aryabhata remainder theorem: relevance to public-key crypto ...

6 RAO AND YANG
2.1. Aryabhata remainder theorem (ART)
Theorem (ART). Let m1 and m2 be relatively prime moduli and M = m1m2.
Given X mod m1 = x1, X mod m2 = x2, X has a unique solution in Z M given by
X = ART(x1, x2; m1, m2; M)
= ART(0, c; m1, m2; M) + x1, where c = (x2 − x1) mod m2
= A + x1, where A = m1[(c · m −1
1 ) mod m2].
Proof. First we show that X = A + x1 ∈ Z M. Because A = m1 · b for some
b ∈ Zm2 , A must be less than or equal to m1(m2 − 1). Because x1 < m1, A + x1
must be less than M = m1m2, and therefore X ∈ Z M. Now consider (A +
x1) mod m1. Because A is a multiple of m1, wehave(A + x1) mod m1 = x1.
Because A mod m2 = c due to the cancellation of the terms m1 and m −1
1 ,wehave
(A + x1) mod m2 = c + x1 = x2. Thus, A + x1 = X satisfies the two congruences
as required and is a solution in Z M. It is easy to show that A + x1 is a unique
solution in Z M. IfY ∈ Z M is another solution, then (X − Y ) mod mi = 0, for
i = 1, 2, and (X − Y ) mod M = 0. Thus, X = Y . ✷
A formal extension of ART to any number of moduli is rather straightforward and
is given in Section 5. Here we illustrate by an example.
Example 3. Let X mod 3 = x1 = 1, X mod 4 = x2 = 3, and X mod 5 = x3 = 3.
Then X = ART(1, 3, 3; 3, 4, 5; 60).
Step 1.
Step 2.
X ′ = X mod 12 = ART(1, 3; 3, 4; 12)
= ART(0, 2; 3, 4; 12) + 1
= 3[(2 · 3 −1 ) mod 4]+1
= 3 · 2 + 1 = 7
X = ART(7, 3; 12, 5; 60)
= ART(0,(3 − 7) mod 5; 12, 5; 60) + 7
= ART(0, 1; 12, 5; 60) + 7
= 12[(1 · 12 −1 ) mod 5]+7
= 12 · 3 + 7 = 43
3. Multiplicative inverse
Given positive pairwise prime integers a and b, it is very often necessary to find
a −1 mod b. That is, to find x ∈ Zb such that a · x mod b = 1. In RSA, the private