Take the 2-minute tour ×

I've seen it said that you can prove Bezout's Identity using Euclid's algorithm backwards, but I've searched google and cannot find such a proof anywhere. I found another proof which looks simple but which I don't understand.

Bezout's lemma is:

For every pair of integers a & b there are 2 integers s & t such that as + bt = gcd(a,b)

Euclid's algorithm is:

1. Start with (a,b) such that a >= b
2. Take reminder r of a/b
3. Set a := b, b := r so that a >= b
4. Repeat until b = 0

So here's the proof by induction that I found on the internet:

Base case:

b = 0 
gcd (a,b) = a
s = 1 
t = 0

Inductive Step:

Assume Bezout's Lemma is true for all pairs of b < k.

a = qb + r with 0 =< r < b = k


By the inductive hypothesis there are integers x and y with bx and ry = gcd(a,b)

bx + ry = bx + (a - qb)y = b(x - qy) + ay = gcd(a,b)

Set t = (x - qy) and s = y. This establishes the identity for a pair (a,b) with b = k and completes the induction. 

I only followed the proof up to the base case. I don't see how it proved b = k from b < k. Could you please explain this to me?


EDIT: After two days of trying to figure it out I still don't understand the proof. I conclude that either I lack the requisite knowledge or the intelligence or both. Thanks for trying to help.

share|improve this question
Could it be skipping a step when it says "by the inductive hypothesis"? –  user62287 Feb 21 '13 at 22:36
Just in case you don't understand how the process works, here is an example with specific values. –  Calvin Lin Feb 21 '13 at 23:49
I thought that using Euclid's Algorithm backwards gave you "Paul is dead." en.wikipedia.org/wiki/Paul_is_dead –  Gerry Myerson Feb 23 '13 at 6:08

2 Answers 2

Here is a simple conceptual proof of Bezout's identity for the gcd.

The set $\rm\:S\:$ of all integers of the form $\rm\:a\:x + b\:y,\,\ x,y\in \mathbb Z,\:$ is closed under subtraction so, by the Lemma below, every positive $\rm\:n\in S\:$ is divisible by $\rm\:d = $ least positive $\rm\in S,\:$ so $\rm\:a,b\in S\:$ $\Rightarrow$ $\rm\:d\:|\:a,b.\:$ So $\rm\:d\:$ is a common divisor of $\rm\:a,b,\:$ necessarily greatest, $ $ by $\rm\:c\:|\:a,b\:$ $\Rightarrow$ $\rm\:c\:|\:d = a\:x\!+\! b\:y\:$ $\Rightarrow$ $\rm\:c\le d.$

Lemma $\ \ $ If a nonempty set of positive integers $\rm\: S\:$ satisfies both $\rm\ n > m\: \in\, S \ \Rightarrow\ n-m\, \in\, S$
then every element of $\rm\:S\:$ is a multiple of the least element $\rm\:m_{\:1} \in\, S.$

Proof 1 $\ $ If not there is a least nonmultiple $\rm\:n\in S,\,$ contra $\rm\:n-m_{\:1} \in S\:$ is a nonmultiple of $\rm\:m_{\:1}.$

Proof 2 $\rm\ \ S\,$ closed under subtraction $\rm\:\Rightarrow\:S\,$ closed under remainder (mod), when it is $\ne 0,$ since mod may be computed by repeated subtraction, i.e. $\rm\: a\ mod\ b\, =\, a - k b\, =\, a-b-b-\cdots -b.\:$ Hence $\rm\:n\in S\:$ $\Rightarrow$ $\rm\: n\ mod\ m_1 = 0,\:$ else it is $\rm\,\in S\,$ and smaller than $\rm\:m_1,\:$ contra mimimality of $\rm\:m_1.$

Remark $\ $ In a nutshell, two applications of induction yield the following inferences

$$\rm\begin{eqnarray} S\ closed\ under\ subtraction &\:\Rightarrow\:&\rm S\ closed\ under\ mod = remainder = repeated\ subtraction \\ &\:\Rightarrow\:&\rm S\ closed\ under\ gcd = repeated\ remainder\ (Euclid's\ algorithm) \end{eqnarray}$$

Interpreted constructively, this yields the extended Euclidean algorithm for the gcd. Namely, $ $ starting from the two elements of $\rm\,S\,$ that we know: $\rm\ a \,=\, 1\cdot a + 0\cdot b,\ \ b \,=\, 0\cdot a + 1\cdot b,\ $ we search for the least element of $\rm\,S\,$ by repeatedly subtracting elements to produce smaller elements of $\rm\,S\,$ (while keeping track of every elements linear representation in terms of $\rm\,a\,$ and $\rm\,b).\:$ This is essentially the subtractive form of the Euclidean algorithm (vs. the mod/remainder form).

share|improve this answer
I don't understand the proof. What does "contra n−m1∈S is a nonmultiple of m1" mean? –  user62287 Feb 21 '13 at 22:55
@user62287 The idea is: if $\rm\,n\in S\,$ isn't a multiple of $\rm\:m_1,\:$ then by repeatedly subtracting $\rm\:m_1\:$ from $\rm\:n\:$ we'd reach $\rm\,r\in S\,$ smaller than $\rm\:m_1,\:$ contra minimality of $\rm\:m_1.\:$ Of course $\rm\,r\,$ is the remainder $\rm\:r = (n\ mod\ m_1),\:$ so $\rm\:r = n - k m_1.\:$ The proof is a slick way of doing this without explicitly using division: if a nonmultiple exists then let $\rm\,n\,$ be the least such. But subtracting $\rm\:m_1\:$ from $\rm\,n\,$ yields a smaller nonmultiple $\rm\in S$ (check both smaller and $\rm\in S$), contradiction! –  Math Gems Feb 21 '13 at 23:32
@user62287 I added an alternative proof which may be easier to follow. –  Math Gems Feb 22 '13 at 0:24
Now I don't understand the lemma. How is your lemma equivalent to Bezout's identity? –  user62287 Feb 22 '13 at 10:22
@user62287 Above the Lemma is a proof that $\rm\,S = a\,\Bbb Z + b\,\Bbb Z\:$ has least positive element $\rm\, d = gcd(a,b).\:$ Now$\rm\,\ d\in S\:\Rightarrow\: d = ax+by\:$ for some $\rm\,x,y\in\Bbb Z.\:$ That's precisely Bezout's identity. –  Math Gems Feb 22 '13 at 14:26

The idea you allude to is doing euclids algorithm to find the gcd, then back substituting all the way to get the values to plug into the bezout equation.

Actually this is a waste of time, you can do both simultaneously! This is called Blankenship's algorithm

You can read about it here http://mathworld.wolfram.com/BlankinshipAlgorithm.htm

share|improve this answer
This is also the idea behind the Euclid-Wallis Algorithm. –  robjohn Feb 22 '13 at 0:00

Your Answer


