Because of the existence of the discrete logarithm, the multiplicative group of is isomorphic to the additive group , which is why roots have multiplicity . This would definitely be a problem for even (it would force a multiplicity of at least two), and in particular in the square root problem mentioned in the notes, but if one is working with odd then one can almost always avoid ambiguity in taking roots. (The situation is not dissimilar to taking roots in the real numbers, where even roots are ambiguous up to sign but odd roots are unambiguous.)

]]>2. Is the standard theorem ‘at most gcd(a,q-1) roots in F_q where q is prime power’? Where can I find it? So a is carefully chosen.

]]>That is an algorithm for the discrete logarithm, not for taking roots. In a field , there are often far fewer than roots that are inside ; in general there are only roots, which is typically quite small (especially if one chooses a safe prime). (There will be roots (counting multiplicity) in the algebraic closure , but this is a far laerger field.)

]]>I am using it as analogy. There is no b such that 2b=1 mod \lambda(p) in the example. So there is only one $a$th root?

]]>I would have imagined there are $a$ possibilities and that would be an issue. Why is it avoided here but not avoided in section 4.3 in http://www.cs.cmu.edu/~ryanw/crypto/lec13.pdf?

]]>Cauchy’s theorem (and a little extra work) shows that the multiplicative group of is isomorphic to . As a consequence, taking an root is the same as taking a power whenever is such that . Locating such a and computing the power can be done quite rapidly (the latter by expanding in binary and repeatedly squaring, for instance).

]]>*[The main reference is https://mathscinet.ams.org/mathscinet-getitem?mr=2140627 -T.]*