Pseudorandom Sequence Generation
|
|
- Ross Heath
- 5 years ago
- Views:
Transcription
1 YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467a: Crytograhy and Comuter Security Handout #21 Professor M. J. Fischer November 29, 2005 Pseudorandom Seuence Generation 1 Distinguishability and Bit Prediction Let D be a robability distribution on a finite set Ω. Then D associates a robability P D (ω) with each each element ω Ω. We will also regard D as a random variable that ranges over Ω and assumes value ω Ω with robability P D (ω). Definition: An (S, l)-seudorandom seuence generator (PRSG) is a function f: S 0, 1} l. (We generally assume 2 l S.) More roerly seaking, a PRSG is a randomness amlifier. Given a random, uniformly distributed seed s S, the PRSG yields the seudorandom seuence z = f(s). We use S also to denote the uniform distribution on seeds, and we denote the induced robability distribution on seudorandom seuences by f(s). The goal of an (S, l)-prsg is to generate seuences that look random, that is, are comutationally indistinguishable from seuences drawn from the uniform distribution U on length-l seuences. Informally, a robabilistic algorithm A that always halts distinguishes X from Y if its outut distribution is noticeably differently deending whether its inut is drawn at random from X or from Y. Formally, there are many different kinds of distinguishably. In the following definition, the only asect of A s behavior that matters is whether or not it oututs 1. Definition: Let ɛ > 0, let X, Y be distributions on 0, 1} l, and let A be a robabilistic algorithm. Algorithm A naturally induces robability distributions A(X) and A(Y ) on the set of ossible outcomes of A. We say that A ɛ-distinguishes X and Y if rob[a(x) = 1] rob[a(y ) = 1] ɛ, and we say X and Y are ɛ-indistinguishable by A if A does not distinguish them. A natural notion of randomness for PRSG s is that the next bit should be unredictable given all of the bits that have been generated so far. Definition: Let ɛ > 0 and 1 i l. A robabilistic algorithm N i is an ɛ-next bit redictor for bit i of f if rob[n i (Z 1,..., Z i 1 ) = Z i ] ɛ where (Z 1,..., Z l ) is distributed according to f(s). A still stronger notion of randomness for PRSG s is that each bit i should be unredictable, even if one is given all of the bits in the seuence excet for bit i. Definition: Let ɛ > 0 and 1 i l. A robabilistic algorithm B i is an ɛ-strong bit redictor for bit i of f if rob[b i (Z 1,..., Z i 1, Z i+1,..., Z l ) = Z i ] ɛ where (Z 1,..., Z l ) is distributed according to f(s).
2 2 Pseudorandom Seuence Generation The close relationshi between distinguishability and the two kinds of bit rediction is established in the following theorems. Theorem 1 Suose ɛ > 0 and N i is an ɛ-next bit redictor for bit i of f. Then algorithm B i is an ɛ-strong bit redictor for bit i of f, where algorithm B i (z 1,..., z i 1, z i+1,..., z l ) simly ignores its last l i inuts and comutes N i (z 1,..., z i 1 ). Proof: Obvious from the definitions. Let x = (x 1,..., x l ) be a vector. We define x i to be the result of deleting the i th element of x, that is, x i = (x 1,..., x i 1, x i+1,..., x l ). Theorem 2 Suose ɛ > 0 and B i is an ɛ-strong bit redictor for bit i of f. Then algorithm A ɛ-distinguishes f(s) and U, where algorithm A on inut x oututs 1 if B i (x i ) = x i and oututs 0 otherwise. Proof: By definition of A, A(x) = 1 recisely when B i (x i ) = x i. Hence, rob[a(f(s)) = 1] 1/2 + ɛ. On the other hand, for r = U, rob[b i (r i ) = r i ] = 1/2 since r i is a uniformly distributed bivalued random variable that is indeendent of r i. Thus, rob[a(u) = 1] = 1/2, so A ɛ-distinguishes f(s) and U. For the final ste in the 3-way euivalence, we have to weaken the error bound. Theorem 3 Suose ɛ > 0 and algorithm A ɛ-distinguishes f(s) and U. For each 1 i l and c 0, 1}, define algorithm N c i (z 1,..., z i 1 ) as follows: 1. Fli coins to generate l i + 1 random bits r i,..., r l. 1 if A(z1,..., z 2. Let v = i 1, r i,..., r l ) = 1; 0 otherwise. 3. Outut v r i c. Then there exist m and c for which algorithm N c m is an ɛ/l-next bit redictor for bit m of f. Proof: Let (Z 1,..., Z l ) = f(s) and (R 1,..., R l ) = U be random variables, and let D i = (Z 1,..., Z i, R i+1,..., R l ). D i is the distribution on l-bit seuences that results from choosing the first i bits according to f(s) and choosing the last l i bits uniformly. Clearly D 0 = U and D l = f(s). Let i = rob[a(d i ) = 1], 0 i l. Since A ɛ-distinguishes D l and D 0, we have l 0 ɛ. Hence, there exists m, 1 m l, such that m m 1 ɛ/l. We show that the robability that N c m correctly redicts bit m for f is 1/2+( m m 1 ) if c = 1 and 1/2+( m 1 m ) if c = 0. It will follow that either N 0 m or N 1 m correctly redicts bit m with robability 1/2+ m m 1 ɛ/l. Consider the following exeriments. In each, we choose an l-tule (z 1,..., z l ) according to f(s) and an l-tule (r 1,..., r l ) according to U. Exeriment E 0 : Succeed if A(z 1,..., z m 1, z m, r m+1,..., r l ) = 1. Exeriment E 1 : Succeed if A(z 1,..., z m 1, z m, r m+1,..., r l ) = 1. Exeriment E 2 : Succeed if A(z 1,..., z m 1, r m, r m+1,..., r l ) = 1.
3 Handout #21 November 29, Let j be the robability that exeriment E j succeeds, where j = 0, 1, 2. Clearly 2 = ( )/2 since r m = z m is eually likely as r m = z m. Now, the inuts to A in exeriment E 0 are distributed according to D m, so m = 0. Also, the inuts to A in exeriment E 2 are distributed according to D m 1, so m 1 = 2. Differencing, we get m m 1 = 0 2 = ( 0 1 )/2. We now analyze the robability that N c m correctly redicts bit m of f(s). Assume without loss of generality that A s outut is in 0, 1}. A articular run of N c m(z 1,..., z m 1 ) correctly redicts z m if A(z 1,..., z m 1, r m,..., r l ) r m c = z m (1) If r m = z m, (1) simlifies to and if r m = z m, (1) simlifies to A(z 1,..., z m 1, z m,..., r l ) = c, (2) A(z 1,..., z m 1, z m,..., r l ) = c. (3) Let OK c m be the event that N c m(z 1,..., Z m 1 ) = Z m, i.e., that N c m correctly redicts bit m for f. From (2), it follows that rob[ok c m R m = Z m ] = 0 if c = 1 (1 0 ) if c = 0 for in that case the inuts to A are distributed according to exeriment E 0. Similarly, from (3), it follows that rob[ok c 1 if c = 1 m R m = Z m ] = (1 1 ) if c = 0 for in that case the inuts to A are distributed according to exeriment E 1. Since rob[r m = Z m ] = rob[r m = Z m ] = 1/2, we have rob[ok c m] = 1 2 rob[okc m R m = Z m ] rob[okc m R m = Z m ] = 0 /2 + (1 1 )/2 = 1/2 + m m 1 if c = 1 1 /2 + (1 0 )/2 = 1/2 + m 1 m if c = 0. Thus, rob[ok c m] = 1/2 + m m 1 ɛ/l for some c 0, 1}, as desired. 2 BBS Generator We now give a PRSG due to Blum, Blum, and Shub for which the roblem distinguishing its oututs from the uniform distribution is closely related to the difficulty of determining whether a number with Jacobi symbol 1 is a uadratic residue modulo a certain kind of comosite number called a Blum integer. The latter roblem is believed to be comutationally hard. First some background. A Blum rime is a rime number such that 3 (mod 4). A Blum integer is a number n =, where and are Blum rimes. Blum rimes and Blum integers have the imortant roerty that every uadratic residue a has a suare root y which is itself a uadratic residue. We call such a y a rincial suare root of a and denote it by a.
4 4 Pseudorandom Seuence Generation Lemma 4 Let be a Blum rime, and let a be a uadratic residue modulo. Then y = a (+1)/4 mod is a rincial suare root of a modulo. Proof: We must show that, modulo, y is a suare root of a and y is a uadratic residue. By the Euler criterion [Theorem 2, handout 15], since a is a uadratic residue modulo, we have a ( 1)/2 1 (mod ). Hence, y 2 (a (+1)/4 ) 2 aa ( 1)/2 a (mod ), so y is a suare root of a modulo. Alying the Euler criterion now to y, we have y ( 1)/2 Hence, y is a uadratic residue modulo. (a (+1)/4) ( 1)/2 ( a ( 1)/2) (+1)/4 1 (+1)/4 1 (mod ). Theorem 5 Let n = be a Blum integer, and let a be a uadratic residue modulo n. Then a has four suare roots modulo n, exactly one of which is a rincial suare root. Proof: By Lemma 4, a has a rincial suare root u modulo and a rincial suare root v modulo. Using the Chinese remainder theorem, we can find x that solves the euations x ±u (mod ) x ±v (mod ) for each of the four choices of signs in the two euations, yielding 4 suare roots of a modulo n. It is easily shown that the x that results from the +, + choice is a uadratic residue modulo n, and the others are not. From Theorem 4, it follows that the maing b b 2 mod n is a bijection from the set of uadratic residues modulo n onto itself. (A bijection is a function that is 1 1 and onto.) Definition: The Blum-Blum-Shub generator BBS is defined by a Blum integer n = and an integer l. It is a (Z n, l)-prsg defined as follows: Given a seed s 0 Z n, we define a seuence s 1, s 2, s 3,..., s l, where s i = s 2 i 1 mod n for i = 1,..., l. The l-bit outut seuence is b 1, b 2, b 3,..., b l, where b i = s i mod 2. Note that any s m uniuely determines the entire seuence s 1,..., s l and corresonding outut bits. Clearly, s m determines s m+1 since s m+1 = s 2 m mod n. But likewise, s m determines s m 1 since s m 1 = s m, the rincial suare root of s m modulo n, which is uniue by Theorem 5. 3 Security of BBS Theorem 6 Suose there is a robabilistic algorithm A that ɛ-distinguishes BBS(Z n) from U. Then there is a robabilistic algorithm Q(x) that correctly determines with robability at least ɛ = ɛ/l whether or not an inut x Z n with Jacobi symbol ( x n) = 1 is a uadratic residue modulo n. Proof: From A, one easily constructs an algorithm  that reverses its inut and then alies A.  ɛ-distinguishes the reverse of BBS(Z n) from U. By Theorem 3, there is an ɛ -next bit redictor N m for bit l m + 1 of BBS reversed. Thus, N m (b l, b l 1,..., b m+1 ) correctly oututs b m with robability at least 1/2 + ɛ, where (b 1,..., b l ) is the (unreversed) outut from BBS(Z n).
5 Handout #21 November 29, We now describe algorithm Q(x), assuming x Z n and ( x n) = 1. Using x as a seed, comute (b 1,..., b l ) = BBS(x) and let b = N m (b l m, b l m 1,..., b 1 ). Outut uadratic residue if b = x mod 2 and non-residue otherwise. To see that this works, observe first that N m (b l m, b l m 1,..., b 1 ) correctly redicts b 0 with robability at least 1/2+ɛ, where b 0 = ( x 2 mod n) mod 2. This is because we could in rincile let s m+1 = x 2 mod n and then work backwards defining s m = s m+1 mod n, s m 1 = s m mod n,..., s 0 = s 1 mod n. It follows that b 0,..., b l m are the last l m + 1 bits of BBS(s 0 ), and b 0 is the bit redicted by N m. Now, x and x are clearly suare roots of s m+1. We show that they both have Jacobi symbol 1. Since ( ( ) ( ) ( ) ( ) ( ) ( ) x n) = x x = 1, then either x = x = 1 or x = x = 1. But because ( ) ( ) and are Blum rimes, 1 is a uadratic non-residue modulo both and, so 1 = 1 = 1. It follows that ( ) x n = 1. Hence, x = ± sm+1, so exactly one of x and x is a uadratic residue. Since n is odd, x mod n and x mod n have oosite arity. Hence, x is a uadratic residue iff x and s m+1 have the same arity. But N m oututs s m+1 mod 2 with robability 1/2 + ɛ, so it follows that Q correctly determines the uadratic residuosity of its argument with robability 1/2 + ɛ.
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467a: Cryptography and Computer Security Notes 23 (rev. 1) Professor M. J. Fischer November 29, 2005 1 Oblivious Transfer Lecture Notes 23 In the locked
More informationJacobi symbols and application to primality
Jacobi symbols and alication to rimality Setember 19, 018 1 The grou Z/Z We review the structure of the abelian grou Z/Z. Using Chinese remainder theorem, we can restrict to the case when = k is a rime
More informationCPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 21 November 15, 2017 CPSC 467, Lecture 21 1/31 Secure Random Sequence Generators Pseudorandom sequence generators Looking random
More informationCS 6260 Some number theory. Groups
Let Z = {..., 2, 1, 0, 1, 2,...} denote the set of integers. Let Z+ = {1, 2,...} denote the set of ositive integers and = {0, 1, 2,...} the set of non-negative integers. If a, are integers with > 0 then
More informationMath 4400/6400 Homework #8 solutions. 1. Let P be an odd integer (not necessarily prime). Show that modulo 2,
MATH 4400 roblems. Math 4400/6400 Homework # solutions 1. Let P be an odd integer not necessarily rime. Show that modulo, { P 1 0 if P 1, 7 mod, 1 if P 3, mod. Proof. Suose that P 1 mod. Then we can write
More informationCPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 22 November 27, 2017 CPSC 467, Lecture 22 1/43 BBS Pseudorandom Sequence Generator Secret Splitting Shamir s Secret Splitting Scheme
More informationx 2 a mod m. has a solution. Theorem 13.2 (Euler s Criterion). Let p be an odd prime. The congruence x 2 1 mod p,
13. Quadratic Residues We now turn to the question of when a quadratic equation has a solution modulo m. The general quadratic equation looks like ax + bx + c 0 mod m. Assuming that m is odd or that b
More informationSQUARES IN Z/NZ. q = ( 1) (p 1)(q 1)
SQUARES I Z/Z We study squares in the ring Z/Z from a theoretical and comutational oint of view. We resent two related crytograhic schemes. 1. SQUARES I Z/Z Consider for eamle the rime = 13. Write the
More informationCryptanalysis of Pseudorandom Generators
CSE 206A: Lattice Algorithms and Alications Fall 2017 Crytanalysis of Pseudorandom Generators Instructor: Daniele Micciancio UCSD CSE As a motivating alication for the study of lattice in crytograhy we
More informationPrimes - Problem Sheet 5 - Solutions
Primes - Problem Sheet 5 - Solutions Class number, and reduction of quadratic forms Positive-definite Q1) Aly the roof of Theorem 5.5 to find reduced forms equivalent to the following, also give matrices
More informationYALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467a: Crytograhy ad Comuter Security Notes 16 (rev. 1 Professor M. J. Fischer November 3, 2008 68 Legedre Symbol Lecture Notes 16 ( Let be a odd rime,
More informationProbabilistic Algorithms
Probabilistic Algorithms Klaus Sutner Carnegie Mellon University Fall 2017 1 Some Probabilistic Algorithms Probabilistic Primality Testing RP and BPP Where Are We? 3 Examle 1: Order Statistics 4 We have
More informationRECIPROCITY LAWS JEREMY BOOHER
RECIPROCITY LAWS JEREMY BOOHER 1 Introduction The law of uadratic recirocity gives a beautiful descrition of which rimes are suares modulo Secial cases of this law going back to Fermat, and Euler and Legendre
More informationQUADRATIC RECIPROCITY
QUADRATIC RECIPROCIT POOJA PATEL Abstract. This aer is an self-contained exosition of the law of uadratic recirocity. We will give two roofs of the Chinese remainder theorem and a roof of uadratic recirocity.
More informationCERIAS Tech Report The period of the Bell numbers modulo a prime by Peter Montgomery, Sangil Nahm, Samuel Wagstaff Jr Center for Education
CERIAS Tech Reort 2010-01 The eriod of the Bell numbers modulo a rime by Peter Montgomery, Sangil Nahm, Samuel Wagstaff Jr Center for Education and Research Information Assurance and Security Purdue University,
More informationMath 104B: Number Theory II (Winter 2012)
Math 104B: Number Theory II (Winter 01) Alina Bucur Contents 1 Review 11 Prime numbers 1 Euclidean algorithm 13 Multilicative functions 14 Linear diohantine equations 3 15 Congruences 3 Primes as sums
More informationPseudo-random Number Generation. Qiuliang Tang
Pseudo-random Number Generation Qiuliang Tang Random Numbers in Cryptography The keystream in the one-time pad The secret key in the DES encryption The prime numbers p, q in the RSA encryption The private
More informationAdvanced Cryptography Midterm Exam
Advanced Crytograhy Midterm Exam Solution Serge Vaudenay 17.4.2012 duration: 3h00 any document is allowed a ocket calculator is allowed communication devices are not allowed the exam invigilators will
More informationPractice Final Solutions
Practice Final Solutions 1. True or false: (a) If a is a sum of three squares, and b is a sum of three squares, then so is ab. False: Consider a 14, b 2. (b) No number of the form 4 m (8n + 7) can be written
More informationt s (p). An Introduction
Notes 6. Quadratic Gauss Sums Definition. Let a, b Z. Then we denote a b if a divides b. Definition. Let a and b be elements of Z. Then c Z s.t. a, b c, where c gcda, b max{x Z x a and x b }. 5, Chater1
More informationLECTURE 10: JACOBI SYMBOL
LECTURE 0: JACOBI SYMBOL The Jcobi symbol We wish to generlise the Legendre symbol to ccomodte comosite moduli Definition Let be n odd ositive integer, nd suose tht s, where the i re rime numbers not necessrily
More informationWe collect some results that might be covered in a first course in algebraic number theory.
1 Aendices We collect some results that might be covered in a first course in algebraic number theory. A. uadratic Recirocity Via Gauss Sums A1. Introduction In this aendix, is an odd rime unless otherwise
More informationQuadratic Reciprocity
Quadratic Recirocity 5-7-011 Quadratic recirocity relates solutions to x = (mod to solutions to x = (mod, where and are distinct odd rimes. The euations are oth solvale or oth unsolvale if either or has
More informationA recipe for an unpredictable random number generator
Condensed Matter Physics 006, Vol. 9, No (46,. 367 37 A recie for an unredictable random number generator M.A.García-Ñustes, L.Trujillo, J.A.González Centro de Física, Instituto Venezolano de Investigaciones
More informationAlgebraic number theory LTCC Solutions to Problem Sheet 2
Algebraic number theory LTCC 008 Solutions to Problem Sheet ) Let m be a square-free integer and K = Q m). The embeddings K C are given by σ a + b m) = a + b m and σ a + b m) = a b m. If m mod 4) then
More informationCDH/DDH-Based Encryption. K&L Sections , 11.4.
CDH/DDH-Based Encrytion K&L Sections 8.3.1-8.3.3, 11.4. 1 Cyclic grous A finite grou G of order q is cyclic if it has an element g of q. { 0 1 2 q 1} In this case, G = g = g, g, g,, g ; G is said to be
More informationPOINTS ON CONICS MODULO p
POINTS ON CONICS MODULO TEAM 2: JONGMIN BAEK, ANAND DEOPURKAR, AND KATHERINE REDFIELD Abstract. We comute the number of integer oints on conics modulo, where is an odd rime. We extend our results to conics
More informationSplit the integral into two: [0,1] and (1, )
. A continuous random variable X has the iecewise df f( ) 0, 0, 0, where 0 is a ositive real number. - (a) For any real number such that 0, rove that the eected value of h( X ) X is E X. (0 ts) Solution:
More informationCryptography Assignment 3
Crytograhy Assignment Michael Orlov orlovm@cs.bgu.ac.il) Yanik Gleyzer yanik@cs.bgu.ac.il) Aril 9, 00 Abstract Solution for Assignment. The terms in this assignment are used as defined in [1]. In some
More informationON FREIMAN S 2.4-THEOREM
ON FREIMAN S 2.4-THEOREM ØYSTEIN J. RØDSETH Abstract. Gregory Freiman s celebrated 2.4-Theorem says that if A is a set of residue classes modulo a rime satisfying 2A 2.4 A 3 and A < /35, then A is contained
More informationExtension of Minimax to Infinite Matrices
Extension of Minimax to Infinite Matrices Chris Calabro June 21, 2004 Abstract Von Neumann s minimax theorem is tyically alied to a finite ayoff matrix A R m n. Here we show that (i) if m, n are both inite,
More informationHow does the computer generate observations from various distributions specified after input analysis?
1 How does the computer generate observations from various distributions specified after input analysis? There are two main components to the generation of observations from probability distributions.
More informationThe Jacobi Symbol. q q 1 q 2 q n
The Jacobi Symbol It s a little inconvenient that the Legendre symbol a is only defined when the bottom is an odd p prime You can extend the definition to allow an odd positive number on the bottom using
More informationMATH 371 Class notes/outline October 15, 2013
MATH 371 Class notes/outline October 15, 2013 More on olynomials We now consider olynomials with coefficients in rings (not just fields) other than R and C. (Our rings continue to be commutative and have
More informationEfficient Cryptosystems From 2 k -th Power Residue Symbols
Efficient Crytosystems From k -th Power Residue Symbols Fabrice Benhamouda, Javier Herranz, Marc Joye 3, and Benoît Libert 4, ENS Paris, CNRS, INRIA, and PSL 45 rue d Ulm, 7530 Paris Cedex 06, France fabrice.benhamouda@ens.fr
More informationEfficient Cryptosystems From 2 k -th Power Residue Symbols
Published in Journal of Crytology, 30(2:519 549, 2017. Efficient Crytosystems From 2 k -th Power Residue Symbols Fabrice Benhamouda 1, Javier Herranz 2, Marc Joye 3, and Benoît Libert 4, 1 ES Paris, CRS,
More informationModeling Chebyshev s Bias in the Gaussian Primes as a Random Walk
Modeling Chebyshev s Bias in the Gaussian Primes as a Random Walk Daniel J. Hutama July 18, 2016 Abstract One asect of Chebyshev s bias is the henomenon that a rime number,, modulo another rime number,,
More informationQuadratic Residues, Quadratic Reciprocity. 2 4 So we may as well start with x 2 a mod p. p 1 1 mod p a 2 ±1 mod p
Lecture 9 Quadratic Residues, Quadratic Recirocity Quadratic Congruence - Consider congruence ax + bx + c 0 mod, with a 0 mod. This can be reduced to x + ax + b 0, if we assume that is odd ( is trivial
More informationA CONCRETE EXAMPLE OF PRIME BEHAVIOR IN QUADRATIC FIELDS. 1. Abstract
A CONCRETE EXAMPLE OF PRIME BEHAVIOR IN QUADRATIC FIELDS CASEY BRUCK 1. Abstract The goal of this aer is to rovide a concise way for undergraduate mathematics students to learn about how rime numbers behave
More informationMATH 2710: NOTES FOR ANALYSIS
MATH 270: NOTES FOR ANALYSIS The main ideas we will learn from analysis center around the idea of a limit. Limits occurs in several settings. We will start with finite limits of sequences, then cover infinite
More informationMATH 361: NUMBER THEORY EIGHTH LECTURE
MATH 361: NUMBER THEORY EIGHTH LECTURE 1. Quadratic Recirocity: Introduction Quadratic recirocity is the first result of modern number theory. Lagrange conjectured it in the late 1700 s, but it was first
More informationComputer arithmetic. Intensive Computation. Annalisa Massini 2017/2018
Comuter arithmetic Intensive Comutation Annalisa Massini 7/8 Intensive Comutation - 7/8 References Comuter Architecture - A Quantitative Aroach Hennessy Patterson Aendix J Intensive Comutation - 7/8 3
More informationMATH 3240Q Introduction to Number Theory Homework 7
As long as algebra and geometry have been searated, their rogress have been slow and their uses limited; but when these two sciences have been united, they have lent each mutual forces, and have marched
More informationNotes for Lecture 25
U.C. Berkeley CS276: Cryptography Handout N25 Luca Trevisan April 23, 2009 Notes for Lecture 25 Scribed by Alexandra Constantin, posted May 4, 2009 Summary Today we show that the graph isomorphism protocol
More informationAlmost All Palindromes Are Composite
Almost All Palindromes Are Comosite William D Banks Det of Mathematics, University of Missouri Columbia, MO 65211, USA bbanks@mathmissouriedu Derrick N Hart Det of Mathematics, University of Missouri Columbia,
More informationPractice Final Solutions
Practice Final Solutions 1. Find integers x and y such that 13x + 1y 1 SOLUTION: By the Euclidean algorithm: One can work backwards to obtain 1 1 13 + 2 13 6 2 + 1 1 13 6 2 13 6 (1 1 13) 7 13 6 1 Hence
More informationOutline. EECS150 - Digital Design Lecture 26 Error Correction Codes, Linear Feedback Shift Registers (LFSRs) Simple Error Detection Coding
Outline EECS150 - Digital Design Lecture 26 Error Correction Codes, Linear Feedback Shift Registers (LFSRs) Error detection using arity Hamming code for error detection/correction Linear Feedback Shift
More informationCryptography. Lecture 8. Arpita Patra
Crytograhy Lecture 8 Arita Patra Quick Recall and Today s Roadma >> Hash Functions- stands in between ublic and rivate key world >> Key Agreement >> Assumtions in Finite Cyclic grous - DL, CDH, DDH Grous
More informationDegree in Mathematics
Degree in Mathematics Title: Gauss s roofs of the uadratic recirocity law Author: Anna Febrer Galvany Advisor: Jordi Quer Bosor Deartment: Matemàtica Alicada II Academic year: 01/013 Universitat Politècnica
More informationQUADRATIC RECIPROCITY
QUADRATIC RECIPROCITY JORDAN SCHETTLER Abstract. The goals of this roject are to have the reader(s) gain an areciation for the usefulness of Legendre symbols and ultimately recreate Eisenstein s slick
More informationMath 261 Exam 2. November 7, The use of notes and books is NOT allowed.
Math 261 Eam 2 ovember 7, 2018 The use of notes and books is OT allowed Eercise 1: Polynomials mod 691 (30 ts In this eercise, you may freely use the fact that 691 is rime Consider the olynomials f( 4
More informationMA257: INTRODUCTION TO NUMBER THEORY LECTURE NOTES 2018
MA257: INTRODUCTION TO NUMBER THEORY LECTURE NOTES 2018 J. E. CREMONA Contents 0. Introduction: What is Number Theory? 2 Basic Notation 3 1. Factorization 4 1.1. Divisibility in Z 4 1.2. Greatest Common
More informationQUADRATIC RECIPROCITY
QUADRATIC RECIPROCITY JORDAN SCHETTLER Abstract. The goals of this roject are to have the reader(s) gain an areciation for the usefulness of Legendre symbols and ultimately recreate Eisenstein s slick
More informationOn generalizing happy numbers to fractional base number systems
On generalizing hay numbers to fractional base number systems Enriue Treviño, Mikita Zhylinski October 17, 018 Abstract Let n be a ositive integer and S (n) be the sum of the suares of its digits. It is
More informationPublic Key Cryptosystems RSA
Public Key Crytosystems RSA 57 17 Receiver Sender 41 19 and rime 53 Attacker 47 Public Key Crytosystems RSA Comute numbers n = * 2337 323 57 17 Receiver Sender 41 19 and rime 53 Attacker 2491 47 Public
More informationTopic 7: Using identity types
Toic 7: Using identity tyes June 10, 2014 Now we would like to learn how to use identity tyes and how to do some actual mathematics with them. By now we have essentially introduced all inference rules
More informationHENSEL S LEMMA KEITH CONRAD
HENSEL S LEMMA KEITH CONRAD 1. Introduction In the -adic integers, congruences are aroximations: for a and b in Z, a b mod n is the same as a b 1/ n. Turning information modulo one ower of into similar
More information4. Score normalization technical details We now discuss the technical details of the score normalization method.
SMT SCORING SYSTEM This document describes the scoring system for the Stanford Math Tournament We begin by giving an overview of the changes to scoring and a non-technical descrition of the scoring rules
More informationPrime Reciprocal Digit Frequencies and the Euler Zeta Function
Prime Recirocal Digit Frequencies and the Euler Zeta Function Subhash Kak. The digit frequencies for rimes are not all equal. The least significant digit for rimes greater than 5 can only be, 3, 7, or
More informationNotes on Zero Knowledge
U.C. Berkeley CS172: Automata, Computability and Complexity Handout 9 Professor Luca Trevisan 4/21/2015 Notes on Zero Knowledge These notes on zero knowledge protocols for quadratic residuosity are based
More information#A64 INTEGERS 18 (2018) APPLYING MODULAR ARITHMETIC TO DIOPHANTINE EQUATIONS
#A64 INTEGERS 18 (2018) APPLYING MODULAR ARITHMETIC TO DIOPHANTINE EQUATIONS Ramy F. Taki ElDin Physics and Engineering Mathematics Deartment, Faculty of Engineering, Ain Shams University, Cairo, Egyt
More informationTHE DIOPHANTINE EQUATION x 4 +1=Dy 2
MATHEMATICS OF COMPUTATION Volume 66, Number 9, July 997, Pages 347 35 S 005-57897)0085-X THE DIOPHANTINE EQUATION x 4 +=Dy J. H. E. COHN Abstract. An effective method is derived for solving the equation
More informationLinear diophantine equations for discrete tomography
Journal of X-Ray Science and Technology 10 001 59 66 59 IOS Press Linear diohantine euations for discrete tomograhy Yangbo Ye a,gewang b and Jiehua Zhu a a Deartment of Mathematics, The University of Iowa,
More information16 The Quadratic Reciprocity Law
16 The Quadratic Recirocity Law Fix an odd rime If is another odd rime, a fundamental uestion, as we saw in the revious section, is to know the sign, ie, whether or not is a suare mod This is a very hard
More informationMobius Functions, Legendre Symbols, and Discriminants
Mobius Functions, Legendre Symbols, and Discriminants 1 Introduction Zev Chonoles, Erick Knight, Tim Kunisky Over the integers, there are two key number-theoretic functions that take on values of 1, 1,
More informationp-adic Measures and Bernoulli Numbers
-Adic Measures and Bernoulli Numbers Adam Bowers Introduction The constants B k in the Taylor series exansion t e t = t k B k k! k=0 are known as the Bernoulli numbers. The first few are,, 6, 0, 30, 0,
More informationVerifying Two Conjectures on Generalized Elite Primes
1 2 3 47 6 23 11 Journal of Integer Sequences, Vol. 12 (2009), Article 09.4.7 Verifying Two Conjectures on Generalized Elite Primes Xiaoqin Li 1 Mathematics Deartment Anhui Normal University Wuhu 241000,
More informationQuaternionic Projective Space (Lecture 34)
Quaternionic Projective Sace (Lecture 34) July 11, 2008 The three-shere S 3 can be identified with SU(2), and therefore has the structure of a toological grou. In this lecture, we will address the question
More informationThe Hasse Minkowski Theorem Lee Dicker University of Minnesota, REU Summer 2001
The Hasse Minkowski Theorem Lee Dicker University of Minnesota, REU Summer 2001 The Hasse-Minkowski Theorem rovides a characterization of the rational quadratic forms. What follows is a roof of the Hasse-Minkowski
More informationIntroduction to MVC. least common denominator of all non-identical-zero minors of all order of G(s). Example: The minor of order 2: 1 2 ( s 1)
Introduction to MVC Definition---Proerness and strictly roerness A system G(s) is roer if all its elements { gij ( s)} are roer, and strictly roer if all its elements are strictly roer. Definition---Causal
More informationAn Algebraic Framework for Pseudorandom Functions and Applications to Related-Key Security
An extended abstract of this aer aears in the Proceedings of the 35th Annual Crytology Conference (CRYPTO 2015), Part I, Rosario ennaro and Matthew Robshaw (Eds.), volume 9215 of Lecture Notes in Comuter
More informationHOMEWORK # 4 MARIA SIMBIRSKY SANDY ROGERS MATTHEW WELSH
HOMEWORK # 4 MARIA SIMBIRSKY SANDY ROGERS MATTHEW WELSH 1. Section 2.1, Problems 5, 8, 28, and 48 Problem. 2.1.5 Write a single congruence that is equivalent to the air of congruences x 1 mod 4 and x 2
More informationAN IMPROVED BABY-STEP-GIANT-STEP METHOD FOR CERTAIN ELLIPTIC CURVES. 1. Introduction
J. Al. Math. & Comuting Vol. 20(2006), No. 1-2,. 485-489 AN IMPROVED BABY-STEP-GIANT-STEP METHOD FOR CERTAIN ELLIPTIC CURVES BYEONG-KWEON OH, KIL-CHAN HA AND JANGHEON OH Abstract. In this aer, we slightly
More informationChapter 3. Number Theory. Part of G12ALN. Contents
Chater 3 Number Theory Part of G12ALN Contents 0 Review of basic concets and theorems The contents of this first section well zeroth section, really is mostly reetition of material from last year. Notations:
More informationCSE 599d - Quantum Computing When Quantum Computers Fall Apart
CSE 599d - Quantum Comuting When Quantum Comuters Fall Aart Dave Bacon Deartment of Comuter Science & Engineering, University of Washington In this lecture we are going to begin discussing what haens to
More informationMA3H1 Topics in Number Theory. Samir Siksek
MA3H1 Toics in Number Theory Samir Siksek Samir Siksek, Mathematics Institute, University of Warwick, Coventry, CV4 7AL, United Kingdom E-mail address: samir.siksek@gmail.com Contents Chater 0. Prologue
More informationMAT 311 Solutions to Final Exam Practice
MAT 311 Solutions to Final Exam Practice Remark. If you are comfortable with all of the following roblems, you will be very well reared for the midterm. Some of the roblems below are more difficult than
More informationCharacteristics of Fibonacci-type Sequences
Characteristics of Fibonacci-tye Sequences Yarden Blausa May 018 Abstract This aer resents an exloration of the Fibonacci sequence, as well as multi-nacci sequences and the Lucas sequence. We comare and
More informationISOSCELES TRIANGLES IN Q 3. Matt Noble Department of Mathematics, Middle Georgia State University, Macon, Georgia
#A9 INTEGERS 18 (2018) ISOSCELES TRIANGLES IN Q Matt Noble Deartment of Mathematics, Middle Georgia State University, Macon, Georgia matthew.noble@mga.edu Received: 7/2/17, Acceted: 2//18, Published: 2/19/18
More informationMATH342 Practice Exam
MATH342 Practice Exam This exam is intended to be in a similar style to the examination in May/June 2012. It is not imlied that all questions on the real examination will follow the content of the ractice
More informationExperimental Mathematics Publication details, including instructions for authors and subscription information:
This article was downloaded by: [Boston College], [Robert Gross] On: 09 December 20, At: 6:07 Publisher: Taylor & Francis Informa Ltd Registered in England and Wales Registered Number: 072954 Registered
More informationCPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 15 October 25, 2017 CPSC 467, Lecture 15 1/31 Primitive Roots Properties of primitive roots Lucas test Special form primes Functions
More informationBilinear Entropy Expansion from the Decisional Linear Assumption
Bilinear Entroy Exansion from the Decisional Linear Assumtion Lucas Kowalczyk Columbia University luke@cs.columbia.edu Allison Bisho Lewko Columbia University alewko@cs.columbia.edu Abstract We develo
More informationOn the Rank of the Elliptic Curve y 2 = x(x p)(x 2)
On the Rank of the Ellitic Curve y = x(x )(x ) Jeffrey Hatley Aril 9, 009 Abstract An ellitic curve E defined over Q is an algebraic variety which forms a finitely generated abelian grou, and the structure
More informationStatistics II Logistic Regression. So far... Two-way repeated measures ANOVA: an example. RM-ANOVA example: the data after log transform
Statistics II Logistic Regression Çağrı Çöltekin Exam date & time: June 21, 10:00 13:00 (The same day/time lanned at the beginning of the semester) University of Groningen, Det of Information Science May
More informationMA3H1 TOPICS IN NUMBER THEORY PART III
MA3H1 TOPICS IN NUMBER THEORY PART III SAMIR SIKSEK 1. Congruences Modulo m In quadratic recirocity we studied congruences of the form x 2 a (mod ). We now turn our attention to situations where is relaced
More informationOn The j-invariants of CM-Elliptic Curves Defined Over Z p
On The j-invariants of CM-Ellitic Curves Defined Over Z Andrew Fiori Deartment of Mathematics and Statistics, Queens University, Jeffery Hall, University Ave, Office 517, Kingston, ON, K7L 3N6, Canada
More informationAn Inverse Problem for Two Spectra of Complex Finite Jacobi Matrices
Coyright 202 Tech Science Press CMES, vol.86, no.4,.30-39, 202 An Inverse Problem for Two Sectra of Comlex Finite Jacobi Matrices Gusein Sh. Guseinov Abstract: This aer deals with the inverse sectral roblem
More informationAn Estimate For Heilbronn s Exponential Sum
An Estimate For Heilbronn s Exonential Sum D.R. Heath-Brown Magdalen College, Oxford For Heini Halberstam, on his retirement Let be a rime, and set e(x) = ex(2πix). Heilbronn s exonential sum is defined
More informationAVERAGES OF EULER PRODUCTS, DISTRIBUTION OF SINGULAR SERIES AND THE UBIQUITY OF POISSON DISTRIBUTION
AVERAGES OF EULER PRODUCTS, DISTRIBUTION OF SINGULAR SERIES AND THE UBIQUITY OF POISSON DISTRIBUTION EMMANUEL KOWALSKI Abstract. We discuss in some detail the general roblem of comuting averages of convergent
More informationCPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 8 February 1, 2012 CPSC 467b, Lecture 8 1/42 Number Theory Needed for RSA Z n : The integers mod n Modular arithmetic GCD Relatively
More informationEvaluating Circuit Reliability Under Probabilistic Gate-Level Fault Models
Evaluating Circuit Reliability Under Probabilistic Gate-Level Fault Models Ketan N. Patel, Igor L. Markov and John P. Hayes University of Michigan, Ann Arbor 48109-2122 {knatel,imarkov,jhayes}@eecs.umich.edu
More informationHASSE INVARIANTS FOR THE CLAUSEN ELLIPTIC CURVES
HASSE INVARIANTS FOR THE CLAUSEN ELLIPTIC CURVES AHMAD EL-GUINDY AND KEN ONO Astract. Gauss s F x hyergeometric function gives eriods of ellitic curves in Legendre normal form. Certain truncations of this
More informationA NOTE ON A YAO S THEOREM ABOUT PSEUDORANDOM GENERATORS
A NOTE ON A YAO S THEOREM ABOUT PSEUDORANDOM GENERATORS STÉPHANE BALLET AND ROBERT ROLLAND Abstract. The Yao s theorem gives an equivalence between the indistinguishability of a pseudorandom generator
More informationCPSC 467b: Cryptography and Computer Security
Outline Quadratic residues Useful tests Digital Signatures CPSC 467b: Cryptography and Computer Security Lecture 14 Michael J. Fischer Department of Computer Science Yale University March 1, 2010 Michael
More informationEötvös Loránd University Faculty of Informatics. Distribution of additive arithmetical functions
Eötvös Loránd University Faculty of Informatics Distribution of additive arithmetical functions Theses of Ph.D. Dissertation by László Germán Suervisor Prof. Dr. Imre Kátai member of the Hungarian Academy
More informationRobust hamiltonicity of random directed graphs
Robust hamiltonicity of random directed grahs Asaf Ferber Rajko Nenadov Andreas Noever asaf.ferber@inf.ethz.ch rnenadov@inf.ethz.ch anoever@inf.ethz.ch Ueli Peter ueter@inf.ethz.ch Nemanja Škorić nskoric@inf.ethz.ch
More informationAlmost 4000 years ago, Babylonians had discovered the following approximation to. x 2 dy 2 =1, (5.0.2)
Chater 5 Pell s Equation One of the earliest issues graled with in number theory is the fact that geometric quantities are often not rational. For instance, if we take a right triangle with two side lengths
More informationANALYTIC NUMBER THEORY AND DIRICHLET S THEOREM
ANALYTIC NUMBER THEORY AND DIRICHLET S THEOREM JOHN BINDER Abstract. In this aer, we rove Dirichlet s theorem that, given any air h, k with h, k) =, there are infinitely many rime numbers congruent to
More informationc 2007 Society for Industrial and Applied Mathematics
SIAM J. COMPUT. Vol. 37, No. 1,. 83 111 c 2007 Society for Industrial and Alied Mathematics A PROBABILISTIC STUDY ON COMBINATORIAL EXPANDERS AND HASHING PHILLIP G. BRADFORD AND MICHAEL N. KATEHAKIS Abstract.
More information