Bounding Lifts of Markoff Triples
Abstract.
In 2016, Bourgain, Gamburd, and Sarnak proved that Strong Approximation holds for the Markoff surface in most cases. That is, the modulo solutions to the equation are covered by the integer solutions for most primes . In this paper, we provide upper bounds on lifts of points of the Markoff surface by analyzing the growth along paths in the Markoff graphs. Our first upper bound follows the algorithm given in the paper of Bourgain, Gamburd, and Sarnak, which constructs a path of possibly long length but where points grow relatively slowly. Our second bound considers paths in these graphs of short length but possibly large growth. We then provide numerical evidence and heuristic arguments for how these bounds might be improved.
1. Introduction
The Markoff surface is the affine surface in given by
and the integer points are called Markoff Triples. Markoff first studied these triples in the context of Diophantine approximation and the theory of quadratic forms (see [12] or Chapter 2 of [3], for example). Markoff triples have since found application in other areas. For example, Cohn used these triples to study free groups on two generators (see Theorem 2 of [6]), and in [10] Hirzebruch and Zagier used Markoff triples to study the signature of certain 4-dimensional manifolds. More recently, work has been done to study Markoff surface modulo .
Define the Vieta group to be the group of affine integral morphisms on generated by permutations and the Vieta involutions ; that is
and the remaining and are defined similarly. It is well-known that the orbit of under gives all the nonzero Markoff triples (see [1], for example). It is expected that the same holds modulo . More precisely, we have the following conjecture.
Conjecture 1.1 (Strong Approximation).
For any prime ,
In Theorem 1 of [2], Bourgain, Gamburd and Sarnak show that Strong Approximation holds for primes where does not have too many divisors. The authors prove this theorem by showing algorithmically that the Markoff mod graphs, defined in Section 2, are connected.
It is conjectured that the Markoff graphs in fact form an expander family, and so in light of [4] these graphs have been proposed as a means to produce cryptographic hash functions. In [9], it is noted that one avenue of attack depends on the difficulty of finding lifts of Markoff triples modulo .
Throughout this paper, we assume that is prime. For convenience, we set the following notation and terminology. We denote the nonzero points by and call elements in Markoff points. We refer to the algorithm given by Bourgain, Gamburd, and Sarnak in [2] to BGS algorithm.
Define the size of a Markoff triple by
Furthermore, for a Markoff point we call a Markoff triple a lift of if we have . The main results of this paper give bounds on the size of minimal lifts by considering “optimal” paths in the Markoff graphs, which are defined in Section 2 along with relevant definitions. We show the following.
Theorem 1.2.
Let be a prime so that for and suppose that with . Let be a lift of of minimal size. Then,
where .
In Section 4, we give numerical evidence to show that the conditions in Theorem 1.2 appear to be satisfied for many primes and approximately 80% of Markoff points. Furthermore, we provide direction for how these results might be obtained theoretically, and for obtaining upper bounds on the sizes of smallest lifts for the remaining points in with .
Our second upper bound is conditional on Strong Approximation, and depends on the expansion constant of the Markoff graph , but holds for all points in . It is expected that the family of Markoff graphs forms an expander family, and so this bound is expected to be uniform (see the discussion on Super Strong Approximation in Section 5). We show the following.
Theorem 1.3.
Let be any prime where Strong Approximation holds, and let be the expansion constant of the Markoff graph . For , let be a lift of of minimal size. Then,
where and
This paper is organized as follows. In Section 2 we introduce special elements of the Vieta group, called rotations, and give an explicit upper bound for the growth of Markoff triples under the action of the group of rotations. In Sections 2 and 3 we give the necessary background and an explicit description of the algorithm given in the paper [2] of Bourgain, Gamburd, and Sarnak for which Theorem 1.2 rests, and provide several alternate proofs to those given in [2] using the language of linear recurrence sequences. In Section 4 we prove Theorem 1.2 and give numerical evidence and a heuristic argument for how one might relax the conditions of this Theorem. In Section 5 we prove Theorem 1.3 and give evidence for how this bound might be improved on average. Finally, in Section 6 we discuss an alternate approach to finding paths in the Markoff graphs which could be used for further improvements to the bounds given in Theorems 1.2 and 1.3.
2. Rotations and The Markoff Graphs
To analyze lifts, we consider the following special elements in the Vieta group as introduced in [2].
Definition 2.1.
The rotations of are the elements given by
Explicitly, we have
For a prime , the Markoff graph is defined to be the graph with vertex set and edges for .
In Figure 1 we give an example of the Markoff mod graph when to demonstrate the complexity of the path structure for these graphs. In this figure, nodes are colored depending on their rotation order, with blue nodes corresponding to points in the cage (defined in Section 3.1).

2.1. Sizes under action of rotations
It’s known that in most cases, the Markoff graph is connected (see [2] and [5]). Observe that when is connected, we can construct lifts of points in by finding paths between and points . Proposition 2.3 will tell us that finding small lifts modulo can then be done by finding “optimal” paths in . Observe that we have the following.
Lemma 2.2.
Given we have
where is the linear recurrence sequence with initial conditions and recurrence
Similarly, where the sequence has initial conditions given by the other two coordinates and recurrence as above, and is a suitable permutation.
This observation allows us to analyze the growth of points obtained from by the action of . We have the following.
Proposition 2.3.
Let and . Then we have
where .
Note that an exponential lower bound can be derived using a similar method to that outlined below, and so we obtain a result similar to that of Zagier in [13], which bounds the growth of sizes in the Markoff tree. Furthermore, we see that switching between rotations contributes doubly exponentially in growth, while traveling along a single rotation only contributes exponentially. Theorem 1.2 follows the path constructed by Bourgain, Gamburd and Sarnak in [2] which has a relatively small number of switches between different rotations, but possibly long path lengths along each orbit. Theorem 1.3 instead considers paths of shortest possible length, but possibly many switches between distinct rotations.
Proof of Proposition 2.3.
Let be a Markoff triple, and without loss of generality set and suppose that . Let denote the linear recurrence sequence defined in Lemma 2.2, and denote the characteristic roots of . That is, are the roots of the minimal polynomial of the sequence , which is given by
Note that has distinct positive real roots, so we can set . Since is a linear recurrence sequence we can write
for some . Using our initial conditions we have
and so solving for and gives
(2.1) |
where the second equality uses that .
We induct on . When , Equation (2.1) gives
where , as desired.
Next, suppose that
and let denote the th coordinate of . We have
and so the result follows by induction. ∎
Remark 2.4.
In Figure 2, the sizes of points
are graphed with the number of rotations on the horizontal axis. Observe that our upper bound in Proposition 2.3 overshoots the growth of these sizes. However, through our experimentation is appears that a tight upper bound will still depend doubly exponentially on and exponentially on the . Improvements to this upper bound or derivation of such an asymptotic would improve the results of this paper, but we expect the true upper bound to still depend on a balance of finding paths in which are short (i.e. minimizes the , which we expect contributes exponentially to the asymptotic growth as in Proposition 2.3) but switch between distinct rotations minimally (i.e. minimizes , which we contribute doubly exponentially to the asmptotic growth as in Proposition 2.3).

2.2. Rotation Orders and Conic Sections
The BGS algorithm constructs paths in the Markoff mod graph by analyzing the orbits under the rotations, defined in 2.1. We present the analysis of these orbits as in [2], giving alternate proofs of several results.
Definition 2.5.
For , we define the following.
-
(1)
The th rotation order of is given by
-
(2)
The rotation order of is given by
If , then we call the maximal index of .
Observe that for distinct , acts on , and we can write
So, the th rotation order of is equal to the order of
in . Note in particular that only depends on the th coordinate of .
Definition 2.6.
We set the following notation. For , let be the orbit of under . Furthermore, let
be the matrix discussed above, and denote the characteristic polynomial of by and the discriminant of by . In our analysis below, we will sometimes only be concerned with a single coordinate of a Markoff point. In this case, we will instead use the notation and , respectively.
Note that the action of on a Markoff triple leaves the th coordinate of fixed, and so the orbits correspond to points inside of some conic section with discriminant . Given we use the notation
to denote the conic section consisting of Markoff points with th coordinate equal to . Note that we may also use the notation to indicate the conic section cut out by fixing the th coordinate of . Accordingly, we have the following definition.
Definition 2.7.
Let be a Markoff point with th coordinate equal to . We say that is
-
(1)
parabolic if ,
-
(2)
hyperbolic if is a nonzero square modulo , and
-
(3)
elliptic if is not a square modulo .
We have the following observation.
Lemma 2.8.
Let be a Markoff , and set . Let a root of . If is not parabolic, then is equal to the order of in , where
under the identification
Proof.
When is hyperbolic or elliptic, is diagonalizable over with eigenvalues given by and its conjugate . Since are roots of
then we have . This gives
where . So, the order of is equal to the order of in . ∎
The following Proposition can be found in Lemma 3 of [2]. We present an alternate proof of this result here.
Proposition 2.9.
Let . For a prime . We have
If is parabolic, then and we have
Proof.
For convenience, set and . If is hyperbolic, then the result follows directly from Lemma 2.8. So suppose that is elliptic. Since
then we get
and since then
So, by Lemma 2.10 below, we have or . But if then which implies , contradicting being elliptic. So we must have which gives . Hence, the order of divides and the result follows from Lemma 2.8.
Finally, suppose that is parabolic. Then which gives
Note that in the parabolic case has Jordan normal form
for some and so
(2.2) |
Recalling that denotes a root of the characteristic polynomial of , we can compute
So, the result for the order of parabolic points follows from Equation (2.2) and Lemma 2.8. ∎
Lemma 2.10.
If for nonzero elements in a field with then we have or .
Proof.
If then multiplying both sides by gives
Since the quadratic formula gives the desired result. ∎
Definition 2.11.
Let .
-
(1)
If then we say is maximal hyperbolic.
-
(2)
If then we’ll call is maximal elliptic, and
-
(3)
If we say is maximal parabolic.
A triple will be called maximal (hyperbolic, elliptic, or parabolic) if one of its coordinates is either maximal hyperbolic, elliptic, or parabolic.
2.3. Connection to Lucas Sequences
In Equation (2.1), we saw that the orbit of points in under a single rotation can be described in terms of a corresponding Lucas sequence. We prove the following identity giving this relation explicitly for any Markoff points, which may be useful for future study, and is referenced in Section 3.5 as a possible direction to relax the conditions of Theorem 1.2.
Lemma 2.12.
Let have th coordinate . Then,
where is the matrix defined in 2.6 and is the Lucas sequence with integer parameters . That is, is the linear recurrence sequence with initial conditions and recurrence
Proof.
For convenience, set . Observe that
The matrix on the right-hand side gives a familiar Lucas sequence identity. We have
Now, let be the roots of
Then, we can write
and we note that . So we have
as required. ∎
3. The BGS Algorithm
The algorithm outlined in [2] constructs a path between any two points in the Markoff graph by connecting them through the cage, which we discuss below. The BGS algorithm then guarantees a path between any two points in the cage which contains at most two distinct rotations. In light of Proposition 2.3, the paths constructed in the BGS algorithm are a good candidate for small lifts, particularly when one or both of our points are in the cage. In this section, we give an outline of the key components of the BGS algorithm from [2], extracting explicit information when possible. An explicit description of the path constructed by the BGS algorithm is then outlined in Algorithm 3.6.
3.1. The Cage
Define the cage to be the subgraph of the Markoff graph containing all vertices that are maximal points in , as defined in 2.11. The convenience of the cage is that the orbits with respect to the maximal index are precisely equal to the conic sections at that index. More precisely, we have the following.
Proposition 3.1.
If is in the cage with maximal index then . That is, if is a maximal triple with maximal index , then the orbit of under contains all Markoff points with th coordinate equal to .
This Proposition follows from our definition of maximal points along with the following lemma which can be found in [2].
Lemma 3.2.
If is parabolic, then
Otherwise, we have
The connectedness of the cage will then follow from the following result. For completeness of our analysis and implementation of the BGS algorithm, we outline the proof given in [2].
Lemma 3.3 (Section 3.2 of [2]).
Let with maximal indices , respectively. Then there is a point and so that
Proof.
Let and . Suppose first that the maximal indices of and are distinct. Without loss of generality, say has maximal index and has maximal index . We claim that there are elements in so that
Considering the Markoff equation as a quadratic in , for to be in we must have
for some . Similarly, considering the Markoff equation as a quadratic in , for to be in we must have
for some . Rearranging, this gives the system of equations
with unknowns .
When , this system of equations defines an irreducible curve in , which has solutions modulo any prime. If then this reduces to finding solutions to
(3.1) |
If is parabolic, then . Since we’ve assumed that is nonempty, then by Lemma 3.2 we must have an so is a square modulo , which gives a solution to equation (3.1). If is not parabolic, then equation (3.1) is a conic section, which has a solution modulo any prime. Using an inclusion/exclusion argument, the authors of [2] show that such a solution can be found so that has maximal order. Hence, if we let then and intersects and nontrivially. Note that if and have the same maximal index, then we can find points by solving the Equation (3.1) as above. This gives triple with maximal and . ∎
3.2. Connecting points to the cage
The following two Propositions from [2] describe how to connect points of large enough order to the cage. We give a brief outline of the proofs given in [2], both to gather explicit information and to highlight the nonexplicit steps in this construction which require we assume long path lengths in the proof of Theorem 1.2. Note that these Propositions do not cover the case when has maximal index and is parabolic of order . We will instead deal with this separately in Proposition 3.3.
Proposition 3.4 (The Endgame from Section 4 of [2]).
Let be in with , and suppose that has maximal index with not parabolic. Then, there exists a positive integer and so that is a maximal triple.
Proof.
Let denote when is hyperbolic and if is elliptic, under the identification , as in the proof of Lemma 2.8. Without loss of generality, let . By Lemma 2.2 we can write
where are roots of and are constants in . The proof given in [2] uses the Weil bound along with an inclusion/exclusion argument to show that there exists a positive integer solution to
where is defined as follows: in the hyperbolic case, is any generator of , and in the elliptic case we take where generates . Then has second coordinate equal to , and since are the roots of
then by Lemma 2.8 is equal to the order of , which is maximal by construction. ∎
Proposition 3.5 (The Middlegame from Section 4 of [2]).
Let be in with where is a fixed constant independent of , which is described in [2]. Then, there exist and positive integers so that the rotation order of
is larger than , where .
Proof.
Since the rotation order of a parabolic triple is lower bounded by , we know that is hyperbolic or elliptic. So, by Proposition 2.9, we have . Suppose that has maximal index and let be the orbit of under , as defined in 2.6. Let be in with maximal index . If is parabolic, then and we’re done. Otherwise, is hyperbolic or elliptic, and so divides as well. If then and we repeat the process above by considering the orbit . If , then we consider the sum
The authors of [2] use estimates on the gcd of elements of the form from Corvaja and Zannier in [7] to show that if does not have too many prime divisors, then . So, by definition of there must be a point in the orbit of with larger rotation order, and we proceed as above. That is, given our point , we can find with . If has maximal coordinate parabolic, then we’re done. Otherwise, . Iterating in this way, we obtain with
and since for every , this process will stop after at most steps, where denotes the number of positive divisors of an integer . ∎
3.3. Connecting Parabolic Points to the Cage
Suppose is in with parabolic. For convenience, suppose that and set . From Proposition 2.9 and Lemma 3.2, we know that and if then consists of two disjoint orbits. Here, we describe the conic section in terms of these orbits, and use this to show how to connect parabolic points of order to any point in the cage.
The Jordan normal decomposition of is given by
and so we get
Let
where is the square root of modulo , noting again that the assumption of a parabolic point implies that . From above we get
(3.2) |
(3.3) |
Observe that these orbits are disjoint and each contain elements, so we have
Now, let be any point in the cage with maximal index with and . Since contains points with distinct th coordinates and then we must have and similarly we have . Hence, we can connect to the cage by .
3.4. Points of small order
3.5. Connecting to the cage
In the tables below, we demonstrate that is in the cage for all primes where . If we can show that is always “close” to the cage, or find a large family of primes where this holds, we could then relax the conditions of Theorem 1.2. One direction to do this might be to note the following connection to the Fibonacci sequence. Observe that the Lucas sequence defined in Lemma 2.12 when is equal to . This gives
and so
So, one approach would be to investigate the orders of where is an odd term in the Fibonacci sequence.
Prime | Path | Points |
---|---|---|
2 | , | |
3 | , | |
5 | , | |
7 | , | |
11 | , | |
13 | , | |
17 | , | |
19 | , | |
23 | , | |
29 | , , | |
31 | , , | |
37 | , | |
41 | , , | |
43 | , | |
47 | , , , | |
53 | , | |
59 | , , , , , | |
61 | , | |
67 | , | |
71 | , , |
Prime | Path | Points |
---|---|---|
73 | , | |
79 | , , | |
83 | , | |
89 | , , , | |
97 | , | |
101 | , | |
103 | , | |
107 | , | |
109 | , | |
113 | , , , , , | |
127 | , | |
131 | , | |
137 | , | |
139 | , | |
149 | , | |
151 | , , , | |
157 | , | |
163 | , | |
167 | , | |
173 | , | |
179 | , , , | |
181 | , | |
191 | , , , | |
193 | , | |
197 | , | |
199 | , |
3.6. Path Construction
We are now prepared to give an explicit description of the path from to points constructed in the BGS algorithm.
Algorithm 3.6.
Let be prime and let with , where is defined in the Middlegame of [2]. Then, we can connect to in as follows.
-
I.
We assume that is connected to the cage for , which appears numerically to hold for many primes as discussed in Section 3.5.
-
II.
If then we can connect to as follows. Suppose that has maximal index and has maximal index . By Lemma 3.3 there exists a point with maximal index so that
Furthermore, by Proposition 3.1 we have that
So, the orbit of under intersects the orbits of under and the orbit of under . That is, there are points with
for integers . As in Figure 3, this gives the following path from to our point
Figure 3. Existence of intersecting the orbits of and -
III.
If then by Proposition 3.4 there exists a point so that is in the orbit of under the rotation for some . This implies that is also in the orbit of under the rotation and so we can write
Then, we can connect to as in Step II to get
-
IV.
If then by Proposition 3.5 there exists a point with where
and . Note that if then this means that is in the orbit of under . So as discussed in Step III, is also in the orbit of and we can write for some integer . Repeating this process gives us the following path from to
Since then we can connect to as in Step III to get
4. Proof of Theorem 1.2
We are now prepared to prove our first main result.
Proof of Theorem 1.2.
Take . If given our assumptions and by Step III of Algorithm 3.6 we can write
where , and the are not necessarily distinct. So, by Proposition 2.3 we have
where . Note that the correspond to path lengths from steps of the BGS algorithm. Since the proofs given in [2] are nonconstructive, we upper bound each by the corresponding rotation order. By assumption we have and by Lemma 2.9 we have for each , and so the result follows. ∎
Observe that, using Step IV of Algorithm 3.6 and Proposition 2.3, we can obtain the following upper bound for minimal lifts of points in the middlegame.
Proposition 4.1.
Let be a prime so that for and suppose that with , where is the absolute constant introduced in the Middlegame of [2]. Let be a lift of of minimal size. Then,
where denotes the number of positive divisors of .
The proof of Proposition 4.1 follows identically to the proof of Theorem 1.2 above, where we additionally note that in the Middlegame our points have order upper bounded by . A natural next step would be to explicitly compute the absolute constant references in [2] in order to extend Theorem 1.2 to a larger family of points in
4.1. Percentage of points in the cage
In Figure 4, the percentage of total points in which satisfy the conditions of Theorem 1.2 is plotted for primes . Observe that this percentage appears to hover around 80%. Note here that this percentage also includes parabolic points of order , since they are a similar distance from as points in the cage.

As shown in the proof of Proposition 2.9, note that a triple is in the cage if and only if one of its coordinates satisfies any of the following
-
(1)
if is parabolic.
-
(2)
generates if is hyperbolic, or
-
(3)
where generates if is elliptic.
Suppose that is a randomly chosen element in . If we assume the are equally likely to take the form in (2) or (3) as a randomly chosen element of and that generators are equally distributed in , then the probability that satisfies conditions (1), (2) or (3) is given by
Since the probability that a Markoff point is in the cage is lower bounded by the probability that satisfies one of , or , an interesting future direction would be to use the argument above to derive a heuristic lower bound on the percentage of points in the cage for primes where has a known asymptotic formula.
5. Shortest Paths and Proof of Theorem 1.3
In Proposition 2.3 we saw that the size of our lift grows much faster when the corresponding path contains many switches between different rotations. By following the BGS algorithm we were able to make a small number of these switches, but had to compromise by assuming long paths as we traveled along the orbit of a single rotation due to the non explicit methods used in [2]. In this section, we study lifts obtained from paths of shortest possible length with possibly many switches between rotations. The bound in Theorem 1.3 are uniform if the following conjecture holds, which is expected to be true (see [8], for example).
Conjecture 5.1 (Super Strong Approximation).
For any prime , the collection of Markoff mod graphs forms an expander family.
An expander family is a collection of graphs that is “highly connected but relatively sparse”. We refer to [11] for the formal definition. To obtain a uniform bound, we will only need to know that the expansion constant of any expander family is bounded. As a Corollary to the following Proposition, we obtain a bound on the diameter of any Markoff graph.
Proposition 5.2 (Proposition 3.1.5 of [11]).
Let be any finite non-empty connected graph. We have
where is the maximum number of edges at each vertex and is the expansion constant of .
Note that , depending on whether . Since the in for any prime we have the following Corollary.
Corollary 5.3.
If Conjecture 5.1 holds, then
where is the Markoff graph and is a constant given by
where is an upper bound for the expansion constant of .
We our now prepared to prove our second main result.
Proof of Theorem 1.3.
Lemma 5.4.
For any positive integer we have
Proof.
Suppose that partition , and that one of our parts is larger than 4, say . Then and we get
Since is also a partition then is not maximal. So, any partition maximizing must have for every . ∎
5.1. Data to support improvements on average
Note that the bound in Theorem 1.3 assumed our shortest path from in to switches between distinct rotations maximally. By Proposition 2.3, this contributes doubly exponentially to the growth of the corresponding lift. From numerical experimentation, we expect that this bound can be improved if we consider lifts on average.
The histogram in Figure 5 plots the frequency of the logarithmic size of Markoff triples of fixed length from in the Markoff tree defined by the rotations ; that is, the tree with root node and edges defined by .

This data suggests that sizes are distributed in such a way that favor smaller lifts, and so we expect that the largest sizes used in our upper bound occur infrequently enough to allow for improvement to this bound on average. An interesting future direction would be an explicit calculation of this distribution in order to obtain an improved upper bound on the size of lifts on average using the methods in Theorem 1.3.
6. Short Paths Along Parabolic Orbits
Suppose is in with parabolic. For convenience, suppose that and set . In Section 3.3 we showed that when and the conic section consists of the disjoint orbits
where and are defined in Equations (3.2) and (3.3). By Proposition 2.9 and Lemma 3.2, when we have and using a similar analysis to that in Section 3.3 we get
Now, let be a prime so that there exists a point in the cage with
for . If it’s the case that the maximal index of is not equal to one, then we can connect any parabolic point directly to as discussed in Section 3.3 by a path of the form
As in the proof of Theorem 1.2 we can take smaller than the largest rotation order, using Proposition 2.3 gives the following.
Proposition 6.1.
Let be of the form . Suppose that the point above has maximal index and let be a lift of of minimal size. Then
Since parabolic points have large orbits, it’s expected that many points are “close” to parabolic orbits. Because the bound in Proposition 6.1 is better than our previously obtained bounds, a natural next direction would be to investigate points that have short paths to nearby parabolic orbits.
References
- [1] Martin Aigner. Markov’s theorem and 100 years of the uniqueness conjecture. Springer, Cham, 2013. A mathematical journey from irrational numbers to perfect matchings.
- [2] Jean Bourgain, Alexander Gamburd, and Peter Sarnak. Markoff triples and strong approximation. Comptes Rendus Mathematique, 354(2):131–135, 2016.
- [3] John William Scott Cassels. An introduction to the geometry of numbers. Springer Science & Business Media, 2012.
- [4] Denis X. Charles, Kristin E. Lauter, and Eyal Z. Goren. Cryptographic hash functions from expander graphs. J. Cryptology, 22(1):93–113, 2009.
- [5] William Chen. Strong approximation for the markoff equation. arXiv: Number Theory, 2020.
- [6] Harvey Cohn. Markoff forms and primitive words. Math. Ann., 196:8–22, 1972.
- [7] Pietro Corvaja and Umberto Zannier. Greatest common divisors of in positive characteristic and rational points on curves over finite fields. J. Eur. Math. Soc. (JEMS), 15(5):1927–1942, 2013.
- [8] Matthew De Courcy-Ireland and Seungjae Lee. Experiments with the Markoff surface. arXiv preprint arXiv: 1812.07275v1, 2018.
- [9] Elena Fuchs, Kristin Lauter, and Austin Tran. A cryptographic hash function from Markoff triples. arXiv preprint arXiv:2107.10906, 2021.
- [10] Friedrich Hirzebruch and Don Zagier. The Atiyah-Singer theorem and elementary number theory. Mathematics Lecture Series, No. 3. Publish or Perish, Inc., Boston, Mass., 1974.
- [11] Emmanuel Kowalski. An introduction to expander graphs, volume 26 of Cours Spécialisés [Specialized Courses]. Société Mathématique de France, Paris, 2019.
- [12] Andrey Markoff. Sur les formes quadratiques binaires indéfinies. Math. Ann., 17(3):379–399, 1880.
- [13] Don Zagier. On the number of Markoff numbers below a given bound. Math. Comp., 39(160):709–723, 1982.