Given a large number $q$ (say, a prime) and a number $a$ between 2 and $q-1$ what is the fastest algorithm known for computing the inverse of $a$ in the group of residue classes modulo $q$?



Fast computation of multiplicative inverse modulo q
The fast Euclidean algorithm runs in time $O(M(n)\log n)$, where $n=\log q,$ and $M(n)$ is the time to multiply two $n$-bit integers. This yields a bit-complexity of
$$
O(n\log^2 n\log\log n)
$$
for the time to compute the inverse of an integer modulo $q$, using the standard Schonhage-Strassen algorithm for multiplying integers (a slightly better asymptotic result can be obtained using Furer's multiplication algorithm).


To understand the basic idea behind the fast Euclidean algorithm, recall that the standard Euclidean algorithm computes the (extended) gcd of two integers $r\_0 > r\_1$ by successively computing $m\_i=\lfloor r\_{i-1}/r\_i\rfloor$ and setting
$$
r\_{i+1} = r\_{i-1} - m\_ir\_i,
$$
until it obtains $r\_{k+1} = 0$, at which point $r\_k = \gcd (r\_0, r\_1)$. This can be expressed in matrix form as
$$
R\_1 = \begin{bmatrix}
r\_0\newline
r\_1
\end{bmatrix};\qquad
R\_{i+1} = \begin{bmatrix}
r\_i\newline
r\_{i+1}\end{bmatrix} = M\_iR\_i;\qquad
M\_i=\begin{bmatrix}
0&1\newline
1&-m\_i
\end{bmatrix},
$$
and if we compute the matrix $S\_k=M\_kM\_{k-1}\ldots M\_1$, we have $R\_{k+1}=S\_kR\_1$ which expresses the entry $r\_k=\gcd(r\_0,r\_1)$ as a linear combination of $r\_0$ and $r\_1$. Assuming this gcd is 1, we can then read off the inverse of $r\_1$ modulo $r\_0$ (and vice versa) from the top row of $S\_k$.


As described above, this involves $O(k)$ arithmetic operations on integers of size $O(n)$, and one can show that $k=O(n)$, leading to a running time that is roughly quadratic in $n$. The fast Euclidean algorithm achieves a quasi-linear running time by only computing $O(\log n)$ of the matrices $S\_i$. Roughly speaking (and ignoring many important details), this is done by directly computing $S\_{k/2}$ using what is known as a "half-gcd" algorithm, computing $R\_{k/2+1}=S\_{k/2}R\_1$, and then proceeding recursively. The half-gcd algorithm, in turn, works by recursively calling itself. The depth of the recursion is $O(\log n)$ and this yields an $O(M(n)\log n)$ complexity bound.


This algorithm also works over polynomial rings and is often described in this setting. Further details can be found in the (incomplete) list of references below:


Chapter 11 of von zur Gathen and Gerhard, "Modern Computer Algebra," Cambridge University Press, 2003.


Chapter 2 of Yap, "Fundamental Problems of Algorithmic Algebra," Oxford University Press, 2000.


N. Moller, "[On Schonhage's algorithm and subquadratic integer GCD computation](http://www.lysator.liu.se/~nisse/archive/S0025-5718-07-02017-0.pdf)," Mathematics of Comutation 77(261), pp. 589-607 (2008).


Stehle and Zimmerman, "[A binary recursive GCD algorithm](http://perso.ens-lyon.fr/damien.stehle/downloads/recbinary.pdf)," ANTS-VI, LCNS 3076, pp. 411-425, 2004.


