Course notes (chap. 1 Number Theory, chap. 2 ... - McGill University
Course notes (chap. 1 Number Theory, chap. 2 ... - McGill University
Course notes (chap. 1 Number Theory, chap. 2 ... - McGill University
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
COMP-547A<br />
/B<br />
Cryptography and Data Security<br />
Lecture 01 02-06<br />
Prof. Claude Crépeau<br />
School of Computer Science<br />
<strong>McGill</strong> <strong>University</strong>
1 Basic <strong>Number</strong> <strong>Theory</strong><br />
1.1 Definitions<br />
Divisibility:<br />
a|b ⇐⇒ ∃k ∈ Z [b = ak]<br />
Congruences:<br />
a ≡ b (mod n) ⇐⇒ n|(a − b)<br />
Modulo operator: (Maple irem, mod)<br />
b mod n =min{a ≥ 0:a ≡ b<br />
(mod n)}<br />
Division operator: (Maple iquo)<br />
b div n = ⌊b/n⌋ =<br />
b − (b mod n)<br />
n<br />
a ≡ b (mod n) <br />
⟺ <br />
a mod n = b mod n
Euclid<br />
Leonhard Euler<br />
Greatest Common Divider: (Maple igcd, igcdex)<br />
g =gcd(a, b) ⇐⇒ g|a, g|b and [g ′ |a, g ′ |b ⇒ g ′ |g]<br />
Euler’s Phi function: (Maple phi)<br />
φ(n) =#{a :0
1.2 Efficient operations<br />
For the basic operations of +, −, ×, mod , div one may use standard “elementary<br />
school” algorithms reducing the work load by the following rules:<br />
a<br />
⎧<br />
⎨<br />
⎩<br />
+<br />
−<br />
×<br />
⎫<br />
⎬<br />
⎭ b mod n = ⎛<br />
⎝(a mod n)<br />
⎧<br />
⎨<br />
⎩<br />
+<br />
−<br />
×<br />
⎫<br />
⎬<br />
⎭ (b mod n) ⎞<br />
⎠ mod n<br />
The standard “elementary school” algorithms are precisely described in<br />
Knuth (Vol 2). For very large numbers, special purpose divide-and-conquer<br />
algorithms may be used for better efficiency of ×,mod, div. Consult the<br />
algorithmics book of Brassard-Bratley for these.
1.2.1 Fast modular exponentiation<br />
The idea behind this algorithm is to maintain in each iteration the value of<br />
the expression xa e mod n while reducing the exponent e by a factor 2.<br />
Algorithm 1.1 ( a e mod n )<br />
1: x ← 1,<br />
2: WHILE e>0 DO<br />
3: IF e is odd THEN x ← ax mod n,<br />
4: a ← a 2 mod n, e ← e div 2,<br />
5: ENDWHILE<br />
6: RETURN x.<br />
(Maple x&^e mod n)
EXAMPLE<br />
5 13 mod 7<br />
= 5 8+4+1 mod 7<br />
= 5 8 x5 4 x5 1 mod 7<br />
5 0 , 5 1 , 5 2 , 5 4 , 5 8 <br />
≡ 1, 5, 4, 2, 4 (mod 7)<br />
= 4x2x5 mod 7<br />
= 1x5 mod 7 <br />
= 5
1.2.2 GCD calculations and multiplicative inverses<br />
Note. gcd(a, b) =g →∃ x,y ∈ Z such that g = ax + by. The following<br />
recursive definition is based on the property gcd(a, b) =gcd(a, b − a).<br />
gcd(a, b) =<br />
{ a if b =0<br />
gcd(b, a mod b) otherwise<br />
The idea behind the following iterative algorithm is to maintain in each<br />
iteration the relations g = ax+by and g ′ = ax ′ +by ′ while reducing the value<br />
of g.<br />
At the end of the algorithm, the value of g is gcd(a, b). The final value<br />
of x is such that ax ≡ g (mod b) andbysymmetry,thefinalvalueofy<br />
is such that by ≡ g (mod a) . Whengcd(a, b) =1,wefindthatx is the<br />
multiplicative inverse of a modulo b and that y is the multiplicative inverse<br />
of b modulo a.
Algorithm 1.2 ( Euclide gcd(a,b) ) <br />
1: g ⟵ a, g′ ⟵ b, x ⟵ 1, y ⟵ 0, x′ ⟵ 0, y′ ⟵ 1,<br />
2:WHILE g′>0 DO <br />
3: k ⟵ g div g′ <br />
4: g′′ ⟵ g-kg′; x′′ ⟵ x-kx′; y′′ ⟵ y-ky′ <br />
5: g ⟵ g′; x ⟵ x′; y ⟵ y′ <br />
6: g′ ⟵ g′′; x′ ⟵ x′′; y′ ⟵ y′′; <br />
7: ENDWHILE <br />
8: RETURN g,x,y <br />
(Maple igcd, igcdex, 1/x mod n, x^(-1) mod n)
EXAMPLE<br />
gcd(7,19)<br />
= gcd(19,7)<br />
= gcd(7,19 mod 7)<br />
= gcd(7,5)<br />
= gcd(5,7 mod 5)<br />
= gcd(5,2)<br />
= gcd(2,5 mod 2)<br />
= gcd(2,1)<br />
= gcd(1,2 mod 1) = gcd(1,0) = 1
EXAMPLE<br />
gcd(7,19)<br />
x=1,y=0,x’=0,y’=1<br />
= gcd(19,7) x=0,y=1,x’=1,y’=0<br />
= gcd(7,19 mod 7)<br />
= gcd(7,5) x=1,y=0,x’=-2,y’=1<br />
= gcd(5,7 mod 5)<br />
= gcd(5,2) x=-2,y=1,x’=3,y’=-1<br />
= gcd(2,5 mod 2)<br />
= gcd(2,1) x=3,y=-1,x’=-8,y’=3<br />
= gcd(1,2 mod 1) = gcd(1,0) = 1<br />
x=-8,y=3,x’=19,y’=-7
EXAMPLE<br />
gcd(7,19)<br />
<br />
= gcd(1,0) = 1 x=-8,y=3,x’=19,y’=-7<br />
thus<br />
1 = -8x7 + 3x19<br />
and<br />
7 -1 mod 19 = 11 = -8 mod 19<br />
19 -1 mod 7 = 3 = 3 mod 7
1.3 Solving linear congruentials<br />
A linear congruential is an expression of the form<br />
ax ⌘ b (mod n)<br />
for known a, b, n and unknown x.<br />
gcd(a, n) =1sinceinthatcasea 1<br />
x ⌘ ba 1<br />
Clearly, we can solve for x whenever<br />
(mod n) existsandthus<br />
(mod n).
EXAMPLE<br />
7x ≡ 5 (mod 9)<br />
7 -1 ∙7x ≡ 7 -1 ∙5 (mod 9)<br />
4∙7x ≡ 4∙5 (mod 9)<br />
x ≡ 2 (mod 9)
Similarily, when gcd(a, n) =g>1thesituationcanbemodifiedtoapply<br />
the same strategy. If it is the case that g|b as well, we can solve the following<br />
system instead, where a ′ = a g , b′ = b g , n′ = n g :<br />
a ′ x ′ ≡ b ′ (mod n ′ ).<br />
Since gcd(a ′ ,n ′ )=1,a ′−1 (mod n ′ )existsandwecansolveforx ′<br />
x ′ ≡ b ′ a ′−1 (mod n ′ ).<br />
Note however, that no solution exists if g̸ |b.
Finally, we know that a solution x modulo n must satisfy x ≡ x ′ (mod n ′ ).<br />
Thus we can write<br />
x = x ′ + kn ′<br />
and consider all such x with 0 ≤ k
EXAMPLE<br />
6x ≡ 5 (mod 9)<br />
has no solution because<br />
gcd(6,9)=3 and 3∤5.<br />
----------------------------------<br />
6x ≡ 3 (mod 9)<br />
2x ≡ 1 (mod 3)<br />
since gcd(6,9)|3<br />
2 -1 ∙2x ≡ 2 -1 ∙1 (mod 3)<br />
x ≡ 2 (mod 3)<br />
x ≡ 2, 5, 8 (mod 9)
1.3.1 Chinese Remainder Theorem<br />
Qin Jiushao<br />
Theorem 1.1 (Chinese Remainder (Maple chrem)) Let m 1 ,m 2 ,...,m r<br />
be r positive integers such that gcd(m i ,m j )=1for 1 ≤ i
EXAMPLE<br />
x ≡ 5 (mod 9) x ≡ 3 (mod 4) <br />
x ≡ 7 (mod 13)<br />
has a unique solution mod 468 <br />
= 4∙9∙13<br />
x = 5∙52∙(52 -1 mod 9)+ 3∙117∙(117 -1 mod 4) <br />
<br />
+ 7∙36∙(36 -1 mod 13)<br />
x = 260∙4 + 351∙1 + 252∙4<br />
x = 1040 + 351 + 1008<br />
x = 2399 <br />
x ≡ 59 (mod 468)
1.4 Quadratic Residues<br />
Quadratic residues modulo n are the integers with an integer square root<br />
modulo n (Maple quadres):<br />
QR n = {a :gcd(a, n) =1, ∃r[a ≡ r 2<br />
QNR n = {a :gcd(a, n) =1, ∀r[a ≢ r 2<br />
(mod n)]}<br />
(mod n)]}<br />
Example:<br />
since<br />
QR 17 = {1, 2, 4, 8, 9, 13, 15, 16}<br />
QNR 17 = {3, 5, 6, 7, 10, 11, 12, 14}<br />
{1 2 , 2 2 , 3 2 , 4 2 , 5 2 , 6 2 , 7 2 , 8 2 , 9 2 , 10 2 , 11 2 , 12 2 , 13 2 , 14 2 , 15 2 , 16 2 }≡<br />
{1, 2, 4, 8, 9, 13, 15, 16} (mod 17).<br />
Theorem 1.2 Let p be an odd prime number<br />
#QR p =#QNR p =(p − 1)/2.
1.4.1 Legendre and Jacobi Symbols<br />
For an odd prime number p,wedefinetheLegendresymbol(Maplelegendre)<br />
as<br />
⎧<br />
( a<br />
⎨ +1 if a ∈ QR p<br />
= −1 if a ∈ QNR p<br />
p)<br />
⎩<br />
0 if p|a<br />
For any integer n = p 1 p 2 ...p k ,wedefinetheJacobisymbol(Maplejacobi)<br />
(a generalization of the Legendre symbol) as<br />
( ( )( ) ( )<br />
a a a a<br />
=<br />
...<br />
n)<br />
p 1 p 2 p k<br />
Adrien-Marie Legendre<br />
Carl Gustav Jacob Jacobi
Properties ( 1<br />
=+1<br />
n)<br />
( ) ab<br />
( a<br />
) ( )<br />
b<br />
=<br />
n n n<br />
( ( )<br />
a a mod n<br />
=<br />
n)<br />
n<br />
For n odd<br />
( ) −1<br />
n<br />
( 2<br />
n)<br />
For a, n odd and such that gcd(a, n) =1<br />
( a<br />
)( n<br />
)<br />
n a<br />
=(−1) (n−1)/2<br />
=(−1) (n2 −1)/8<br />
=(−1) (n−1)(a−1)/4<br />
Carl Friedrich Gauss
Algorithm 1.3 ( Jacobi(a, n) )<br />
1:if a ≤ 1 then return a<br />
else if a is odd then if a ≡ n ≡ 3(mod4)<br />
then return −Jacobi(n mod a, a)<br />
else return +Jacobi(n mod a, a)<br />
else if n ≡±1(mod8)<br />
then return +Jacobi(a/2,n)<br />
else return −Jacobi(a/2,n)<br />
This algorithm runs in O((lg n) 2 )bitoperations.
EXAMPLE<br />
Jacobi(527, 723)<br />
= -Jacobi(723 mod 527, 527)<br />
= -Jacobi(196, 527)<br />
= -Jacobi(98, 527)<br />
= -Jacobi(49, 527)<br />
= -Jacobi(527 mod 49, 49)<br />
= -Jacobi(37, 49)<br />
= -Jacobi(49 mod 37, 37)<br />
= -Jacobi(12, 37)
EXAMPLE<br />
Jacobi(527, 723)<br />
= -Jacobi(12, 37)<br />
= Jacobi(6, 37)<br />
= -Jacobi(3, 37)<br />
= -Jacobi(37 mod 3, 3)<br />
= -Jacobi(1, 3)<br />
= -1
Pierre de Fermat<br />
1.4.2 Fermat-Euler<br />
Theorem 1.3 (Fermat) Let p be a prime number and a be an integer not<br />
amultipleofp, then<br />
a p−1 ≡ 1 (mod p).<br />
Theorem 1.4 Let p be a prime number and a be an integer, then<br />
(Euler)<br />
( a<br />
a (p−1)/2 ≡ (mod p).<br />
p)<br />
Theorem 1.5 (Euler) Let n be an integer and a another integer such that<br />
gcd(a, n) =1,then<br />
a φ(n) ≡ 1 (mod n).
1.4.3 Extracting Square Roots modulo p<br />
Theorem 1.6 For prime numbers p ≡ 3(mod4)and a ∈ QR p ,wehave<br />
that r = a (p+1)/4 mod p is a square root of a.<br />
Proof.<br />
(a (p+1)/4) ) 2 ≡ a (p−1)/2 · a (mod p)<br />
≡ a (mod p)(Fermat, sec. 1.3)
For prime numbers p ≡ 1(mod4)anda ∈ QR p ,there(only)existsan<br />
efficient probabilistic algorithm. We present one found in the algorithmics<br />
book of Brassard-Bratley:<br />
Algorithm 1.4 ( rootLV(a, p, VAR r, VAR success) )<br />
1: z ← uniform(1 ...p− 1)<br />
2: IF a = z 2 mod p {very unlikely} THEN success ← true, r ← z<br />
3: ELSE compute c and d such that 0 ≤ c ≤ p − 1, 0 ≤ d ≤ p − 1, and<br />
c + d √ a ≡ (z + √ a) (p−1)/2 mod p<br />
4: IF d =0THEN success ← false<br />
5: ELSE (c =0), success ← true,<br />
<br />
Michele Cipolla<br />
6: compute r such that 1 ≤ r ≤ p − 1andd · r ≡ 1modp
EXAMPLE<br />
p = 37, a = 16<br />
z = 3<br />
(3 + √a) (p-1)/2 ≡ (3 + √a) 18 (mod 37)<br />
≡ (25 + 6√a) 9 (mod 37)<br />
≡ (25 + 6√a) 8 (25 + 6√a) (mod 37)<br />
≡ (17 + 4√a) 4 (25 + 6√a) (mod 37)<br />
≡ (27 + 25√a) 2 (25 + 6√a) (mod 37)<br />
≡ (36 + 18√a)(25 + 6√a) (mod 37)<br />
≡ (1 + 0√a) (mod 37)
EXAMPLE<br />
p = 37, a = 16<br />
z = 5<br />
(5 + √a) (p-1)/2 ≡ (5 + √a) 18 (mod 37)<br />
≡ (4 + 10√a) 9 (mod 37)<br />
≡ (4 + 10√a) 8 (4 + 10√a) (mod 37)<br />
≡ (25 + 6√a) 4 (4 + 10√a) (mod 37)<br />
≡ (17 + 4√a) 2 (4 + 10√a) (mod 37)<br />
≡ (27 + 25√a)(4 + 10√a) (mod 37)<br />
≡ (1 + 0√a) (mod 37)
EXAMPLE<br />
p = 37, a = 16<br />
z = 7<br />
(7 + √a) (p-1)/2 ≡ (7 + √a) 18 (mod 37)<br />
≡ (28 + 14√a) 9 (mod 37)<br />
≡ (28 + 14√a) 8 (28 + 14√a) (mod 37)<br />
≡ (35 + 7√a) 4 (28 + 14√a) (mod 37)<br />
≡ (11 + 9√a) 2 (28 + 14√a)(mod 37)<br />
≡ (11 + 13√a)(28 + 14√a) (mod 37)<br />
≡ (1 + 0√a) (mod 37)
EXAMPLE<br />
p = 37, a = 16<br />
z = 9<br />
(9 + √a) (p-1)/2 ≡ (9 + √a) 18 (mod 37)<br />
≡ (23 + 18√a) 9 (mod 37)<br />
≡ (23 + 18√a) 8 (23 + 18√a) (mod 37)<br />
≡ (15 + 14√a) 4 (23 + 18√a) (mod 37)<br />
≡ (31 + 13√a) 2 (23 + 18√a)(mod 37)<br />
≡ (2 + 29√a)(23 + 18√a) (mod 37)<br />
≡ (36 + 0√a) (mod 37)
EXAMPLE<br />
p = 37, a = 16<br />
z = 11<br />
(11 + √a) (p-1)/2 ≡ (11 + √a) 18 (mod 37)<br />
≡ (26 + 22√a) 9 (mod 37)<br />
≡ (26 + 22√a) 8 (26 +22√a)(mod 37)<br />
≡ (21 + 34√a) 4 (26 + 22√a)(mod 37)<br />
≡ (30 + 22√a) 2 (26 +22√a)(mod 37)<br />
≡ (23 + 25√a)(26 + 22√a) (mod 37)<br />
≡ (0 + 9√a) (mod 37)
EXAMPLE<br />
p = 37, a = 16<br />
z = 11<br />
(11 + √a) (p-1)/2 ≡ (11 + √a) 18 (mod 37)<br />
≡ (0 + 9√a) (mod 37)<br />
thus<br />
9√a ≡ ±1 (mod 37)<br />
√a ≡ ±9 -1 (mod 37)<br />
√a ≡ ±33 (mod 37)
1.4.4 Extracting Square Roots modulo n<br />
We want to solve r 2 ≡ a (mod n) forr knowing p, q such that n = pq. We<br />
first solve modulo p and q and find solutions to<br />
r 2 p ≡ a (mod p)<br />
r 2 q ≡ a (mod q).<br />
We then consider the simultaneous congruences<br />
r ≡ r p (mod p) ⇐⇒ p|r 2 − a<br />
r ≡ r q (mod q) ⇐⇒ q|r 2 − a<br />
} {{ }<br />
⇒ p · q = n|r 2 − a<br />
⇒ r 2 ≡ a (mod n)<br />
We can now solve r by the chinese remainder theorem.
EXAMPLE<br />
n = 37*43 = 1591, a = 16<br />
√a ≡ ±33 (mod 37)<br />
√a ≡ ±a (p+1)/4 ≡ ±a 11 ≡ ±4 (mod 43)<br />
use CRT on the following 4 systems<br />
√a ≡ 4 (mod 37) √a ≡ 4 (mod 43)<br />
√a ≡ 4 (mod 37) √a ≡ 39(mod 43)<br />
√a ≡ 33(mod 37) √a ≡ 4 (mod 43)<br />
√a ≡ 33(mod 37) √a ≡ 39(mod 43)
EXAMPLE<br />
use CRT on the following 4 systems<br />
√a ≡ 4 (mod 37) √a ≡ 4 (mod 43)<br />
√a ≡ 4 (mod 1591)<br />
√a ≡ 4 (mod 37) √a ≡ 39(mod 43)<br />
√a ≡ 1114 (mod 1591)<br />
√a ≡ 33(mod 37) √a ≡ 4 (mod 43)<br />
√a ≡ 477 (mod 1591)<br />
√a ≡ 33(mod 37) √a ≡ 39(mod 43)<br />
√a ≡ 1587 (mod 1591)
Definition 1.7 (SQROOT) The square root modulo n problem can be<br />
stated as follows: <br />
given a composite integer n and a ∈ QR n , find a square root of a mod n. <br />
(Maple msqrt) <br />
Theorem 1.8 SQROOT is polynomialy equivalent to FACTORING. <br />
Proof idea: the previous construction showed that if we know the<br />
factorization of n, then we can extract square roots modulo each prime<br />
factor of n and then recombine using the Chinese Remainder Theorem. <br />
If we can extract square roots modulo n, then we can split n in two factors<br />
n = uv by repeating the following algorithm: <br />
• Pick a random integer a and extract the square root of a 2 mod n, say a′.<br />
• If a′ ≡ ±a (mod n) then try again,<br />
• Return(u,v) <br />
else set u = gcd(a+a′, n) and v = gcd(a−a′, n). <br />
(The probability of the second case is at least 1 / 2 .)
EXAMPLE<br />
n = 37*43 = 1591,<br />
a = 477,<br />
a 2 mod 1591 = 16<br />
√(a 2 ) mod 1591 = 4<br />
477 ≢ ±4 (mod 1591)<br />
u = gcd(477+4, 1591) = 37<br />
v = gcd(477-4, 1591) = 43
1.5 Prime numbers<br />
If we want a random prime (Maple rand, isprime) ofagivensize,weuse<br />
the following theorem to estimate the number of integers we must try before<br />
finding a prime. Let π(n) =#{a :0
Algorithm 1.5 ( Pseudo(a, n) )<br />
1: IF gcd(a, n) ≠1THEN RETURN “composite”,<br />
2: Let t be an odd number and s apositiveintegersuchthatn − 1=t2 s<br />
3: x ← a t mod n, y ← n − 1,<br />
4: FOR i ← 0 TO s<br />
5: IF x =1AND y = n − 1 THEN RETURN “pseudo”,<br />
6: y ← x, x ← x 2 mod n,<br />
7: ENDFOR<br />
8: RETURN “composite”.<br />
It is easy to show that if n is prime, then Pseudo(a, n) returns“pseudo”<br />
for all a, 0
EXAMPLE<br />
n = 37*43 = 1591,<br />
n-1 = 1590 = 795*2<br />
t = 795, s = 1<br />
a = 16<br />
x = 16 795 mod 1591, y = 1590<br />
i=0, x = 692 ≠ 1, y = n-1<br />
i=1, x = 1564 ≠ 1, y=692<br />
1591 is composite
EXAMPLE<br />
n = 1597,<br />
n-1 = 1596 = 399*4<br />
t = 399, s = 2<br />
a = 16<br />
x = 16 399 mod 1597, y = 1596<br />
i=0, x = 1, y = n-1<br />
1597 is pseudo
EXAMPLE<br />
n = 1597,<br />
n-1 = 1596 = 399*4<br />
t = 399, s = 2<br />
a = 17<br />
x = 17 399 mod 1597, y = 1596<br />
i=0, x = 1, y = n-1<br />
1597 is pseudo
EXAMPLE<br />
n = 1597,<br />
n-1 = 1596 = 399*4<br />
t = 399, s = 2<br />
a = 18<br />
x = 18 399 mod 1597, y = 1596<br />
i=0, x = 610, y = n-1<br />
i=1, x = 1596, y = 610<br />
i=2, x = 1, y = 1596<br />
1597 is pseudo
Algorithm 1.6 ( Miller-Rabin prime(n, k) )<br />
1: FOR i ← 1 TO k<br />
2: Pick a random element a, 0
EXAMPLE<br />
n = 1597<br />
is either prime<br />
or we just experienced an event<br />
(3 random occurrences of “pseudo”)<br />
that happens with probability at<br />
most 1/64.<br />
We are almost certain that 1597 is<br />
prime...
In August of 2002, Agrawal, Kayal, and Saxena, announced the discovery<br />
of a deterministic primality test running in polynomial time. Unfortunately<br />
this test is too slow in practice... its running time being O(|n| 12 ).<br />
To prove that an integer n is prime:<br />
Let a be an integer such that gcd(a, n) =1.<br />
n is prime if and only if, for all such a<br />
(x + a) n ≡ x n + a (mod n)<br />
Manindra Agrawal, Neeraj Kayal, and Nitin Saxena
1.6 Quadratic Residuosity problem<br />
Definition 1.11<br />
J n := {a ∈ Z n |<br />
( a<br />
n)<br />
=1}<br />
Theorem 1.12 Let n be a(<br />
product ) ( of ) two distinct odd primes p and q. Then<br />
we have that a ∈ QR n iff = =1.<br />
a<br />
p<br />
a<br />
q<br />
Definition 1.13 The quadratic residuosity problem (QRP) is the following:<br />
given an odd composite integer n and a ∈ J n ,decidewhetherornota is a<br />
quadratic residue modulo n.<br />
Definition 1.14 (pseudosquare) Let n ≥ 3 be an odd integer. An integer a<br />
is said to be a pseudosquare modulo n if a ∈ QNR n<br />
⋂<br />
Jn .
Remark: If n is a prime, then it is easy to decide if a is in QR n ,since<br />
a ∈ QR n iff a ∈ J n ,andtheLegendresymbolcanbeefficientlycomputedby<br />
algorithm 1.3.<br />
If n is a product of two distinct odd primes ( p and ) q, thenitfollowsfrom<br />
theorem 1.12 that if a ∈ J n ,thena ∈ QR n iff =1.<br />
If we can factor ( ) n, thenwecanfindoutifa ∈ QR n by computing the<br />
Legendre symbol .<br />
a<br />
p<br />
If the factorization of n is unknown, then there is no efficient algorithm known<br />
to decide if a ∈ QR n .<br />
a<br />
p
Shafi Goldwasser<br />
Silvio Micali<br />
This leads to the Goldwasser-Micali probabilistic encryption algorithm:<br />
Init: Alice starts by selecting two large distinct prime numbers p and q.<br />
She then computes n = pq and selects a pseudosquare y. n and y will be<br />
public, p and q private.<br />
Algorithm 1.7 ( Goldwasser-Micali probabilistic encryption )<br />
1: Represent message m in binary (m = m 1 m 2 ...m t ).<br />
2: FOR i =1TO t DO<br />
3:<br />
∗<br />
Pick x ∈ R Z n<br />
4: c i ← y m i<br />
x 2 mod n<br />
5: RETURN c = c 1 c 2 ...c t
3: Pick x ∈ R Z n<br />
∗<br />
4: c i ← y m i<br />
x 2 mod n<br />
5: RETURN c = c 1 c 2 ...c t<br />
Algorithm 1.8 ( Goldwasser-Micali decryption )<br />
1: FOR i =1TO t DO<br />
2: e i ←<br />
(<br />
ci<br />
p<br />
)<br />
using algo 1.3.<br />
3: IF e i =1THEN m i ← 0 ELSE m i ← 1<br />
4: RETURN m = m 1 m 2 ...m t
2 Finite Fields<br />
2.1 Prime Fields<br />
Let p be a prime number. The integers 0, 1, 2,...,p − 1withoperations<br />
+modp et × mod p constitute a field F p of p elements.<br />
• contains an additive neutral element (0)<br />
• each element e has an additive inverse −e<br />
• contains an multiplicative neutral element (1)<br />
• each non-zero element e has a multiplicative inverse e −1<br />
Évariste Galois<br />
• associativity<br />
• commutativity<br />
• distributivity
Examples<br />
F 2 =({0, 1}, ⊕, ∧). F 5 =({0, 1, 2, 3, 4}, +, ×) definedby<br />
+ 0 1 2 3 4<br />
0 0 1 2 3 4<br />
1 1 2 3 4 0<br />
2 2 3 4 0 1<br />
3 3 4 0 1 2<br />
4 4 0 1 2 3<br />
× 0 1 2 3 4<br />
0 0 0 0 0 0<br />
1 0 1 2 3 4<br />
2 0 2 4 1 3<br />
3 0 3 1 4 2<br />
4 0 4 3 2 1<br />
Other kind of finite fields for numbers q not necessarily prime exist (Maple<br />
GF). This is studied in another section. In general we refer to F q for a finite<br />
field, but you may think of the special case F p if you do not wish to find out<br />
about the general field construction.
2.1.1 Primitive Elements<br />
In all finite fields F q (and some groups in general) there exists a primitive<br />
element, thatisanelementg of the field such that g 1 ,g 2 ,...,g q−1 enumerate<br />
all of the q − 1non-zeroelementsofthefield. Weusethefollowingtheorem<br />
to find a primitive element over F q .<br />
Theorem 2.1 Let l 1 ,l 2 ,...,l k be the prime factors of q−1 and m i =(q−1)/l i<br />
for 1 ≤ i ≤ k. Anelementg is primitive over F q if and only if<br />
• g q−1 =1<br />
• g mi ≠1for 1 ≤ i ≤ k
Algorithm 2.1 ( Primitive(q) )<br />
1: Let l 1 ,l 2 ,...,l k be the prime factors of q−1 and m i = q−1<br />
l i<br />
for 1 ≤ i ≤ k,<br />
2: REPEAT<br />
3: pick a random non-zero element g of F q ,<br />
4: UNTIL g mi ≠1for 1 ≤ i ≤ k,<br />
5: RETURN g.<br />
(Maple primroot, G[PrimitiveElement])<br />
We use the following theorems to estimate the number of field elements<br />
we must try in order to find a random primitive element.<br />
Theorem 2.2 #{g : g is a primitive element of F q } = φ(q − 1).<br />
Theorem 2.3 lim inf<br />
n→∞<br />
φ(n)loglogn<br />
n<br />
= e −γ ≈ 0.5614594836<br />
Example: 2isaprimitiveelementofF 5 since {2, 2 2 , 2 3 , 2 4 } = {2, 4, 3, 1}.
Relation to Quadratic residues As an interesting note, if g is a primitive<br />
element of the field F p ,foraprimep, thenwehave:<br />
QR p = {g 2i mod p :0≤ i
Factoring q − 1... The only efficient way we know to finding a primitive<br />
element in fields F q is when the factorization of q − 1isknown. Ingeneral,it<br />
may be difficult to factor q − 1. However, if we are after a large field with a<br />
random number of elements, Eric Bach has devised an efficient probabilistic<br />
algorithm to generate random integers of a given size with known factorization.<br />
Recently, Adam Kalai has invented a somewhat slower algorithm that<br />
is much simpler. Suppose we randomly select r with its factorization using<br />
Bach’s or Kalai’s algorithm. We may check whether r +1 is a prime or a<br />
prime power. In this case a finite field of r +1elements isobtainedand a<br />
primitive element may be computed.<br />
Eric Bach<br />
Adam Kalai
Algorithm 2.2 ( Kalai randfact(n) )<br />
1: Generate a sequence n = s 0 ≥ s 1 ≥ s 2 ≥ ... ≥ s l =1by picking<br />
s i+1 ∈ R {1, 2,...,s i },untilreachings l =1.<br />
2: Let r be the product of the prime s i ’s, 1 ≤ i ≤ l.<br />
3: IF r ≤ n THEN with probability r/n RETURN (r, {prime s i ’s}).<br />
4: Otherwise, RESTART.<br />
∏<br />
Theorem 2.4 The probability of producing r at step 2 is M n /r, whereM n =<br />
(1 − 1/p).<br />
p≤n<br />
Thus by outputting r with probability r/n in step 3, each possible value<br />
is generated with equal probability M n r<br />
= M n<br />
r n n<br />
.Theoverallprobabilitythat<br />
some small enough r is produced and chosen in step 3 is ∑ M n<br />
1≤r≤n n<br />
= M n .<br />
Theorem 2.5 lim<br />
n→∞<br />
M n log n = e −γ ≈ 0.5614594836
EXAMPLE<br />
n = 10000000<br />
S = [2710128, 641972, 624230, <br />
63651, 29726, 20674, 18328, 11419, <br />
2278, 225, 111, 20, 9, 6, 4, 3˙, 3˙, 3˙, <br />
3˙, 2˙, 1]<br />
r = 3*3*3*3*2 = 162 < 10000000<br />
output r with prob 162/10000000
EXAMPLE<br />
n = 10000000<br />
S = [1710521, 1598315, 1593963,<br />
391063˙, 358492, 238266, 47754, <br />
16614, 15731˙, 15278, 13784, 5463, <br />
3157, 1668, 764, 666, 25, 15, 1]<br />
r = 391063*15731 <br />
= 6151812053 > 10000000<br />
output r with prob 0
EXAMPLE<br />
n = 10000000<br />
S = [4721693, 4476798, 78400,<br />
64925, 16481˙, 4780, 529, 251˙,<br />
189, 182, 175, 72, 1]<br />
r = 16481*251 = 4136731 < 10000000<br />
output r<br />
with prob 4136731/10000000 ≈ 41%<br />
4136731, [16481, 251]
2.2 Polynomials over a field<br />
ApolynomialoverF p is specified by a finite sequence (a n ,a n−1 ,...,a 1 ,a 0 )of<br />
elements from F p ,witha n ≠0.Thenumbern is the degree of the polynomial.<br />
We have operations +, −, × on polynomials analogous to the similar integer<br />
operations. Addition and subtraction are performed componentwise using<br />
the addition + and subtraction − of the field F p .<br />
Products are computed by adding all the products of coefficients associated<br />
to pairs of exponents adding to a specific exponent.<br />
Example:<br />
(x 4 + x +1)× (x 3 + x 2 + x)<br />
= x 4 × (x 3 + x 2 + x)+x × (x 3 + x 2 + x)+1× (x 3 + x 2 + x)<br />
= (x 7 + x 6 + x 5 )+(x 4 + x 3 + x 2 )+(x 3 + x 2 + x)<br />
= x 7 + x 6 + x 5 + x 4 +(1+1)x 3 +(1+1)x 2 + x<br />
= x 7 + x 6 + x 5 + x 4 + x
We also have operations g(x) modh(x)(Maplemodpol, rem)andg(x) divh(x)<br />
Maple quo) defined as the unique polynomials r(x) andq(x) such that<br />
(x) =q(x)h(x) +r(x) withdeg(r)
2.2.1 Irreducible Polynomials<br />
Apolynomialg(x) isirreducible (Maple irreduc) ifitisnottheproductof<br />
two polynomials h(x),k(x) oflowerdegrees. Weusethefollowingtheorem<br />
to find irreducible polynomials.<br />
Theorem 2.6 Let l 1 ,l 2 ,...,l k be the prime factors of n and m i = n/l i for<br />
1 ≤ i ≤ k. Apolynomialg(x) of degree n is irreducible over F p iff<br />
• g(x)|x pn − x<br />
• gcd(g(x),x pm i<br />
− x) =1for 1 ≤ i ≤ k
F 2<br />
x +1 x 9 + x 4 +1<br />
x 2 + x +1 x 10 + x 3 +1<br />
x 3 + x +1 x 11 + x 2 +1<br />
x 4 + x +1 x 12 + x 6 + x 4 + x +1<br />
x 5 + x 2 +1 x 13 + x 4 + x 3 + x +1<br />
x 6 + x +1 x 14 + x 10 + x 6 + x +1<br />
x 7 + x 3 +1 x 15 + x +1<br />
x 8 + x 4 + x 3 + x 2 +1 x 16 + x 12 + x 3 + x +1<br />
Figure 1: Irreducible polynomials over F 2 .<br />
F 3 F 5 F 7<br />
x +1 x +1 x +1<br />
x 2 + x +2 x 2 + x +2 x 2 + x +3<br />
x 3 +2x +1 x 3 +3x +2 x 3 +3x +2<br />
x 4 + x +2 x 4 + x 2 + x +2<br />
x 5 +2x +1<br />
x 6 + x +2<br />
Figure 2: Irreducible polynomials over F 3 ,F 5 ,F 7 .
Algorithm 2.3 ( Rabin Irr(p, n) )<br />
1: let l 1 ,l 2 ,...,l k be the prime factors of n and m i = n/l i for 1 ≤ i ≤ k,<br />
2: REPEAT<br />
3: pick a random polynomial h(x) of degree n − 1 over F p ,andset<br />
g(x) ← x n + h(x),<br />
4: UNTIL x pn mod g(x) =x and<br />
gcd(g(x),x pm i<br />
mod g(x) − x) =1for 1 ≤ i ≤ k,<br />
5: RETURN g.<br />
We use the following theorem to estimate the number of polynomials we<br />
have to try on average before finding one that is irreducible.<br />
Theorem 2.7 Let m(n) be the number of irreducible polynomials g(x) of<br />
degree n of the form g(x) =x n + h(x) where h(x) is of degree n − 1. Wehave<br />
p n<br />
2n ≤ pn − p n/2 log n<br />
n<br />
≤ m(n) ≤ pn<br />
n .
2.3 General Fields<br />
Let p be a prime number and n apositiveinteger. Weconstructafieldwith<br />
p n elements (Maple GF) fromthebasisfieldF p with p elements.<br />
• The elements of F p n<br />
F p .<br />
are of the form a 1 a 2 ...a n where a i is an element of<br />
• The sum of two elements of F p n<br />
is defined by<br />
a 1 a 2 ...a n + b 1 b 2 ...b n = c 1 c 2 ...c n<br />
such that c i = a i + b i for 1 ≤ i ≤ n.<br />
• The product of two elements of F p n<br />
is defined by<br />
a 1 a 2 ...a n × b 1 b 2 ...b n = c 1 c 2 ...c n<br />
such that<br />
(c 1 x n−1 + c 2 x n−2 + ... + c n )=<br />
(a 1 x n−1 + a 2 x n−2 + ... + a n ) × (b 1 x n−1 + b 2 x n−2 + ... + b n )modr(x)<br />
where r(x) isanirreduciblepolynomialofdegreen over F p .
Examples computations over F 2 5<br />
10011 + 01110 = (1 + 0)(0 + 1)(0 + 1)(1 + 1)(1 + 0) = 11101<br />
+ 000 001 010 011 100 101 110 111<br />
000 000 001 010 011 100 101 110 111<br />
001 001 000 011 010 101 100 111 110<br />
010 010 011 000 001 110 111 100 101<br />
011 011 010 001 000 111 110 101 100<br />
100 100 101 110 111 000 001 010 011<br />
101 101 100 111 110 001 000 011 010<br />
110 110 111 100 101 010 011 000 001<br />
111 111 110 101 100 011 010 001 000<br />
addition of F23
10011×01110 = 01001 since (x 4 +x+1)×(x 3 +x 2 +x) mod(x 5 +x 2 +1) =<br />
x 3 +1.<br />
× 000 001 010 011 100 101 110 111<br />
000 000 000 000 000 000 000 000 000<br />
001 000 001 010 011 100 101 110 111<br />
010 000 010 100 110 011 001 111 101<br />
011 000 011 110 101 111 100 001 010<br />
100 000 100 011 111 110 010 101 001<br />
101 000 101 001 100 010 111 011 110<br />
110 000 110 111 001 101 011 010 100<br />
111 000 111 101 010 001 110 100 011<br />
multiplication of F23<br />
Figure 3: operations of F 2 3
COMP-547A<br />
/B<br />
Cryptography and Data Security<br />
Lecture 01 02-06<br />
Prof. Claude Crépeau<br />
School of Computer Science<br />
<strong>McGill</strong> <strong>University</strong>
EXTRA SLIDES
1.4.5 ∗∗∗ Extracting Square Roots modulo p e<br />
If we have a solution r to r 2 ≡ a (mod p), how do we find a solution s to<br />
s 2 ≡ a (mod p e )fore>1<br />
The chinese remainder theorem does not apply here. We have to figure<br />
things out in a different way.
First, consider the case e =2. Sincer 2 ≡ a (mod p), there exists an<br />
integer m =(r 2 − a)/p such that r 2 − a = mp. Supposethesolutionmodp 2<br />
is of the form s = r + kp for some integer k. Let’sexpands 2 :<br />
and therefore<br />
s 2 =(r + kp) 2 = r 2 +2rkp +(kp) 2 = mp + a +2rkp +(kp) 2<br />
s 2 ≡ a +(m +2rk) ∗ p (mod p 2 ).<br />
We find a solution s by making m +2rk amultipleofp so that<br />
(m +2rk) ∗ p ≡ 0 (mod p 2 ).
The following value of k will acheive our goal<br />
k ≡−m ∗ (2r) −1 (mod p)<br />
and thus remembering s = r + kp we get<br />
s = r − (m ∗ (2r) −1 mod p) ∗ p<br />
and finally remembering m =(r 2 − a)/p we obtain a solution<br />
s = r +(a − r 2 ) ∗ ((2r) −1 mod p).
Second, notice that the same exact reasoning allows to go from thecase<br />
p e to the case p 2e ,meaningthatanysolutionr to r 2 ≡ a (mod p e ), can be<br />
transformed to a solution s = r + kp e of s 2 ≡ a (mod p 2e ).<br />
Using this argument i times allows to start from a solution r to r 2 ≡ a<br />
(mod p), and find a solution s to s 2 ≡ a (mod p 2i ).<br />
Finally, to solve the general problem where e is not necessarily a power<br />
of 2, let i be the smallest integer such that 2 i ≥ e. From a solution r to<br />
r 2 ≡ a (mod p), find a solution to s 2 ≡ a (mod p 2i )andsincep e |p 2i this<br />
same solution s will also work mod p e .
2.4 Application of finite fields: Secret Sharing<br />
ApolynomialoverF q is specified by a finite sequence (a n ,a n−1 ,...,a 1 ,a 0 )of<br />
elements from F q ,witha n ≠0.Thenumbern is the degree of the polynomial.<br />
Theorem 2.8 (Lagrange’s Interpolation) Let x 0 ,x 1 ,...,x d be distinct elements<br />
of a field F q and y 0 ,y 1 ,...,y d be any elements of F q . There exists a<br />
unique polynomial p(x) over F q with degree ≤ d such that p(x i )=y i for<br />
1 ≤ i ≤ n.<br />
Algorithm 2.4 ( Interpolation(x 0 ,x 1 ,...,x d ,y 0 ,y 1 ,...,y d ) )<br />
1: return<br />
⎛<br />
⎜<br />
⎝<br />
1 x 0 ... x d 0<br />
1 x 1 ... x d 1<br />
.<br />
. . .. .<br />
1 x d ... x d d<br />
⎞<br />
⎟<br />
⎠<br />
−1 ⎛<br />
⎜<br />
⎝<br />
⎞<br />
y 0<br />
y 1<br />
⎟<br />
. ⎠<br />
y d<br />
Adi Shamir<br />
Of course the matrix inversion is to be performed over F q ,whichmeansall<br />
additions, subtractions and multiplications are calculated within the field,<br />
and divisions are performed by multiplying with the multiplicative inverse in<br />
the field.
Suppose Alice wants to distribute a secret S among n people P 1 ,P 2 ,...,P n<br />
in such a way that any k of them can recover the secret from their joint information,<br />
while it remains perfectly secret when any k − 1orlessofthem<br />
get together. This is what we call a [n, k]-secret sharing scheme.<br />
Algorithm 2.5 ( SSSS(S) )<br />
1: a 0 ← S,<br />
2: FOR i := 1 TO k − 1 DO a i ← uniform(0..p − 1)<br />
3: FOR j := 1 TO n DO s i ← a k−1 j k−1 + ...+ a 1 j + a 0 mod p<br />
4: RETURN s 1 ,s 2 ,...,s n .
Let’s be a bit more formal. Let S be Alice’s secret from the finite set<br />
{0, 1, 2,...,M} and let p be a prime number greater than M and n, the<br />
number of share holders. Shamir’s construction of a [n, k]-secret sharing<br />
scheme is as follows.<br />
Share s j is given to P j secretly by Alice. In order to find S, k or more<br />
people may construct the matrix from Lagrange’s theorem from thedistinct<br />
values x j = j and find the unique (a 0 ,a 1 ,...,a k−1 )correspondingtotheir<br />
values y j = s j .<br />
Theorem 2.9 For 0 ≤ m ≤ n, distinctj 1 ,j 2 ,...,j m and any s j1 ,s j2 ,...,s jm<br />
S|[j 1 ,s j1 ], [j 2 ,s j2 ],...,[j m ,s jm ]=<br />
{ C if m ≥ k<br />
U if m
Algorithm 2.6 ( Solve(x 1 ,x 2 ,...,x m ,s 1 ,s 2 ,...,s m ) )<br />
⎛<br />
⎜<br />
⎝<br />
1 x 1 ... x k+d<br />
1 −s 1 ... −s 1 x k−1<br />
1<br />
1 x 2 ... x k+d<br />
2 −s 2 ... −s 2 x2<br />
k−1<br />
.<br />
. . .. .<br />
. . .. .<br />
. .<br />
. .. . .<br />
. .. .<br />
1 x i ... x k+d<br />
i<br />
−s i ... −s i x k−1<br />
i<br />
.<br />
. . .. .<br />
. . .. .<br />
. .<br />
. .. . .<br />
. .. .<br />
1 x m ... xm k+d −s m ... −s m x k m<br />
⎞<br />
⎟<br />
⎠<br />
⎛<br />
⎜<br />
⎝<br />
⎞<br />
n 0<br />
n 1<br />
.<br />
.<br />
n k+d<br />
w 0<br />
w 1<br />
⎟<br />
. ⎠<br />
w k−1<br />
=<br />
⎛<br />
⎜<br />
⎝<br />
s 1 x k 1<br />
s 2 x k 2<br />
.<br />
.<br />
s i x k i<br />
.<br />
.<br />
s m x k m<br />
⎞<br />
⎟<br />
⎠