Editing Simple continued fraction (section)

=== Legendre's theorem on continued fractions ===
{{see also|Dirichlet's approximation theorem}}
In his ''Essai sur la théorie des nombres'' (1798), [[Adrien-Marie Legendre]] derives a necessary and sufficient condition for a rational number to be a convergent of the continued fraction of a given real number.<ref>{{cite book|last=Legendre|first=Adrien-Marie|author-link=Adrien-Marie Legendre|title=Essai sur la théorie des nombres|date=1798|publisher=Duprat|location=Paris|publication-date=1798|pages=27–29|language=fr}}</ref> A consequence of this criterion, often called '''Legendre's theorem''' within the study of continued fractions, is as follows:<ref>{{cite journal|last1=Barbolosi|first1=Dominique|last2=Jager|first2=Hendrik|date=1994|title=On a theorem of Legendre in the theory of continued fractions|url=https://www.jstor.org/stable/26273940|journal=[[Journal de Théorie des Nombres de Bordeaux]]|volume=6|issue=1|pages=81–94|doi=10.5802/jtnb.106 |jstor=26273940 }}</ref>

'''Theorem'''. If ''α'' is a real number and ''p'', ''q'' are positive integers such that <math>\left|\alpha - \frac{p}{q}\right| < \frac{1}{2q^2}</math>, then ''p''/''q'' is a convergent of the continued fraction of ''α''.
{{collapse top|title = Proof}}
'''Proof'''. We follow the proof given in ''[[An Introduction to the Theory of Numbers]]'' by [[G. H. Hardy]] and [[E. M. Wright]].<ref>{{cite book|last1=Hardy|first1=G. H.|author-link=G. H. Hardy|last2=Wright|first2=E. M.|author-link2=E. M. Wright|title=An Introduction to the Theory of Numbers|title-link=An Introduction to the Theory of Numbers|publisher=[[Oxford University Press]]|year=1938|isbn=|location=London|publication-date=1938|pages=140–141, 153|language=en}}</ref>

Suppose ''α'', ''p'', ''q'' are such that <math>\left|\alpha - \frac{p}{q}\right| < \frac{1}{2q^2}</math>, and assume that ''α'' > ''p''/''q''. Then we may write <math>\alpha - \frac{p}{q} = \frac{\theta}{q^2}</math>, where 0 < ''θ'' < 1/2. We write ''p''/''q'' as a finite continued fraction [''a''<sub>0</sub>; ''a''<sub>1</sub>, ..., ''a<sub>n</sub>''], where due to the fact that each rational number has two distinct representations as finite continued fractions differing in length by one (namely, one where ''a<sub>n</sub>'' = 1 and one where ''a<sub>n</sub>'' ≠ 1), we may choose ''n'' to be even. (In the case where ''α'' < ''p''/''q'', we would choose ''n'' to be odd.)

Let ''p''<sub>0</sub>/''q''<sub>0</sub>, ..., ''p<sub>n</sub>''/''q<sub>n</sub>'' = ''p''/''q'' be the convergents of this continued fraction expansion. Set <math>\omega := \frac{1}{\theta} - \frac{q_{n-1}}{q_n}</math>, so that <math>\theta = \frac{q_n}{q_{n-1} + \omega q_n}</math> and thus,<math display="block">\alpha = \frac{p}{q} + \frac{\theta}{q^2} = \frac{p_n}{q_n} + \frac{1}{q_n (q_{n-1} + \omega q_n)} = \frac{(p_n q_{n-1} + 1) + \omega p_n q_n}{q_n (q_{n-1} + \omega q_n)} = \frac{p_{n-1} q_n + \omega p_n q_n}{q_n (q_{n-1} + \omega q_n)} = \frac{p_{n-1} + \omega p_n}{q_{n-1} + \omega q_n}, </math>where we have used the fact that ''p<sub>n</sub>''<sub>−1</sub> ''q<sub>n</sub>'' - ''p<sub>n</sub>'' ''q<sub>n</sub>''<sub>−1</sub> = (-1)''<sup>n</sup>'' and that ''n'' is even.

Now, this equation implies that ''α'' = [''a''<sub>0</sub>; ''a''<sub>1</sub>, ..., ''a<sub>n</sub>'', ''ω'']. Since the fact that 0 < ''θ'' < 1/2 implies that ''ω'' > 1, we conclude that the continued fraction expansion of ''α'' must be [''a''<sub>0</sub>; ''a''<sub>1</sub>, ..., ''a<sub>n</sub>'', ''b''<sub>0</sub>, ''b''<sub>1</sub>, ...], where [''b''<sub>0</sub>; ''b''<sub>1</sub>, ...] is the continued fraction expansion of ''ω'', and therefore that ''p<sub>n</sub>''/''q<sub>n</sub>'' = ''p''/''q'' is a convergent of the continued fraction of ''α''.
{{collapse bottom}}

This theorem forms the basis for [[Wiener's attack]], a polynomial-time exploit of the [[RSA (cryptosystem)|RSA cryptographic protocol]] that can occur for an injudicious choice of public and private keys (specifically, this attack succeeds if the prime factors of the public key ''n'' = ''pq'' satisfy ''p'' < ''q'' < 2''p'' and the private key ''d'' is less than (1/3)''n''<sup>1/4</sup>).<ref>{{cite journal|last=Wiener|first=Michael J.|date=1990|title=Cryptanalysis of short RSA secret exponents|url=https://ieeexplore.ieee.org/document/54902|journal=[[IEEE Transactions on Information Theory]]|volume=36|issue=3|pages=553–558|doi=10.1109/18.54902 |via=IEEE}}</ref>