonal line aside. We show a stronger hardness result for a number theoretic problem called Quadratic Congruences where the objective is to compute a number $z \le \gamma$ satisfying $z^2 \equiv \alpha \bmod \beta$ for given $\alpha , \beta , \gamma \in {\mathbb {Z}}$. This problem was proven to be NP-hard already in 1978 by Manders and Adleman. However, this hardness only applies for instances where the prime factorization of $\beta$ admits large multiplicities of each prime number. We circumvent this necessity proving that the problem remains NP-hard, even if each prime number only occurs constantly often. Using this new hardness result for the $\textsc {Quadratic Congruences}$ problem, we prove a lower bound of $2^{2^{\delta (s+t)}} |I|^{O(1)}$ for some $\delta > 0$ for the running time of any algorithm solving 2-stage stochastic ILPs assuming the Exponential Time Hypothesis (ETH). Here, |I| is the encoding length of the instance. This result even holds if r, $||b||_{\infty }$, $||c||_{\infty }, ||\ell ||_{\infty }$ and the largest absolute value $\varDelta$ in the constraint matrix ${\mathcal {A}}$ are constant. This shows that the state-of-the-art algorithms are nearly tight. Further, it proves the suspicion that these ILPs are indeed harder to solve than the closely related $n$-fold ILPs where the constraint matrix is the transpose of ${\mathcal {A}}$.

1 Introduction

One of the most fundamental problems in algorithm theory and optimization is the Integer Linear Programming problem. Many theoretical and practical problems can be modeled as integer linear programs (ILPs) and thus, they serve as a very general but powerful framework for tackling various questions. Formally, the Integer Linear Programming problem is defined as

$$\begin{aligned} \min \{c^\top x \,|\, {\mathcal {A}}x = b, \ell \le x \le u, x \in {\mathbb {Z}}^{d_2}\} \end{aligned}$$

for some matrix ${\mathcal {A}} \in {\mathbb {Z}}^{d_1 \times d_2}$, a right-hand side $b \in {\mathbb {Z}}^{d_1}$, an objective function $c \in {\mathbb {Z}}^{d_2}$ and some lower and upper bounds $\ell , u \in {\mathbb {Z}}^{d_2}$. The goal is to find a solution x such that the value of the objective function $c^\top x$ is minimized. In general, this problem is NP-hard. Thus, it is of great interest to find structures to these ILPs which make them solvable more efficiently. This work considers 2-stage stochastic integer linear programs where the constraint matrix admits a specific block structure. Namely, the constraint matrix ${\mathcal {A}}$ only contains non-zero entries in the first few columns and block-wise along the the diagonal aside. This yields a constraint matrix ${\mathcal {A}}$ of 2-stage stochastic form:

$$\begin{aligned} {\mathcal {A}} = \begin{pmatrix} A_1 &{}\quad B_1 &{}\quad 0 &{} \quad \dots &{}\quad 0 \\ A_2 &{}\quad 0 &{}\quad B_2 &{} \quad \ddots &{}\quad \vdots \\ \vdots &{}\quad \vdots &{}\quad \ddots &{} \quad \ddots &{}\quad 0 \\ A_n &{} \quad 0 &{} \quad \dots &{}\quad 0 &{} \quad B_n \end{pmatrix}. \end{aligned}$$

Thereby $A_1, \dots , A_n \in {\mathbb {Z}}^{t \times r}$ and $B_1, \dots , B_n \in {\mathbb {Z}}^{t \times s}$ are integer matrices themselves. The complete constraint matrix ${\mathcal {A}}$ has size $nt \times r +ns$. Let $\varDelta$ denote the largest absolute entry in ${\mathcal {A}}$.

Such 2-stage stochastic ILPs are a common tool in stochastic programming and they are often used in practice to model uncertainty of decision making over time [1, 11, 22, 28]. In particular, each block of the second stage encodes a different scenario, i. e., its restrictions and behaviour. The first stage is used to encode the probability that the respective scenario occurs. Due to the applicability, a lot of research has been done in order to solve these (mixed) ILPs efficiently in practice. Since we focus on the theoretical aspects of 2-stage stochastic ILPs in this chapter, we only refer the reader to the surveys [13, 26, 32] and the references therein regarding the practical methods.

The current state-of-the-art algorithms to solve 2-stage stochastic ILPs admits a running time of $3^{(r+s)s^s(2r\varDelta +1)^{rs}} n\log ^3(n) \cdot |I|$ where |I| is the binary encoding length of the input [12, 20] or respectively of $n \log ^{O(rs)}(n) 2^{(2\varDelta )^{O(r^2 + rs)}}$ [7] by a recent result. The first result improves upon the result in [23] due to Klein where the dependence on n was quadratic. The dependencies on the block dimensions and |I| were similar. The first result in that respect was by Hemmecke and Schulz [16] who provided an algorithm with a running time of $f(r,s,t, \varDelta ) \cdot \text {poly}(n)$ for some computable function f. However, due to the use of an existential result from commutative algebra, no explicit bound could be stated for f.

Let us turn our attention to the $n$-fold ILPs for a moment, which where first introduced in [9]. These ILPs admit a constraint matrix which is the transpose of the 2-stage stochastic constraint matrix. Despite being so closely related, $n$-fold ILPs can be solved in time near linear in the number of blocks and only single exponentially in the block-dimensions of $A_i^T, B_i^T$ [6, 21].

Thus, it is an intrinsic questions whether we can solve 2-stage stochastic ILPs more efficient or – as the latest algorithms suggest – whether 2-stage stochastic ILPs are indeed harder to solve than the closely related $n$-fold ILPs. We answer this question by showing a double-exponential lower bound in the running time for any algorithm solving the 2-stage stochastic integer linear programming (2-stage ILP) problem. Here, the 2-stage ILP problem is the corresponding decision variant which asks whether the ILP admits a feasible solution. We summarize this problem formally as follows:

To prove this hardness, we reduce from the Quadratic Congruences problem. This problem asks whether there exists a $z \le \gamma$ such that $z^2 \equiv \alpha \bmod \beta$ for some $\gamma , \alpha , \beta \in {\mathbb {N}}$. Formally, we get:

This problem was proven to be NP-hard by Manders and Adleman [29] already in 1978 by showing a reduction from 3-SAT. This hardness even persists if the prime factorization of $\beta$ is given [29]. By this result, Manders and Adleman prove that it is NP-complete to compute the solutions of diophantine equations of degree 2. However, their reduction yields large parameters: the occurrences of each prime factor in the prime factorization of $\beta$ is too large to obtain the desired lower bound for the 2-stage ILP problem. In particular, the occurrence of each prime factor is at least linear in the number of variables and clauses of the underlying 3-SAT problem. As the reduction generates block dimensions of size logarithmic in the largest prime factor to the power of its occurrence, the dependence on its occurrence and thus, on $n_3$, is linear, whereas we aim for a logarithmic one to show the desired hardness.

We give a new reduction yielding a stronger statement: The Quadratic Congruences problem is NP-hard even if the prime factorization of $\beta$ is given and each prime factor occurs at most once (except 2 which occurs four times). Beside being useful to prove the lower bounds for solving the 2-stage stochastic ILPs, we think this results is of independent interest. We obtain a neat structure which may be helpful in various related problems or may yield stronger statements of past results which use the Quadratic Congruences problem.

Along the way to reduce to the 2-stage stochastic ILPs, based on this new reduction, we show strong NP-hardness for another problem we call the Non-Unique Remainder problem. In this algorithmic number theoretic problem, we are given $x_1, \dots , x_{n_{\text {NR}}}, y_1, \dots , y_{n_{\text {NR}}}, \zeta \in {\mathbb {N}}$ and pairwise coprime numbers $q_1, \dots , q_{n_{\text {NR}}}$. The question is to decide whether there exists a number $z \in {\mathbb {Z}}_{>0}$ with $z \le \zeta$ satisfying $z \bmod q_i \in \{x_i, y_i\}$ for all $i \in [n_\text {NR}]$. In other words, either the residue $x_i$ or $y_i$ should be met for each equation. We summarize this problem as follows:

This problem is a natural generalization of the Chinese Remainder problem where $x_i = y_i$ for all i. In that case, however, the problem can be solved using the Extended Euclidean algorithm. To the best of our knowledge the Non-Unique Remainder problem has not been considered in the literature so far.

In order to finally achieve the desired lower bounds on the running time for the 2-stage stochastic ILP problem, we make use of the Exponential Time Hypothesis (ETH) – a widely believed conjecture stating that the 3-SAT problem cannot be solved in subexponentially time with respect to the number of variables:

Conjecture 1

(ETH [17]) The 3-SAT problem cannot be solved in time less than $O(2^{\delta _\text {3}n_\text {3}})$ for some constant $\delta _\text {3}> 0$ where $n_\text {3}$ is the number of variables in the instance.

Note that we use the index 3 for all variables of the 3-SAT problem.

Using the ETH, plenty lower bounds for various problems are shown, for an overview on the techniques and results see e.g. [8]. So far, the best algorithm runs in time $O(2^{0.387 n_{\text {3}}})$, i. e., it follows that $\delta _\text {3}\le 0.387$ [8].

In the following, we also need the Chinese Remainder Theorem (CRT) for some of the proofs, which states the following:

Proposition 1

(CRT [19]) Let $n_1, \dots , n_k$ be pairwise co-prime. Further, let $i_1, \dots , i_k$ be some integers. Then there exists integers x satisfying $x \equiv i_j \bmod n_j$ for all j. Further, any two solutions $x_1$, $x_2$ are congruent modulo $\prod _{j=1}^k n_j$.

Summary of Results

• We give a new reduction from the 3-SAT problem to the Quadratic Congruences problem which proves a stronger NP-hardness result: The Quadratic Congruences problem remains NP-hard, even if the prime factorization of $\beta$ is given and each prime number greater than 2 occurs at most once and the prime number 2 occurs four times. This does not follow from the original proof. In contrast, the original proof generates each prime factor at least $O(n_\text {3}+ m_\text {3})$ times, where $m_\text {3}$ is the number of clauses in the formula. Our reduction circumvents this necessity, yet neither introduces noteworthily more nor larger prime factors. The proof is based on the original one. We believe this result is of independent interest.

• Based on this new reduction, we show strong NP-hardness for the Non-Unique Remainder problem. This problem is a natural generalization of the Chinese Remainder problem where $x_i = y_i$ for all i. To the best of our knowledge the Non-Unique Remainder problem has not been considered in the literature so far.

• Finally, we show that the Non-Unique Remainder problem can be modeled by a 2-stage stochastic ILP. Assuming the ETH, we can then conclude a doubly exponential lower bound of $2^{2^{\delta (s+t)}}|I|^{O(1)}$ on the running time for any algorithm solving 2-stage stochastic ILPs. The double exponential lower bound even holds if the number of first stage variables $r=1$, and the largest entries in the constraint matrix, the right-hand side and the objective function are constant, i. e., $\varDelta , ||b||_{\infty }, ||c||_{\infty } \in O(1)$. This proves the suspicion that 2-stage stochastic ILPs are significantly harder to solve than $n$-fold ILPs with respect to the dimensions of the block matrices and $\varDelta$. Furthermore, it implies that the current state-of-the-art algorithms for solving 2-stage stochastic ILPs is indeed (nearly) optimal.

Further Related Work In recent years, there was significant progress in the development of algorithms for n-fold ILPs and lower bounds on the other hand. Assume the parameters as of the transpose of the 2-stage stochastic constraint matrix, i. e., the blocks $A_i^T$ in the first few rows have dimension $r \times t$ and the blocks $B_i^T$ along the diagonal beneath admit a dimension of $s \times t$. The best known algorithms to solve these ILPs have a running time of $2^{O(rs^2)}(rs\varDelta )^{O(r^2s+s^2)} (nt)^{1+o(1)}$ [6] or respectively a running time of $(rs\varDelta )^{r^2s+s^2} L^2 (nt)^{1+o(1)}$ [21] where L denotes the encoding length of the largest number in the input. The best known lower bound is $\varDelta ^{\delta _{\text {n-fold{}}}(r+s)^2}$ for some $\delta _{\text {n-fold{}}} > 0$ [12].

Despite their similarity, it seems that 2-stage stochastic ILPs are significantly harder to solve than $n$-fold ILPs. Yet, no superexponential lower bound for the running time of any algorithm solving the 2-stage ILP problem was shown. There is a lower bound for a more general class of ILPs in [12] that contain 2-stage stochastic ILPs showing that the running time is double-exponential parameterized by the topological height of the treedepth decomposition of the primal or dual graph. However, the topological height of 2-stage stochastic ILPs is constant and thus, no strong lower bound can be derived for this case.

If we relax the necessity of an integral solution, the 2-stage stochastic LP problem becomes solvable in time $2^{2\varDelta ^{O(t^3)}} n \log ^3(n) \log (||u-\ell ||_{\infty })$ $\log (||c||_{\infty })$ [3]. For the case of mixed integer linear programs, there exists an algorithm solving 2-stage stochastic MILPs in time $2^{\varDelta ^{\varDelta ^{t^{O(t^2)}}}} n \log ^3(n) \log (||u-\ell ||_{\infty }) \log (||c||_{\infty })$ [3]. Note that t can be replaced by $r+s$ as this value corresponds to the size of a submatrix with full rang derived from any block, see [3]. Both results rely on the fractionality of a solution whose size is only dependent on the parameters. This allows us to scale the problem such that it becomes an ILP (as the solution has to be integral) and thus, state-of-the-art algorithms for 2-stage stochastic ILPs can be applied.

There are also studies for a more general case called 4-Block ILPs where the constraint matrix consists of non-zero entries in the first few columns, the first few rows and block-wise along the diagonal. This may be seen as the combination of $n$-fold and 2-stage stochastic ILPs. Only little is known about them: They are in XP [15]. Further, a lower and upper bound on the Graver Basis elements (inclusion-wise minimal kernel elements) of $O(n^{r} f(k,\varDelta ))$ was shown recently [4], where r is the number of rows in the submatrix appearing repeatedly in the first few rows and k denotes the sum of the remaining block dimensions. There are also various results for recursive block structures, for an overview see [12, 24].

Structure of this Chapter Sect. 2 presents the stronger hardness result for the Quadratic Congruences problem we derive by enhancing the original reduction by Manders and Adleman from the 3-SAT problem. Due to the technical depth and length, however, the formal proof it postponed to Sect. 5. In Sect. 3, we show that the Quadratic Congruences problem can be modeled as a 2-stage stochastic ILP. To do so, we utilize the Non-Unique Remainder problem as an intermediate step during the reduction. Finally, in Sect. 4, we bring the reductions together to prove the desired lower bound. This involves a construction which lowers the absolute value of $\varDelta$ at the cost of slightly larger block dimensions.

2 Advanced hardness for Quadratic Congruences

This section presents that every instance of the 3-SAT problem can be transformed into an equivalent instance of the Quadratic Congruences problem in polynomial time. Recall that the Quadratic Congruences problem asks whether there exists a number $z \le \gamma$ such that $z^2 \equiv \alpha \bmod \beta$ holds. This problem was proven to be NP-hard by Manders and Adleman [29] showing a reduction from 3-SAT. This hardness even persists when the prime factorization of $\beta$ is given [29]. However, we aim for an even stronger statement: The Quadratic Congruences problem remains NP-hard even if the prime factorization of $\beta$ is given and each prime number greater than 2 occurs at most once and the prime number 2 occurs four times. This does not follow from the original hardness proof. In contrast, if $n_\text {3}$ is the number of variables and $m_\text {3}$ the number of clauses in the 3-SAT formula then $\beta$ admits a prime factorization with $O(n_\text {3}+m_\text {3})$ different prime numbers each with a multiplicity of at least $O(n_\text {3}+m_\text {3})$. Even though our new reduction lowers the occurrence of each prime factor greatly, the number of prime factors as well as their size do not enlarge notably.

While the idea and thus, the structure follows the proof of the original one from [29], adapting it to our needs requires various new observations concerning the behaviour of the newly generated prime factors and the functions we introduce. The original proof heavily depends on the numbers being high powers of the prime factors whereas we employ careful combinations of (new) prime factors. This requires us to introduce other number theoretical results as for example Lemma 1 into the arguments to estimate the bounds and function appropriately.

In the following, we want to give an idea of the hardness proof. The reduction may seem non-intuitive at first as it only shows the final result of equivalent transformations between various problems until we reach the Quadratic Congruences one. We list all these problems in order of their appearance whose strong NP-hardness is shown implicitly along the way. Afterwards, we give short ideas of their respective equivalence, which are proven in separate claims in the full proof, see Sect. 5. Note that not all variables are declared at this point, but also not necessary to understand the proof sketch.

• (3-SAT) Is there a function $\eta :x_i \rightarrow \{0,1\}$ assigning a truth value to each variable that satisfies all clauses $\sigma _k$ of the 3-SAT formula $\varPhi$ simultaneously?

• (P2) Are there values $y_k \in \{0,1,2,3\}$ and a truth assignment $\eta$ such that $0 = y_k - \sum _{x_i \in \sigma _k} \eta (x_i) - \sum _{\bar{x_i} \in \sigma _k} (1 - \eta (x_i)) +1$ for all k?

• (P3) Are there values $\alpha _j \in \{-1, +1\}$ such that $\sum _{j=0}^\nu \theta _j \alpha _j \equiv \tau \bmod 2^3 \cdot p^* \prod _{i=1}^{m'} p_i$ for some $\theta _j$ and $\tau$ specified in dependence on the formula later on, and some prime numbers $p_i$ and $p^*$?

• (P5) Is there an $x \in {\mathbb {Z}}$ satisfying

  $$\begin{aligned}&0 \le |x| \le H \end{aligned}$$

  (P5.1)
  $$\begin{aligned} x \equiv \tau \bmod 2^3 \cdot p^* \prod _{i=1}^{m'} p_i \end{aligned}$$

  (P5.2)
  $$\begin{aligned} (H+x)(H-x) \equiv 0 \bmod K? \end{aligned}$$

  (P5.3)

  for some H dependent on the $\theta _j$ and K being a product of primes?

• (P6) Is there an $x \in {\mathbb {Z}}$ satisfying

  $$\begin{aligned} 0 \le |x| \le H \end{aligned}$$

  (P6.1)
  $$\begin{aligned} (\tau -x)(\tau +x) \equiv 0 \bmod 2^4 \cdot p^* \prod _{i=1}^{m'} p_i \end{aligned}$$

  (P6.2)
  $$\begin{aligned} (H+x)(H-x) \equiv 0 \bmod K ? \end{aligned}$$

  (P6.3)

• (Quadratic Congruences) Is there a number $x \le H$ such that $(2^4 \cdot p^* \cdot \prod _{i=1}^{m'} p_i + K)x^2 \equiv K\tau ^2 + 2^4 \cdot p^* \cdot \prod _{i=1}^{m'} p_i H^2 \bmod 2^4 \cdot p^* \cdot \prod _{i=1}^{m'} p_i \cdot K ?$

The 3-SAT problem is transformed to Problem (P2) by using the straight-forward interpretation of truth values as numbers 0 and 1 and the satisfiability of a clause as the sum of its literals being larger zero. Introducing slack variables $y_k$ yields the above form, see Claim 3.

Multiplying each equation of (P2) with exponentially growing factors and then forming their sum preserves the equivalence of these systems. Introducing some modulo consisting of unique prime factors larger than the outcome of the largest possible sum obviously does not influence the system. Replacing the variables $\eta (x_i)$ and $y_k$ by variables $\alpha _j$ with domain $\{-1, +1\}$, re-arranging the term and defining parts of the formula as the variables $\theta _j$ and $\tau$ yields Problem (P3), see Claim 4.

We then introduce some Problem (P4) to integrate the condition $x \le H$. The problem asks whether there exists some $x \in {\mathbb {Z}}$ such that

$$\begin{aligned} 0 \le |x| \le H \end{aligned}$$

(P4.1)

$$\begin{aligned} (H + x) (H -x) \equiv 0 \bmod K? \end{aligned}$$

(P4.2)

By showing that each solution to the system (P4) is of form $\sum _{j=0}^\nu \theta _j \alpha _j$, we can combine (P3) and (P4) yielding (P5), see Claim 5.

Using some observations about the form of solutions for the second constraint of Problem (P5), we can re-formulate it as Problem (P6), see Claim 6.

Next, we use the fact that $p^* \prod _{i=1}^{m'} p_i$ and K are co-prime per definition and thus, we can combine (P6.2) and (P6.3) to one equivalent equation. To do so, we take each left-hand side of (P6.2) and (P6.3) and multiply the modulo of the respective other equation and form their overall sum. Using a little re-arranging, this finally yields the desired Quadratic Congruences problem, see Claim 7. Note that by re-arranging the factor to the other side of the equivalence, this form is exactly the same as in the problem statement. Overall, we get the following Theorem.

Theorem 1

An instance of the 3-SAT problem with $n_\text {3}$ variables and $m_\text {3}$ clauses is reducible to an instance of the Quadratic Congruences problem in polynomial time with the properties that $\alpha , \beta , \gamma \in 2^{O((n_\text {3}+m_\text {3})^2 \log (n_\text {3}+ m_\text {3}))}$, $n_{\text {QC}} \in O((n_\text {3}+m_\text {3})^2)$, $max_{i}\{b_i\} \in O((n_\text {3}+m_\text {3})^2\log (n_\text {3}+m_\text {3}))$, and each prime factor in $\beta$ occurs at most once except the prime factor 2 which occurs four times.

Due to the technical depth and length, the actual proof it postponed to Sect. 5.

3 Reduction from the quadratic congruences problem

This section presents the reduction from the Quadratic Congruences problem to the 2-stage ILP problem. First, we present a transformation of an instance of the Quadratic Congruences problem to an instance of the Non-Unique Remainder problem. This problem was not considered in the literature so far and serves as an intermediate step in this chapter. However, it might be of independent interest as it generalizes the prominent Chinese Remainder theorem. Secondly, we show how an instance of the Non-Unique Remainder problem can be modelled as a 2-stage stochastic ILP. Recall that in the Non-Unique Remainder problem, we are given numbers $x_1, \dots , x_{n_{\text {NR}}}, y_1, \dots , y_{n_{\text {NR}}}, q_1, \dots , q_{n_{\text {NR}}}, \zeta \in {\mathbb {N}}$ where the $q_i$s are pairwise co-prime. The question is to decide whether there exists a natural number z satisfying $z \bmod q_i \in \{x_i, y_i\}$ simultaneously for all $i \in \{1, 2, \dots , n_{\text {NR}}\}$ and which is smaller or equal to $\zeta$.

In other words, we either should meet the residue $x_i$ or $y_i$. Thus, we can re-write the equation as $z \equiv x_i \bmod q_i$ or $z \equiv y_i \bmod q_i$ for all i.

Indeed, this problem becomes easy if $x_i = y_i$ for all i, i. e., we know the remainder we want to satisfy for each equation [33]: First, compute $s_i$ and $r_i$ with $r_i \cdot q_i + s_i \cdot \prod _{j=1, j\ne i}^{n_{\text {NR}}} q_j = 1$ for all i using the Extended Euclidean algorithm. Now it holds that $s_i \cdot \prod _{j=1, j\ne i}^{n_{\text {NR}}} q_j \equiv 1 \bmod q_i$ as $q_i$ and $\prod _{j=1, j\ne i}^{n_{\text {NR}}} q_j$ are coprime, and $s_i \cdot \prod _{j=1, j\ne i}^{n_{\text {NR}}} q_j \equiv 0 \bmod q_j$ for $j \ne i$. Thus, the smallest solution corresponds to $z = \sum _{i=1}^{n_{\text {NR}}} x_i \cdot s_i \cdot \prod _{j=1, j\ne i}^{n_{\text {NR}}} q_j$ due to the Chinese Remainder theorem [33]. Comparing z to the bound $\zeta$ finally yields the answer. Also note that if $n_{\text {NR}}$ is constant, we can solve the problem by testing all possible vectors $(v_1, \dots , v_{n_{\text {NR}}})$ with $v_i \in \{x_i, y_i\}$ and then use the Chinese Remainder theorem as explained above.

Theorem 2

The Quadratic Congruences problem is reducible to the Non-Unique Remainder problem in polynomial time with the properties that $n_{\text {NR}} \in O(n_{\text {QC}})$, $\max _{i \in \{1, \dots , n_{\text {NR}}\}}\{q_i, x_i, y_i\}=O(\max _{j \in \{1, \dots , n_{\text {QC}}\}}\{b_j^{\beta _j}\}$, and $\zeta \in O(\gamma )$.

Proof

Transformation: Set $q_1 = b_1^{\beta _1}, \dots , q_{n_{\text {NR}}} = b_{n_{\text {QC}}}^{\beta _{\text {QC}}}$ and $\zeta = \gamma$ where $\beta _i$ denotes the occurrence of the prime factor $b_i$ in the prime factorization of $\beta$. Compute $\alpha _i \equiv \alpha \bmod q_i$. Set $x_i^2 = \alpha _i$ if there exists such an $x_i \in {\mathbb {Z}}_{q_i}$. Further, compute $y_i = -x_i+q_i$. If there is no such number $x_i$ and thus, $y_i$, produce a trivial no-instance.

Instance size: The numbers we generate in the reduction equal the prime numbers of the Quadratic Congruences problem including their occurrence. Hence, it holds that $\max _{i \in \{1, \dots , n_{\text {NR}}\}}\{q_i\}$ $=O(\max _{j \in \{1, \dots , n_{\text {QC}}\}}\{b_j^{\beta _j}\}$. Due to the modulo, this value also bounds $x_i$ and $y_i$. The upper bound on a solution equals the ones from the instance of the Quadratic Congruences problem, i. e., $\zeta \in O(\gamma )$, and $n_{\text {NR}} = n_{\text {QC}}$ holds.

Correctness: First, let us verify that producing a trivial no-instance is correct if we cannot find some $x_i$. Indeed, this can be traced back to the Chinese Remainder theorem: If and only if there is an x with $x^2 \equiv \alpha \bmod \beta$ and $q_1, \dots , q_{n_{\text {NR}}}$ (i. e., the equivalences to $b_i^{\beta _i}$) is the prime factorization of $\beta$, then $x^2 \equiv \alpha _i \bmod q_i$, $\alpha _i \in {\mathbb {Z}}_{q_i}$ for all i. In other words, it is has to be dividable by all $b_i^{\beta _i}$ yielding the same remainder $\alpha$ (modulo $b_i^{\beta _i}$). Hence, if there does not exists a square root of $\alpha$ in one of the systems then $x^2 \equiv \alpha \bmod \beta$ has no solution.

But if there exists $x_i$ and $y_i$, these values are in ${\mathbb {Z}}_{q_i}$ as $x_i \le \alpha _i < q_i$ per definition of $x_i$ and $\alpha _i$. Further, both values solve the problem $x_i^2, y_i^2 \equiv \alpha \bmod q_i$ as $x_i^2 \equiv \alpha _i \bmod q_i \equiv \alpha _i + \lambda \cdot q_i \bmod q_i \equiv \alpha \bmod q_i$ for some $\lambda \in {\mathbb {N}}$. Moreover,

$$\begin{aligned} y_i^2&\equiv (-x_i + q_i)^2 \bmod q_i = q_i^2 - 2x_iq_i + x_i^2 \bmod q_i \\&\equiv x_i^2 \bmod q_i \equiv \alpha \bmod q_i. \end{aligned}$$

The third equation holds as each summand except the last one is a multiple of $q_i$. The last transformation is true due to the computation above.

Note that for all prime numbers greater than 2 it holds that $x_i \ne y_i$. This can easily be seen as we already argued that $x_i$ and $y_i$ are in ${\mathbb {Z}}_{p_i}$. Let us suppose both values are equal, i. e.,

$$\begin{aligned} x_i^2&= y_i^2 \\&\Leftrightarrow \alpha _i = (-x_i + q_i)^2 \\&\Leftrightarrow \alpha _i = q_i^2 - 2q_ix_i + x_i^2 \\&\Leftrightarrow \alpha _i = q_i^2 - 2q_ix_i + \alpha _i \\&\Leftrightarrow 2q_ix_i = q_i^2\\&\Leftrightarrow 2x_i = q_i . \end{aligned}$$

The factor $q_i$ is a product of some prime number greater than 2 by the assumption above. Thus, there is no $x_i$ satisfying the formula.

Let us now prove the equivalence of the reduction.

$\Rightarrow$ Let the instance of the Quadratic Congruences problem be a yes-instance. Then there exists a z satisfying $z^2 \equiv \alpha \bmod \beta$ with $0 < z \le \gamma$. This solution directly corresponds to a solution of the generated instance of the Non-Unique Remainder problem. First, $z \le \gamma = \zeta$. Secondly, z satisfies all equations as it holds that

$$\begin{aligned} z^2 \equiv \alpha \bmod \beta \equiv \alpha \bmod \prod _{i=1}^{n_{\text {NR}}} b_i^{\beta _i} \equiv \alpha \bmod b_i^{\beta _i} \text { for all } i. \end{aligned}$$

The first equivalence holds as the $b_i^{\beta _i}$s are the prime factorization of $\beta$. The second equivalence is true as we can decompose the solution as follows: $z^2 = \lambda \cdot \prod _{i=1}^{n} b_i^{\beta _i} + \alpha$ for some $\lambda \in {\mathbb {N}}$. Thus, the first summand is not only divided without remainder by $\prod _{i=1}^{n_{\text {NR}}} b_i^{\beta _i}$ but also by all primes along with their occurrences alone, leaving only the second summand $\alpha$ as the remainder. Further, since $x_i^2, y_i^2 \equiv \alpha \bmod q_i$ as shown before, it holds that

$$\begin{aligned} z^2 \equiv \alpha \bmod b_i^{\beta _i} \equiv \alpha \bmod q_i \equiv x_i^2 \equiv y_i^2 \text { for all } i. \end{aligned}$$

Hence, this satisfies all equations of the generated instance of the Non-Unique Remainder problem making it a yes-instance.

$\Leftarrow$ Let the instance of the Non-Unique Remainder problem be a yes-instance. Hence, we could verify that there exists a solution to the given equations smaller than $\zeta$. Let this solution be denoted as $z^*$. It holds that $z^* \equiv x_i \bmod q_i$ or $z \equiv y_i \bmod q_i$. Let $v_i$ correspond to the residue that was satisfied, i. e., $v_i = x_i$ or $v_i = y_i$. The solution $z^*$ also solves the Quadratic Congruences problem. First, $z^* \le \zeta = \gamma$. Further, it holds per definition of the numbers that

$$\begin{aligned} (z^*)^2 \equiv (v_i)^2 \equiv \alpha \bmod q_i \text { for all } i. \end{aligned}$$

As it satisfies all equations simultaneously and the $b_i$ are pairwise co-prime, it follows from the Chinese Remainder theorem that

$$\begin{aligned} (z^*)^2&\equiv (v_i)^2 \equiv \alpha \bmod q_i \text { for all } i \\&\equiv (z^*)^2 \equiv \alpha \bmod \prod _{i=1}^{n_{\text {NR}}} q_i \equiv \alpha \bmod \prod _{i=1}^{n_{\text {QC}}} b_i^{\beta _i} \equiv \alpha \bmod \beta \end{aligned}$$

as the $b_i^{\beta _i}$s are the prime factorization of $\beta$.

Running time: Setting the variables accordingly can be done in time polynomial in $n_{\text {QC}}$. Further, computing each $x_i, y_i$ can be done in poly-logarithmic time regarding the largest absolute number for each $i \in \{1, \dots , n_{\text {NR}}\}$ [5]. $\square$

Finally, we reduce the Non-Unique Remainder problem to the 2-stage ILP problem. Note that the considered 2-stage ILP problem is a decision problem. In other words, we only seek to determine whether there exists a feasible solution. We neither optimize a solution vector nor are we interested in the solution vector itself.

Theorem 3

The Non-Unique Remainder problem is reducible to the 2-stage ILP problem in polynomial time with the properties that $n \in O(n_{\text {NR}})$, $r,s,t, ||c||_{\infty }, ||b||_{\infty }, ||\ell ||_{\infty } \in O(1)$, $||u||_{\infty } \in O(\zeta )$, and $\varDelta \in O(\max _i\{q_i\})$.

Proof

Transformation: Having the instance for the Non-Unique Remainder problem at hand we construct our ILP as follows with $n = n_{\text {NR}}$:

$$\begin{aligned} {\mathcal {A}} \cdot x = \begin{pmatrix} -1 &{}\quad q_1 &{}\quad x_1 &{}\quad y_1 &{}\quad 0&{}\quad \dots &{}\quad 0&{}\quad 0 &{}\quad \dots &{}\quad 0 \\ 0 &{}\quad 0 &{}\quad 1 &{} \quad 1 &{}\quad 0&{}\quad \dots &{}\quad 0&{}\quad 0 &{} \quad \dots &{} \quad 0 \\ \vdots &{}\quad \vdots &{}\quad \ddots &{}\quad \ddots &{}\quad \ddots &{}\quad \ddots &{}\quad \ddots &{}\quad \ddots &{}\ddots &{}\quad \ddots \\ -1 &{}\quad 0 &{}\quad \dots &{} \quad 0 &{}\quad 0&{}\quad \dots &{}\quad 0&{} \quad q_n &{}\quad x_n &{}\quad y_n \\ 0 &{}\quad 0 &{} \quad \dots &{} \quad 0 &{}\quad 0&{}\quad \dots &{}\quad 0&{} \quad 0 &{}\quad 1 &{}\quad 1 \\ \end{pmatrix} \cdot x = b = \begin{pmatrix} 0 \\ 1 \\ \vdots \\ 0 \\ 1 \\ \end{pmatrix}. \end{aligned}$$

All variables get a lower bound of 0 and an upper bound of $\zeta$. We can set the objective function arbitrarily as we are just searching for a feasible solution, hence we set it to $c = (0, 0, \dots , 0)^\top$.

Instance size: Due to our construction, it holds that $t = 2, r = 1, s = 3$. The number n of repeated blocks equals the number $n_{\text {NR}}$ of equations in the instance of the Non-Unique Remainder problem. The largest entry $\varDelta$ can be bounded by $\max _i\{q_i\}$. The lower and upper bounds are at most $||u||_{\infty } = O(\zeta )$, $||\ell ||_{\infty } = O(1)$. The objective function c is set to zero and is thus of constant size. The largest value in the right-hand side is $||b||_\infty = 1$.

Correctness: $\Rightarrow$ Let the given instance of the Non-Unique Remainder problem be a yes-instance. Thus, there exists a solution $z^* < \zeta$ satisfying all equations. As before, let $v_i$ correspond to the remainder that was satisfied in each equation i, i. e., $v_i = x_i$ or $v_i = y_i$. A solution to our integer linear program now looks as follows: Set the first variable to $z^*$. Let the columns corresponding to $x_i$ and $y_i$ be set as follows for each i: If $v_i = x_i$ then set this variable occurrence in the solution vector to 1. Set the occurrence to the corresponding variable of $y_i$ to zero. Otherwise, set the variables the other way round. Finally, the variable corresponding to the columns of the $q_i$ are computed as $(z^* - v_i)/q_i$. It is easy to see that this solution is feasible and satisfies the bounds on the variable sizes.

$\Leftarrow$ Let the given instance of the 2-stage ILP problem be a yes-instance. By definition of the constraint matrix we have for every $1 \le i \le n$ that there exists a multiple $\lambda _i \ge 0$ such that $z = x_i + \lambda _i q_i$ or $z = y_i + \lambda _i q_i$. Hence $z \equiv x_i \mod q_i$ or $z \equiv y_i \mod q_i$ for every $1 \le i \le n$. Further, $z \le u$. Thus, the solution z is a solution of the Non-Unique Remainder problem.

Running time: Mapping the variables and computing the values for the $q_i$s can all be done in polynomial time regarding the largest occurring number and n. $\square$

4 Runtime bounds for 2-stage stochastic ILPs under ETH

This sections presents the proof that the double exponential running time in the current state-of-the-art algorithms is nearly tight assuming the Exponential Time Hypothesis (ETH). To do so, we make use of the reductions above showing that we can transform an instance of the 3-SAT problem to an instance of the 2-stage ILP problem.

Corollary 1

The 2-stage ILP problem cannot be solved in time less than $2^{\delta \sqrt{n}}$ for some $\delta > 0$ assuming ETH.

Proof

Suppose the opposite. That is, there is an algorithm solving the 2-stage ILP problem in time less than $2^{\delta \sqrt{n}}$. Let an instance of the 3-SAT problem with $n_\text {3}$ variables and $m_\text {3}$ clauses be given. Due to the Sparsification lemma, we may assume that $m_\text {3}\in O(n_\text {3})$ [18]. The Sparsification lemma states that any 3-SAT formula can be replaced by subexponentially many 3-SAT formulas, each with a linear number of clauses with respect to the number of variables. The original formula is satisfiable if at least one of the new formulas is. This yields that if we cannot decide a 3-SAT problem in subexponential time, we can also not do so for a 3-SAT problem where $m_\text {3}\in O(n_\text {3})$.

We can reduce such an instance to an instance of the Quadratic Congruences problem in polynomial time regarding $n_\text {3}$ such that $n_{\text {QC}} \in O(n_\text {3}^2)$, $max_{i}\{b_i\} \in O(n_\text {3}^2\log (n_\text {3}))$, $\alpha , \beta , \gamma = 2^{O(n_\text {3}^2 \log (n_\text {3}))}$, see Theorem 1.

Next, we reduce this instance to an instance of the Non-Unique Remainder problem. Using Theorem 2, this yields the parameter sizes $n_{\text {NR}} \in O(n_\text {3}^2)$, $\max _{i \in \{1, \dots , n_{\text {NR}}\}}\{q_i, x_i, y_i\}=O(n_\text {3}^2\log (n_\text {3}))$, and finally $\zeta \in$ $2^{O(n_\text {3}^2 \log (n_\text {3}))}$. Note that all prime numbers greater than 2 appear at most once in the prime factorization of $\beta$ and 2 appears 4 times. Thus, the largest $q_i$, which corresponds to $\max _i\{b_i^{\beta _i}\}$ equals the largest prime number in the Quadratic Congruences problem: The largest prime number is at least the $(\nu ^2+2\nu +2m'+13) \ge 13$th prime number by a rough estimation. The 13th prime number is 41 and thus, larger than $2^4 = 16$.

Finally, we reduce that instance to an instance of the 2-stage ILP problem with parameters $r,s,t, ||c||_{\infty }$, $||b||_{\infty }, ||\ell ||_{\infty } \in O(1)$, $||u||_{\infty } \in 2^{O(n_\text {3}^2 \log (n_\text {3}))}$, $n \in O(n_\text {3}^2)$, and $\varDelta \in O(n_\text {3}^2$ $\log (n_\text {3}))$, see Theorem 3.

Hence, if there is an algorithm solving the 2-stage ILP problem in time less than $2^{\delta \sqrt{n}}$ this would result in the 3-SAT problem to be solved in time less than $2^{\delta \sqrt{n}} = 2^{\delta \sqrt{C_1 n_\text {3}^2}} = 2^{\delta (C_2 n_\text {3}))}$ for some constants $C_1$, $C_2$. Setting $\delta _\text {3}\le \delta /C_2$, this would violate the ETH. $\square$

To prove our main result, we still have to reduce the size of the coefficients in the constraint matrix. To do so, we encode large coefficients into submatrices. This reduces the size of the entries greatly while just extending the matrix dimensions slightly. A similar approach was used for example in [10, 23] to prove a lower bound for the size of inclusion minimal kern-elements of 2-stage stochastic ILPs or in [25] to decrease the value of $\varDelta$ in the matrices.

Theorem 4

The 2-stage ILP problem cannot be solved in time less than $2^{2^{\delta (s+ t)}} |I|^{O(1)}$ for some constant $\delta > 0$, even if $r=1$, $\varDelta , ||b||_{\infty }, ||c||_{\infty }, ||b||_{\infty } \in O(1)$, assuming ETH. Here |I| denotes the encoding length of the total input.

Proof

First, we show that we can alter the resulting integer linear program such that we reduce the size of $\varDelta$ to O(1). We do so by encoding large coefficients with base 2, which comes at the cost of enlarged dimensions of the constraint matrix. Let $\text {enc}(x)$ be the encoding of a number x with base 2. Further, let $\text {enc}_i(x)$ be the ith number of $\text {enc}(x)$. Finally, $\text {enc}_0(x)$ denotes the last significant number of the encoding. Hence, the encoding of a number x is $\text {enc}(x) = \text {enc}_0(x) \text {enc}_1(x) \dots \text {enc}_{\lfloor \log (\varDelta )\rfloor }(x)$ and x can be reconstructed by $x = \sum \nolimits ^{\lfloor \log (\varDelta )\rfloor }_{i = 0} \text {enc}_i(x) \cdot 2^i$.

Let a matrix E be defined as,

$$\begin{aligned} E = \begin{pmatrix} 2 &{} \quad -1 &{}\quad 0 &{} \quad \dots &{}\quad 0 \\ 0 &{}\quad 2 &{} \quad -1 &{}\quad 0 \dots &{} \quad 0 \\ \vdots &{}\quad \ddots &{} \quad \ddots &{} \quad \ddots \\ 0 &{}\quad \dots &{}\quad 0 &{}\quad 2 &{}\quad -1 \end{pmatrix}. \end{aligned}$$

We re-write the constraint matrix as follows: For each coefficient $a > 1$, we insert its encoding $\text {enc}(a)$ and beneath we put the matrix E. Furthermore, we have to fix the dimensions for the first row in the constraint matrix, the columns without great coefficients and the right-hand side b by filling the matrix at the corresponding positions with zeros. The altered integer linear program ${\mathcal {A}}\cdot x = b$ is displayed in Fig. 1.

Note that the ones beneath the sub-matrices $\text {enc}(x_i)$ and $\text {enc}(y_i)$ correspond to $\text {enc}_0(x_i)$ and $\text {enc}_0(y_i)$. The independent blocks consisting of $\text {enc}(a)$ and the matrix E beneath correctly encodes the number $a>1$, i. e., it preserves the solution space: Let $x_a$ be the number in the solution corresponding to the column with entry a of the original instance. The solution for the altered column (i. e., the sub-matrix) is $(x_a \cdot 2^0, x_a \cdot 2^1, \dots , x_a \cdot 2^{\lfloor \log (\varDelta )\rfloor })$. The additional factor of 2 for each subsequent entry is due to the diagonal of E. It is easy to see that $a \cdot x_a = \sum \nolimits _{i = 0}^{\lfloor \log (\varDelta )\rfloor } \text {enc}_i(a) \cdot x_a \cdot 2^i$ as we can extract $x_a$ on the right-hand side and solely the encoding of a remains. Thus, the solutions of the original matrix and the altered one directly transfer to each other. Hence, the solution space is preserved.

Regarding the dimensions, each coefficient $a > 1$ is replaced by a $(O(\log (\varDelta )) \times O(\log (\varDelta )))$ matrix. Thus, the dimension expands to $t' = t \cdot O(\log (\varDelta )) = O(\log (\varDelta ))$, $s' = s \cdot O(\log (\varDelta )) = O(\log (\varDelta ))$, while r and n stay the same. Further, we have to adjust the bounds. The lower bound for all new variables is also zero. For the upper bounds we allow an additional factor of $2^i$ for the ith value of the encoding. Thus, $||u'||_{\infty } = 2^{{\lfloor \log (\varDelta )\rfloor }} ||u||_{\infty }$. Further, we get that the largest coefficient is bounded by $\varDelta ' = O(1)$. The right-hand side b enlarges to a vector $b'$ with $O(n\log (\varDelta ))$ entries.

Now suppose there is an algorithm solving the 2-stage ILP problem in time less than $2^{2^{\delta (s+t)}} |I|^{O(1)}$. The Proof of Corollary 1 shows that we can transform an instance of the 3-SAT problem with $n_\text {3}$ variables and $m_\text {3}$ clauses to an 2-stage stochastic ILP with parameters $r,s,t, ||c||_{\infty }, ||b||_{\infty }, ||\ell ||_{\infty } \in O(1)$, $||u||_{\infty } \in 2^{O(n_\text {3}^2 \log (n_\text {3}))}$, $n \in O(n_\text {3}^2)$, and $\varDelta \in O(n_\text {3}^2\log (n_\text {3}))$. Further, we explained above that we can transform this ILP to an equivalent one where

$$\begin{aligned} t'&= O(\log (\varDelta )) = O(\log (n_\text {3}^2 \log (n_\text {3}))) = O(\log (n_\text {3})), \\ s'&= O(\log (\varDelta )) = O(\log (n_\text {3}^2 \log (n_\text {3}))) = O(\log (n_\text {3})), \\ \varDelta '&= O(1),\\ b'&\in {\mathbb {Z}}^{O(n_\text {3}^2\log (n_\text {3}))},\\ ||u'||_{\infty }&= 2^{{\lfloor \log (\varDelta )\rfloor }} ||u||_{\infty } = 2^{{\lfloor \log (n_\text {3}^2\log (n_\text {3}))\rfloor }} 2^{O(n_\text {3}^2 \log (n_\text {3}))} = 2^{O(n_\text {3}^2 \log (n_\text {3}))}, \end{aligned}$$

while r, and n stay the same. The encoding length |I| is then given by

$$\begin{aligned} |I|&= (nt'(r+ns'))\log (\varDelta ')+(r+ns')\log (||\ell ||_{\infty })\\&\quad + (r+ns')\log (||u'||_{\infty }) +nt'\log (||b'||_{\infty }) +(r+ns')\log (||c||_{\infty }) \\&= 2^{O(n_\text {3}^2)}. \end{aligned}$$

Hence, if there is an algorithm solving the 2-stage ILP problem in time less than $2^{2^{\delta (s+t)}} |I|^{O(1)}$ this would result in the 3-SAT problem to be solved in time less than

$$\begin{aligned} 2^{2^{\delta (s+t)}} |I|^{O(1)}&= 2^{2^{\delta ( C_1\log (n_\text {3}) + C_2\log (n_\text {3})) }} 2^{n_\text {3}^{O(1)}} = 2^{2^{\delta C_3\log (n_\text {3}) }} 2^{n_\text {3}^{O(1)}} \\&= 2^{n_\text {3}^{\delta \cdot C_3}} 2^{n_\text {3}^{O(1)}} = 2^{n_\text {3}^{\delta \cdot C_4}} \end{aligned}$$

for some constants $C_1, C_2, C_3, C_4$. Setting $\delta = \delta '/C_4$ we get $2^{n_\text {3}^{\delta C_4}} = 2^{n_\text {3}^{\delta '}}$. As it holds for sufficient large x and $\epsilon < 1$ that $x^\epsilon < \epsilon x$ it follows that $2^{n_\text {3}^{\delta '}} < 2^{\delta 'n_\text {3}}$. This violates the ETH. Note that this result even holds if $r=1$, $\varDelta , ||c||_{\infty }, ||b||_{\infty },||\ell ||_{\infty } \in O(1)$ as constructed by our reductions. $\square$

Fig. 1

The displayed ILP is the altered ILP after encoding large entries with basis 2

5 Full proof of Theorem 1

This section presents the full Proof of Theorem 1. For an intuition and road map of the proof, we refer to Sect. 2.

First, let us prove a lemma about the size of the product of prime numbers, which comes in handy in the respective theorem.

Lemma 1

Denote by $q_i$ the ith prime number. The product of the first k prime numbers $\prod _{i=1}^k q_i$ is bounded by $2^{2k \log (k)}$ for all $k \ge 2$.

Proof

Denote by $\pi (x)$ the number of prime numbers of size at most x. It holds that $\pi (x) > x/\log (x)$ for $x \ge 17$ [30]. Note that the original statement uses the natural logarithm. But due to the division, the estimation also holds for the logarithm with base 2. Setting $x = y^2$, it holds that $\pi (y^2) > y^2/\log (y^2)$ for $y \ge 5$. As $y^2/\log (y^2) = y^2/(2\log (y)) \ge y^2/y = y$ for $y \ge 5$, it also holds that $\pi (y^2) > y$ for $y \ge 5$. Thus $p_i < i^2$ for $i \ge 5$, as we have at least i many prime numbers in the interval $[1, i^2]$.

Manually checking the values for the first four prime numbers shows that the equation $p_i \le i^2$ even holds for all prime numbers greater 2. For $p_1 = 2 > 1^2$, we can simply multiply an additional factor of 2. Altogether, we can thus estimate the product of the first k prime numbers for $k \ge 2$ as

$$\begin{aligned} \prod _{i=1}^k q_i&\le \prod _{i=1}^k (i^2) \cdot 2 = (\prod _{i=1}^k i)^2 \cdot 2 = (k!)^2 \cdot 2 \le (2 (k/2)^k)^2 \cdot 2 \\&= 2^2 ((k/2)^k)^2 \cdot 2 = 2^3 (k/2)^{2k} = 2^3 2^{2k \log (k/2)} \le 2^{2k \log (k)} \end{aligned}$$

proving the statement. We use the estimation $k! = 2(k/2)^k$ which can easily be proved using induction. Further, note that $k \ge 2$ has to hold for the last estimation. $\square$

Theorem 5

The Quadratic Congruences problem is NP-hard even if the prime factorization of $\beta$ is given and each prime factor greater than 2 occurs at most once and the prime factor 2 occurs 4 times.

Proof

We show a reduction from the well-known NP-hard problem 3-SAT where we are given a 3-SAT formula $\varPhi$ with $n_\text {3}$ variables and $m_\text {3}$ clauses.

Transformation: First, eliminate duplicate clauses from $\varPhi$ and those where some variable $x_i$ and its negation $\bar{x_i}$ appear together. Call the resulting formula $\varPhi '$, the number of occurring variables $n'$ and denote by $m'$ the number of appearing clauses respectively. Let $\varSigma = (\sigma _1, \dots , \sigma _{m'})$ be some enumeration of the clauses. Denote by $p_1, \dots , p_{2m'}$ the first $2m'$ prime numbers greater 2. Compute

$$\begin{aligned} \tau _{\varPhi '} = - \sum _{k=1}^{m'} \prod _{i = 1}^{k} p_i . \end{aligned}$$

Further, compute for each $i \in 1, 2, \dots , n'$:

$$\begin{aligned} f_j^+ = \sum _{x_i \in \sigma _k} \prod _{i = 1}^{k} p_i \,\,\, \text {and}\,\,\, f_j^- = \sum _{\bar{x_i} \in \sigma _k} \prod _{i = 1}^{k} p_i . \end{aligned}$$

Set $\nu = 2m'+n'$. Compute the coefficients $c_j$ for all $j = 0, 1, \dots , \nu$ as follows: Set $c_0 = 0$. For $j = 1, \dots , 2m'$ set

$$\begin{aligned} c_j = -\frac{1}{2} \prod _{i = 1}^{k} p_i \text { if } j = 2k-1 \,\, \text {and}\,\,\, c_j = - \prod _{i = 1}^{k} p_i \text { if } j = 2k, \text { for some } k \in {\mathbb {N}}. \end{aligned}$$

Compute the remaining coefficients for $j = 1, \dots , n'$ as $c_{2m'+j} = \tfrac{1}{2} \cdot (f_j^+ - f_j^-)$. Further, set $\tau = \tau _{\varPhi '} + \sum _{j=0}^{\nu } c_j + \sum _{j=1}^{n'} f_j^-$.

Denote by $q_1, \dots , q_{\nu ^2+2\nu +1}$ the first $\nu ^2+2\nu +1$ prime numbers. Let $p_{0,0}, p_{0,1}, \dots ,$ $p_{0,\nu }, p_{1,0}, \dots , p_{\nu ,\nu }$ be the first $(\nu +1)^2 = \nu ^2 + 2\nu + 1$ prime numbers greater than $(4(\nu +1) 2^3 \prod _{i=1}^{\nu ^2+2\nu +1} q_i)^{1/((\nu ^2 + 2\nu + 1)\log (\nu ^2+2\nu +1))}$ and greater than $p_{2m'}$. Define $p^*$ as the $(\nu ^2+2\nu +2m'+13)$th prime number.

Determine the parameters $\theta _j$ for $j = 0, 1, \dots , \nu$ as the least $\theta _j$ satisfying:

$$\begin{aligned} \theta _j&\equiv c_j \bmod 2^3 \cdot p^* \prod _{i=1}^{m'} p_i, \\ \theta _j&\equiv 0 \bmod \prod _{i = 0, i\ne j}^{\nu } \prod _{k=0}^{\nu }p_{i,k}, \\ \theta _j&\not \equiv 0 \bmod p_{j,1} . \end{aligned}$$

Set the following parameters:

$$\begin{aligned}&H = \sum _{j=0}^{\nu } \theta _j \,\,\,\text {and}\,\,\, K = \prod _{i = 0}^{\nu } \prod _{k=0}^{\nu }p_{i,k} . \end{aligned}$$

Finally, set

$$\begin{aligned} \alpha&= (2^4 \cdot p^* \prod _{i=1}^{m'} p_i + K)^{-1} \cdot (K\tau ^2 + 2^4 \cdot p^* \prod _{i=1}^{m'} p_i\cdot H^2),\\ \beta&= 2^4 \cdot p^* \prod _{i=1}^{m'} p_i \cdot K,\\ \gamma&= H, \end{aligned}$$

where $(2^4 \cdot p^* \prod _{i=1}^{m'} p_i + K)^{-1}$ is the inverse of $(2^4 \cdot p^* \prod _{i=1}^{m'} p_i + K) \bmod 2^4 \cdot p^* \prod _{i=1}^{m'} p_i \cdot K$.

Correctness: We show that the satisfiability of the formula $\varPhi$ is equivalent to a line of (systems of) equations, i. e., the formula has a satisfying truth assignment on the variables if and only if the (systems of) equations admit a solution. By this, we prove the hardness for various problems along the way. These are listed above with their respective equivalence sketched. In the following, we separate each of these steps by claims. We do not state the formula for each variable repeatedly and refer to the transformation section for an overview.

However, before we start with the transformations of the formula, we first observe two properties about the generated prime factors. These come in handy for the estimations later on we need to prove the equivalence of the systems.

Claim 1

Choosing $p^*$ as the $(\nu ^2+2\nu +2m'+13)$th prime factor satisfies $p^* > p_{\nu ,\nu }$.

Proof of Claim

Denote by $q_i$ the ith prime number: Suppose $p_{2m'} \ge (4(\nu +1) 2^3 \cdot \prod _{i=1}^{\nu ^2+2\nu +1} q_i)^{1/((\nu ^2 + 2\nu + 1)\log (\nu ^2+2\nu +1))}$. Then $p_{\nu ,\nu }$ is the $(\nu ^2+2\nu +1+2m'+1)$th prime number and thus, $p^* > p_{\nu ,\nu }$. Otherwise, if $p_{2m'} < (4(\nu +1) 2^3 \prod _{i=1}^{\nu ^2+2\nu +1} q_i)^{1/((\nu ^2 + 2\nu + 1)\log (\nu ^2+2\nu +1))}$, we bound the function values as follows:

$$\begin{aligned}&\displaystyle (4(\nu +1) 2^3 \prod _{i=1}^{\nu ^2+2\nu +1} q_i)^{1/((\nu ^2 + 2\nu + 1)\log (\nu ^2+2\nu +1))} \\&\displaystyle \quad = 4^{1/((\nu ^2 + 2\nu + 1)\log (\nu ^2+2\nu +1))} (\nu +1)^{1/((\nu ^2 + 2\nu + 1)\log (\nu ^2+2\nu +1))}\\&\displaystyle \quad \qquad \cdot (2^3)^{1/((\nu ^2 + 2\nu + 1)\log (\nu ^2+2\nu +1))}\\&\displaystyle \quad \qquad \cdot (\prod _{i=1}^{\nu ^2+2\nu +1} q_i)^{1/((\nu ^2 + 2\nu + 1)\log (\nu ^2+2\nu +1))}\\&\displaystyle \quad \le 2 \cdot 2 \cdot 2 \cdot (2^{2(\nu ^2 + 2\nu + 1)\log (\nu ^2+2\nu +1)})^{1/((\nu ^2 + 2\nu + 1)\log (\nu ^2+2\nu +1))} \\&\displaystyle \quad \le 8 \cdot (4^{(\nu ^2 + 2\nu + 1)\log (\nu ^2+2\nu +1)})^{1/((\nu ^2 + 2\nu + 1)\log (\nu ^2+2\nu +1))} \\&\displaystyle \quad = 8 \cdot 4 = 32 . \end{aligned}$$

The second transformation holds as the product of the first k prime numbers is bounded by $2^{2k\log (k)}$ (for $k \ge 2$, which obviously holds here), see Lemma 1. There are 11 prime numbers in the interval [1, 32]. Hence, $p_{\nu ,\nu }$ is at most the $(11+\nu ^2+2\nu +1)$th prime number and thus, $p^* > p_{\nu ,\nu }$. $\square$

Claim 2

It holds that $p^* \le \prod _{i=m'+1}^{\nu ^2+2\nu } q_i$.

Proof of Claim

We can bound the value of the product from beneath as $\prod _{i=m'+1}^{\nu ^2+2\nu } q_i \ge q_{m'+1}^{\nu ^2+\nu }$. Estimating the value for $p^*$, we use that the value of the next prime number after a number $\rho$ is at most $2\rho$ [2]. Thus, as there are $\nu ^2+2\nu +m'+10$ prime numbers between $p_{m'+1}$ and $p^*$, we get $p^* \le p_{m'+1} \cdot 2^{\nu ^2+2\nu +m'+10} \le q_{m'+1} \cdot 2^{\nu ^2+2\nu +m'+11} \le q_{m'+1} \cdot 2^{\nu ^2+3\nu +11}$ since per definition $p_i \le 2 \cdot q_i$ and $\nu \ge m'$ holds. Dividing both sides of the estimation by $q_{m'+1}$, it thus remains to show that $2^{\nu ^2+3\nu +11} \le q_{m'+1}^{\nu ^2+\nu -1}$. Obviously, $q_{m'+1}^{\nu ^2+\nu -1}$ grows for larger values of $m'$. The smallest reasonable value for $m' = 2$ and thus, $q_{m'+1} \ge 5$. By that, we get that

$$\begin{aligned} q_{m'+1}^{\nu ^2+\nu -1} \ge 5^{\nu ^2+\nu -1} \ge 2^{2(\nu ^2+\nu -1)} = 2^{2\nu ^2+2\nu -2} \ge 2^{\nu ^2+3\nu +11} \end{aligned}$$

for all $\nu \ge 5$ and thus, for all reasonable values of $\nu$, showing the statement. $\square$

Let us now focus on the transformations of the formula $\varPhi$ yielding the equivalence of the first two above-mentioned problems:

Claim 3

The 3-SAT problem asking whether there is a function $\eta :x_i \rightarrow \{0,1\}$ assigning a truth value to each variable that satisfies all clauses $\sigma _k$ of the 3-SAT formula $\varPhi$ simultaneously is a yes-instance if and only if Problem (P2) asking whether there are values $y_k \in \{0,1,2,3\}$ and a truth assignment $\eta$ such that $0 = R_k = y_k - \sum _{x_i \in \sigma _k} \eta (x_i) - \sum _{\bar{x_i} \in \sigma _k} (1 - \eta (x_i)) +1$ for all k is a yes-instance.

Proof of Claim

Obviously, the reduced formula $\varPhi '$ is satisfiable if and only if $\varPhi$ is. The formula $\varPhi '$ is satisfiable if there exists a truth assignment $\eta :\{x_1, \dots , x_{n'}\} \rightarrow \{0,1\}$ assigning a logical value to each variable $x_1, \dots , x_{n'}$ which satisfies all clauses $\sigma _1, \dots , \sigma _{m'}$ simultaneously. This can be re-written to the following equation for each clause $\sigma _k \in \varPhi _k$ interpreting the truth values as numbers:

$$\begin{aligned}&0 = R_k = y_k - \sum _{x_i \in \sigma _k} \eta (x_i) - \sum _{\bar{x_i} \in \sigma _k} (1 - \eta (x_i)) +1 {,\,\,\,} y_k \in \{0,1,2,3\}. \end{aligned}$$

For a clause $\sigma _k$, this equation is only satisfiable if at least one variable $x_i \in \sigma _k$ has value $\eta (x_i) = 1$ or one variable occurring in its negation $\bar{x_i} \in \sigma _k$ has value $\eta (x_i) = 0$. Otherwise, we have to set $y_k = -1$ which is not allowed. $\square$

Note that we never have to set $y_k = 3$ to satisfy the formula. However, we allow this value as it will come in handy later on when transforming the equation. Further, set $0 = R_0 = \alpha _0 + 1$ for $\alpha _0 \in \{-1, +1\}$ for later convenience. Clearly, the new equation is satisfiable.

Claim 4

The Problem (P2) asking whether there are values $y_k \in \{0,1,2,3\}$ and a truth assignment $\eta$ such that $0 = R_k = y_k - \sum _{x_i \in \sigma _k} \eta (x_i) - \sum _{\bar{x_i} \in \sigma _k} (1 - \eta (x_i)) +1$ for all k is a yes-instance if and only if Problem (P3) asking whether there are values $\alpha _j \in \{-1, +1\}$ such that $\sum _{j=0}^\nu \theta _j \alpha _j \equiv \tau \bmod 2^3 \cdot p^* \prod _{i=1}^{m'} p_i$ is a yes-instance.

Proof of Claim

We can bound the values of $R_k$ for $k \in \{0, 1, \dots , m'\}$ by $-2 \le R_k \le 4$. For the lower bound, the values are given by $y_k = 0$, all $x_i \in \sigma _k$ have value $\eta (x_i) = 1$ and all $\bar{x_i} \in \sigma _k$ have value $\eta (x_i) = 0$. For the upper bound we set $y_k = 3$, all $x_i \in \sigma _k$ to $\eta (x_i) = 0$ and $\bar{x_i} \in \sigma _k$ to $\eta (x_i) = 1$. For $R_0$ obviously $0 \le R_0 \le 2$ holds. Thus,

$$\begin{aligned} R_k = 0 {,\,} \forall k \in \{0, 1, \dots , m'\} \Leftrightarrow \sum _{k=0}^{m'} R_k \prod _{i=0}^k p_i = 0 \end{aligned}$$

as the sum is zero if all $R_k = 0$. For the opposite direction, if the sum is zero, then no $R_k \ne 0$ as the product of the prime numbers grows too fast. Thus, the other summands cannot compensate for some $R_k \ne 0$. We can bound the expression further by

$$\begin{aligned} \left| \sum _{k=0}^{m'} R_k \prod _{i=0}^k p_i\right| \le 4 \sum _{k=0}^{m'} \prod _{i=0}^k p_i \le 4 (m'+1) \prod _{i=0}^{m'} p_i < 2^3 \cdot p^* \prod _{i=1}^{m'} p_i \end{aligned}$$

as $p^* > p_{\nu ,\nu }$, see Claim 1, and as $p_{\nu ,\nu }> p_{m'} > m'+1$. This yields

$$\begin{aligned} R_k = 0 {,\,} \forall k \in \{0, 1, \dots , m'\} \Leftrightarrow \sum _{k=0}^{m'} R_k \prod _{i=0}^k p_i \equiv 0 \bmod 2^3 \cdot p^* \prod _{i=1}^{m'} p_i \end{aligned}$$

(I)

as the modulo has no impact on the satisfiability of the equation.

Next, we aim to re-write $R_k$ by replacing the variables $y_k$ and $\eta (x_i)$ with new variables admitting a domain of $\{-1, 1\}$:

$$\begin{aligned} y_k&= 1/2 \cdot [ (1-\alpha _{2k-1}) + 2 \cdot (1-\alpha _{2k}) ] {,\,\,\,} k \in \{1, \dots , m'\}, \\ \eta (x_i)&= 1/2 \cdot (1 - \alpha _{2m'+i}) {,\,\,\,} i \in \{1, \dots , n'\}. \end{aligned}$$

Obviously the value domains of $y_k$ and $\eta (x_i)$ are preserved. Substituting the variables and re-arranging the Eq. (I) yields

$$\begin{aligned} \sum _{j=0}^{\nu } c_j \alpha _j \equiv \tau \bmod 2^3 \cdot p^* \prod _{i=1}^{m'} p_i {, \,} \alpha _j \in \{-1, +1\}. \end{aligned}$$

Intuitively, the $\alpha _j$s corresponding to the truth assignment each appear $c_j$ times, a number which captures how often a variable occurs positive and, respectively, negative in the original formula. Additionally, we get some $\alpha _j$ variables due to the $y_k$ variables. Their additional occurrences introduced by the corresponding $c_j$ are cancelled out by $\tau$. By definition of $\theta _j$ this is equivalent to

$$\begin{aligned} \sum _{j=0}^\nu \theta _j \alpha _j \equiv \tau \bmod 2^3 \cdot p^* \prod _{i=1}^{m'} p_i {, \,} \alpha _j \in \{-1, +1\} \end{aligned}$$

proving the claim. $\square$

Let $H = \sum _{j=0}^{\nu } \theta _j$ and $K = \prod _{i = 0}^{\nu } \prod _{j=0}^{\nu }p_{i,j}$ be defined as before. Consider the following system asking whether there is an $x \in {\mathbb {Z}}$ such that:

$$\begin{aligned} 0 \le |x| \le H \end{aligned}$$

(P4.1)

$$\begin{aligned} (H + x) (H -x) \equiv 0 \bmod K \end{aligned}$$

(P4.2)

We use this system to integrate the condition $x \le H$ into the transformations. In the following, we prove that each solution of this system is of form $x = \sum _{j=0}^\nu \alpha _j \theta _j$ and thus, Problem (P4) can be combined with Problem (P3) yielding Problem (P5).

Claim 5

The Problem (P3) asking whether there are values $\alpha _j \in \{-1, +1\}$ such that $\sum _{j=0}^\nu \theta _j \alpha _j \equiv \tau \bmod 2^3 \cdot p^* \prod _{i=1}^{m'} p_i$ is a yes-instance if and only if the Problem (P5) is a yes-instance.

Proof of Claim

The unique solutions x to the given system (P4) are of form

$$\begin{aligned} x = \sum _{j=0}^\nu \alpha _j \theta _j {, \,} \alpha \in \{-1, +1\} {, \,} j = 0, 1, \dots , \nu . \end{aligned}$$

Let us first verify that an x of such form solves the system. First

$$\begin{aligned} |x| = \left| \sum _{j=0}^\nu \alpha _j \theta _j\right| \le \sum _{j=0}^\nu \theta _j = H \end{aligned}$$

satisfies (P4.1). Further, we have that each summand in the expanded formula $(H+x)(H-x)$ has to contain all prime factors $p_{i,j}$ for $i = 0, 1, \dots , \nu$ and $j = 0, 1, \dots , \nu$ in its prime factorization to satisfy (P4.2). For $(H+x) = (\sum _{j=0}^{n} \theta _j + \sum _{j=0}^n \theta _j \alpha _j)$ it holds that each $\theta _j$ where $\alpha _j = +1$ occurs twice while each $\theta _j$ where $\alpha _j = -1$ is canceled out by H. The other way round holds for $(H-x)$. Thus, expanding the brackets yields that each summand is a product of some $\theta _j$ and $\theta _k$ where $\alpha _j = +1$ and $\alpha _k = -1$. This implies that $j \ne k$. As each $\theta _j$ contains all prime factors of K except $p_{j,0}, \dots , p_{j, \nu }$, the product of two different $\theta _j$ and $\theta _k$ contains each prime factor occurring in K satisfying (P4.2).

Regarding the uniqueness, we first prove that each solution $x'$ to the given system satisfies $x' \equiv x \bmod K$. Then we show that the distance of two solutions is at most 2H. Finally, proving that $2H < K$ yields the desired statement.

Observe that

$$\begin{aligned} (H + x) (H -x) \equiv 0 \bmod \prod _{j=0}^\nu p_{i,j} {, \,} \forall i = 0, 1, \dots , \nu . \end{aligned}$$

Assume there exists some number ${\tilde{p}} = \prod _{j=0}^\nu p_{i,j}$ for some $i \in \{0, 1, \dots , \nu \}$ which divides $(H+x)$ and $(H-x)$ (without remainder). Thus, $(H+x)+(H-x) \equiv 0 \bmod {\tilde{p}} \Leftrightarrow 2H \equiv 0 \bmod {\tilde{p}}$. As ${\tilde{p}}$ is a product of prime numbers greater than 2, it follows that $H \equiv 0 \bmod {\tilde{p}} \Leftrightarrow \sum _{j=0}^{\nu } \theta _j \equiv 0 \bmod {\tilde{p}}$. However, from the definition of $\theta _j$ (third condition) it follows that for each j there exist different prime numbers not present in the prime factorization of $\theta _j$ contradicting the assumption. Thus, ${\tilde{p}}$ divides either $(H+x)$ or $(H-x)$ (without remainder). Define

$$\begin{aligned}&\alpha _j = {\left\{ \begin{array}{ll} +1 &{} \text { if } (H-x) \equiv 0 \bmod \prod _{i=0}^\nu p_{j,i}\\ -1 &{} \text { if } (H+x) \equiv 0 \bmod \prod _{i=0}^\nu p_{j,i} \end{array}\right. } \\&x' = \sum _{j=0}^\nu \alpha _j \theta _j . \end{aligned}$$

In the following, we show that $x' \equiv x \bmod \prod _{k=0}^\nu p_{j,k}$ holds for all $j \in \{0, 1, \dots , \nu \}$:

$$\begin{aligned} x'&\equiv x \bmod \prod _{k=0}^\nu p_{j,k} \\&\Leftrightarrow \sum _{j=0}^\nu \alpha _j \theta _j \equiv x \bmod \prod _{k=0}^\nu p_{j,k} \\&\Leftrightarrow \alpha _j \theta _j \equiv x \bmod \prod _{k=0}^\nu p_{j,k} \\&\Leftrightarrow \sum _{i=0}^\nu \alpha _j \theta _i \equiv x \bmod \prod _{k=0}^\nu p_{j,k}\\&\Leftrightarrow \alpha _j \sum _{i=0}^\nu \theta _i \equiv x \bmod \prod _{k=0}^\nu p_{j,k}\\&\Leftrightarrow \alpha _j H \equiv x \bmod \prod _{k=0}^\nu p_{j,k}. \end{aligned}$$

The first transformation simply inserts the definition of $x'$. Due to the definition of the $\theta _i$, only the summand $\theta _j$ remains after calculating the modulo. Thus, we can sum up all $\theta _i$ with arbitrary sign as they equal zero after calculating the modulo. In the last step, we insert the definition of H. Now we either have $\alpha _j = +1$. Then $H \equiv x \bmod \prod _{k=0}^\nu p_{j,k}$, i. e., $H - x\equiv 0 \bmod \prod _{k=0}^\nu p_{j,k}$, which is true by definition of $\alpha _j = +1$. Otherwise, $\alpha _j = -1$. Then $-H \equiv x \bmod \prod _{k=0}^\nu p_{j,k}$, i. e., $H + x \equiv 0 \bmod \prod _{k=0}^\nu p_{j,k}$, which is again true by the definition of $\alpha _j$. Thus, the initial statement is correct. As it holds for all j, we can conclude that $x' \equiv x \bmod K$.

As $\alpha _j \in \{-1,+1\}$ for all $j \in \{0, 1, \dots , \nu \}$, it holds that $-H \le x \le H$. Since the same holds for $x'$ it follows that $|x-x'| \le 2H$.

We can bound the value of $\theta _j$ as $\theta _j < 2^4 \cdot p^* \prod _{i=1}^{m'} p_i \cdot \prod _{i = 0, i\ne j}^{\nu } \prod _{k=0}^{\nu }p_{i,k}$, as $2^3 \cdot p^* \prod _{i=1}^{m'} p_i$ and $\prod _{i = 0, i\ne j}^{\nu } \prod _{k=0}^{\nu }p_{i,k}$ are coprime and thus, the least $\theta _j$ satisfying the equivalence conditions in the definition of $\theta _j$ is at most their product [31]. The additional factor of 2 is introduced by the inequality constraint $\theta _j \not \equiv 0 \bmod p_{j,1}$, as if the calculated $\theta _j$ for the equality constraints does not satisfy that condition, we can extend it to $\theta _j' = \theta _j + 2^3 \cdot p^* \prod _{i=1}^{m'} p_i \cdot \prod _{i = 0, i\ne j}^{\nu } \prod _{k=0}^{\nu }p_{i,k}$. This doubles the size estimation and as $p_{j,1}$ is coprime to $2^3 \cdot p^* \prod _{i=1}^{m'} p_i \cdot \prod _{i = 0, i\ne j}^{\nu } \prod _{k=0}^{\nu }p_{i,k}$, it holds that $\theta _j'$ is not equivalent to $0 \bmod p_{j,1}$.

As $p^* \le \prod _{i=m'+1}^{\nu ^2+2\nu } q_i$, see Claim 2, we get

$$\begin{aligned} 2^4 \cdot p^* \prod _{i=1}^{m'} p_i \le 2^4 \prod _{i=m'+1}^{\nu ^2+2\nu } q_i \prod _{i=1}^{m'} p_i = 2^4 \prod _{i=1}^{\nu ^2+2\nu +1} q_i . \end{aligned}$$

Using this and our choice for the prime factors to satisfy $p_{0,0} > (4(\nu +1) 2^3 \prod _{i=1}^{\nu ^2+2\nu +1} q_i)^{1/((\nu ^2 + 2\nu + 1)\log (\nu ^2+2\nu +1))}$, we estimate:

$$\begin{aligned}&2^4 \cdot p^* \prod _{i=1}^{m'} p_i \cdot \prod _{i = 0, i\ne j}^{\nu } \prod _{k=0}^{\nu }p_{i,k} \\&\quad = \frac{2^4 \cdot p^* \prod _{i=1}^{m'} p_i \cdot K}{\prod _{k=0}^\nu p_{j,k}} \\&\quad \le \frac{2^4 \prod _{i=1}^{\nu ^2+2\nu +1} q_i \cdot K}{\prod _{k=0}^\nu (4(\nu +1) 2^3 \prod _{i=1}^{\nu ^2+2\nu +1} q_i)^{1/((\nu ^2 + 2\nu + 1)\log (\nu ^2+2\nu +1))}} \\&\quad \le \frac{K}{2(\nu +1)}. \end{aligned}$$

This term bounds each value of $\theta _j$. It follows that $2H = 2 \sum _{j=0}^\nu \theta _j < 2 \cdot (\nu +1) \cdot K/(2(\nu +1)) = K$. Thus, $x = x'$, as each solution $x'$ to the given system satisfies $x' \equiv x \bmod K$ and the distance of two solutions is at most $2H < K$. Hence, we conclude that solutions of the form $x=\sum _{j=0}^\nu \theta _j \alpha _j$ are the unique solutions to the system (P4.1) and (P4.2).

Thus, we can re-write

$$\begin{aligned} \sum _{j=0}^\nu \theta _j \alpha _j \equiv \tau \bmod 2^3 \cdot p^* \prod _{i=1}^{m'} p_i {, \,} \alpha _j \in \{-1, +1\} \end{aligned}$$

using the system (P4.1) and (P4.2) to the following one:

$$\begin{aligned} 0 \le |x| \le H {, \,} x \in {\mathbb {Z}} \end{aligned}$$

(P5.1)

$$\begin{aligned} x \equiv \tau \bmod 2^3 \cdot p^* \prod _{i=1}^{m'} p_i \end{aligned}$$

(P5.2)

$$\begin{aligned} (H+x)(H-x) \equiv 0 \bmod K \end{aligned}$$

(P5.3)

proving their equivalence. $\square$

Next, we re-write the system (P5) to:

$$\begin{aligned} 0 \le |x| \le H {, \,} x \in {\mathbb {Z}} \end{aligned}$$

(P6.1)

$$\begin{aligned} (\tau -x)(\tau +x) \equiv 0 \bmod 2^4 \cdot p^* \prod _{i=1}^{m'} p_i \end{aligned}$$

(P6.2)

$$\begin{aligned} (H+x)(H-x) \equiv 0 \bmod K . \end{aligned}$$

(P6.3)

Claim 6

The Problem (P5) is a yes-instance if and only if the Problem (P6) is a yes-instance.

Proof of Claim

As only the second conditions differ, we focus on their equivalence in the following. First, we prove that if (P5.2) holds, i. e., $x \equiv \tau \bmod 2^3 \cdot p^* \prod _{i=1}^{m'} p_i$, then (P6.2) holds, i. e., $(\tau -x)(\tau +x) \equiv 0 \bmod 2^4 \cdot p^* \prod _{i=1}^{m'} p_i$. We can re-write (P5.2) to $x = \lambda 2^3 \cdot p^* \prod _{i=1}^{m'} p_i + \tau$ for some $\lambda \in {\mathbb {Z}}$. Inserting this in (P6.2) yields:

$$\begin{aligned}&(\tau + \lambda 2^3 \cdot p^* \prod _{i=1}^{m'} p_i + \tau )(\tau - \lambda 2^3 \cdot p^* \prod _{i=1}^{m'} p_i - \tau ) \\&\quad = (2\tau + \lambda 2^3 \cdot p^* \prod _{i=1}^{m'} p_i) (\lambda 2^3 \cdot p^* \prod _{i=1}^{m'} p_i) \equiv 0 \bmod 2^3 \cdot p^* \prod _{i=1}^{m'} p_i \end{aligned}$$

as each factor is multiplied with $\lambda 2^3 \cdot p^* \prod _{i=1}^{m'} p_i$.

Next, we prove the opposite direction. First, observe that if $(\tau -x)(\tau +x) \equiv 0 \bmod 2^4 \cdot p^* \prod _{i=1}^{m'} p_i$ then either $(\tau -x) \equiv 0 \bmod 2^3$ or $(\tau +x) \equiv 0 \mod 2^3$: As (P6.2) holds, $(\tau +x) = \lambda _i \cdot 2^i$ and $(\tau -x) = \lambda _j \cdot 2^j$ for some $i,j \in {\mathbb {Z}}$ and $\lambda _i, \lambda _j \not \equiv 0 \bmod 2$. It follows that

$$\begin{aligned} (\tau +x)+(\tau -x)&= \lambda _i \cdot 2^i + \lambda _j \cdot 2^j \\ \Leftrightarrow 2 \tau&= \lambda _i \cdot 2^i + \lambda _j \cdot 2^j \\ \Leftrightarrow \tau&= \lambda _i \cdot 2^{i-1} + \lambda _j \cdot 2^{j-1}. \end{aligned}$$

As $\tau$ is odd per definition, either i or j has to be 1 and thus, the other parameter has to be 3. Using this, we know that if x satisfies (P6.2), then $(\tau -x) \equiv 0 \bmod 2^3 \cdot p^* \prod _{i=1}^{m'} p_i$ or $(\tau +x) \equiv 0 \mod 2^3 \cdot p^* \prod _{i=1}^{m'} p_i$. In the first case, x directly corresponds to a solution of (P5.2) as $x-\tau$ is a multiple of $2^3 \cdot p^* \prod _{i=1}^{m'} p_i$ and thus, x is a multiple of $2^3 \cdot p^* \prod _{i=1}^{m'} p_i$ with a residue of $\tau$. Otherwise $-x$ satisfies the condition using the same argument. Obviously the other conditions are also satisfied in both systems. $\square$

Lastly, we re-write the system one final time to:

$$\begin{aligned}&0 \le x \le H{, \,} x \in {\mathbb {Z}}\\&2^4 \cdot p^* \cdot \prod _{i=1}^{m'} p_i (H^2 - x^2) + K (\tau ^2 - x^2) \end{aligned}$$

(QC.1)

$$\begin{aligned} \equiv 0 \bmod 2^4 \cdot p^* \cdot \prod _{i=1}^{m'} p_i \cdot K . \end{aligned}$$

(QC.2)

Claim 7

The Problem (P6) is a yes-instance if and only if the Quadratic Congruences problem is a yes-instance.

Proof of Claim

First, as we only consider $x^2$, we can suppose $x \ge 0$ and thus, re-writting (P6.1) to (QC.1) is correct. Further, (P6.2) and (P6.3) merge into (QC.2). Recall that $2^4 \cdot p^* \cdot \prod _{i=1}^{m'} p_i$ and K are co-prime. The first summand obviously always contains the factor $2^4 \cdot p^* \cdot \prod _{i=1}^{m'} p_i$, thus we have to find an x such that $(H^2 - x^2) \equiv 0 \bmod K$ which corresponds to (P6.3). The second summand clearly is a multiple of K, thus we have to assure that $(\tau ^2 - x^2) \equiv 0 \bmod 2^4 \cdot p^* \cdot \prod _{i=1}^{m'} p_i$. This matches (P6.2).

Dissolving the brackets and rearranging the term (QC.2) we get

$$\begin{aligned}&(2^4 \cdot p^* \cdot \prod _{i=1}^{m'} p_i + K)x^2\\&\quad \equiv K\tau ^2 + 2^4 \cdot p^* \cdot \prod _{i=1}^{m'} p_i H^2 \bmod 2^4 \cdot p^* \cdot \prod _{i=1}^{m'} p_i \cdot K . \end{aligned}$$

As $2^4 \cdot p^* \cdot \prod _{i=1}^{m'} p_i + K$ is relatively prime to $2^4 \cdot p^* \cdot \prod _{i=1}^{m'} p_i \cdot K$ it has an inverse modulo $2^4 \cdot p^* \cdot \prod _{i=1}^{m'} p_i \cdot K$ [27]. Thus, multiplying by the inverse we get the values for $\alpha , \beta$ and $\gamma$ as in the transformation above. $\square$

Overall, this proves that satisfying the formula $\varPhi$ is equivalent to an instance of the Quadratic Congruences problem admitting a feasible solution.

Running time: All steps, numbers and their computation can be bounded in a polynomial dependent of $n_\text {3}$, i. e., the number of variables in the 3-Sat formula, and $m_\text {3}$, i. e., the number of clauses in the formula. First, we eliminate unnecessary clauses from the formula. Hence, we have to go through all clauses once. The first $2m'+1$ prime numbers have a value of at most $O(m' \log (m'))$ and can thus be found in polynomial time via sieving. The function $(4(\nu +1) 2^3 \prod _{i=1}^{\nu ^2+2\nu +1} q_i)^{1/((\nu ^2+2\nu +1)\log (\nu ^2 + 2\nu + 1))}$ is at most 32 as shown before. Hence, we can also bound the value of the next $\nu ^2 + 2\nu + 1$ prime numbers larger than 32 and $p_{2m'}$ by a polynomial in $n_\text {3}$ and $m_\text {3}$ and we can compute them efficiently by sieving. All other numbers calculated in the transformation are a product or sum over these prime numbers (each occurring at most once in the calculation) and thus, their values are also in poly$(n_\text {3}, m_\text {3})$. We can compute the inverse $(2^4 \cdot p^* \prod _{i=1}^{m'} p_i + K)^{-1}$ in polynomial time [27]. $\square$

Now we have proved that the Quadratic Congruences problem is NP-hard even in the restricted case where all prime factors in $\beta$ only appear at most once (except 2). To apply the ETH, however, we also have to estimate the dimensions of the generated instance. The above reduction yields the following parameters:

Theorem 1An instance of the 3-SAT problem with $n_\text {3}$ variables and $m_\text {3}$ clauses is reducible to an instance of the Quadratic Congruences problem in polynomial time with the properties that $\alpha , \beta , \gamma \in 2^{O((n_\text {3}+m_\text {3})^2 \log (n_\text {3}+ m_\text {3}))}$, $n_{\text {QC}} \in O((n_\text {3}+m_\text {3})^2)$, $max_{i}\{b_i\} \in O((n_\text {3}+m_\text {3})^2\log (n_\text {3}+m_\text {3}))$, and each prime factor in $\beta$ occurs at most once except the prime factor 2 which occurs four times.

Proof

In Theorem 5, we already showed and proved a reduction from the 3-SAT problem to the Quadratic Congruences problem and argued the running time. It remains to bound the parameters. To do so, we bound the numbers occurring in the reduction above in order of their appearance. Again, for an overview of the generated numbers and variables, and their respective formulas, we refer to the transformation section of Theorem 5.

After eliminating the trivial clauses it obviously holds that $m' \le m_\text {3}$ and $n' \le n_\text {3}$. Next, we calculate $\tau _{\varPhi '}$. Its absolute value can be bounded as

$$\begin{aligned} |\tau _{\varPhi '}|&= |- \sum _{k=1}^{m'} \prod _{i = 1}^{k} p_i| = \sum _{k=1}^{m'} \prod _{i = 1}^{k} p_i \\&\le m_\text {3}\prod _{i = 1}^{m_\text {3}} p_i \le m_\text {3}2^{2m_\text {3}\log (m_\text {3})} \le 2^{O(m_\text {3}\log (m_\text {3}))} \end{aligned}$$

since the product of the first k prime numbers is bounded by $2^{2k\log (k)}$ for all $k \ge 2$, see Lemma 1. Similarly, $\max _i\{|f^+_i|, |f^-_i|\} \le \sum _{x_i \in \sigma _j} \prod _{k = 1}^{j} p_k + \sum _{\bar{x_i} \in \sigma _j} \prod _{k = 1}^{j} p_k \le 2m_\text {3}\cdot 2^{2m_\text {3}\log (m_\text {3})} \le 2^{O(m_\text {3}\log (m_\text {3}))}$ and also $\max _j\{c_j\} =$ $\max _j\{\prod _{i=1}^j p_i, f^+_j + f^-_j\} \le 2^{O(m_\text {3}\log (m_\text {3}))}$. Per definition, $\nu = 2m' + n' = O(n_\text {3}+ m_\text {3})$. The largest prime number $max_{i}\{b_i\}$ we generate in the reduction is $p^*$, which is the $(\nu ^2+2\nu +2m'+13)$th prime number. Thus, its value is bounded by $p^* \le O(\nu ^2 \log (\nu )) = O((n_\text {3}+m_\text {3})^2\log (n_\text {3}+m_\text {3}))$ [14]. Due to the modulo, we can bound $\max _j\{\theta _j\}$ as

$$\begin{aligned} \max _j\{\theta _j\}&\le 2^4 \cdot p^* \prod _{i=1}^{m'} p_i \cdot \prod _{i = 0, i\ne j}^{\nu } \prod _{k=0}^{\nu } p_{i,k} \\&\le 2^4 2^{O((n_\text {3}+m_\text {3})^2 \log (n_\text {3}+ m_\text {3}))} = 2^{O((n_\text {3}+m_\text {3})^2 \log (n_\text {3}+ m_\text {3}))}. \end{aligned}$$

Thus, $H = \sum _{j=0}^\nu \theta _j \le \nu \cdot 2^{O((n_\text {3}+m_\text {3})^2 \log (n_\text {3}+ m_\text {3}))} = 2^{O((n_\text {3}+m_\text {3})^2 \log (n_\text {3}+ m_\text {3}))}$ and $K = \prod _{i = 0}^{\nu } \prod _{k=0}^{\nu }p_{i,k} \le 2^{O((n_\text {3}+m_\text {3})^2 \log (n_\text {3}+ m_\text {3}))}$. Finally, we can bound the main parameters. As $\alpha$ is bounded by the modulo of $\beta$ is follows that $\alpha \le \beta$. Further, $\beta = 2^4 \cdot p^* \prod _{i=1}^{m'} p_i \cdot K \le 2^{O((n_\text {3}+m_\text {3})^2 \log (n_\text {3}+ m_\text {3}))}$. Per definition $\gamma = H$ and thus, $\gamma \le 2^{O((n_\text {3}+m_\text {3})^2 \log (n_\text {3}+ m_\text {3}))}$, which finalizes the estimation of the numbers. $\square$