2.2 Inverses and GCDs

Transcription

1 34 CHAPTER 2. CRYPTOGRAPHY AND NUMBER THEORY 2.2 Inverses and GCDs Inverses mod p In the last section we explored the multiplication in Z n. We saw in the special case with n =12 and a = 4 that if we used multiplication by a mod n to encrypt a message, then our receiver would need to be able to solve, for x, the equation a n x = b in order to decode a received message b. In the end of section exercises there are exercises that show that with some values of n the solution of equations of the form a n x = b has a unique solution, while for other values of n we could have equations with no solutions, or equations with more than one solution. Notice that if n = mk, then the equation m n x = 0 will always have at least the two solutions, k and 0. Thus if we want the equation a n x = b to have a unique solution in Z n for every a 0,thenn must be a prime number. If you experimented with the prime numbers 5, 7, and 11 in the last set of problems (and if you didn t, now would be a great time to do so), you probably recognized that what is relevant for solving the equation a n x = b is the question of whether a has a multiplicative inverse in Z n, that is, whether there is another number a such that a n a =1. Ifa does have the inverse a, then the unique solution to the equation a n x = b is a n b. Once we realize this, we find it relatively easy to make computations that convince us of that every nonzero element in Z 5, Z 7, and Z 11 does have a multiplicative inverse, so every equation of the form a n x = b (with a 0) does have a unique solution. The evidence we have for p = 5, 7, and 11 suggests that whenever p is a prime then every nonzero elemnet of Z p has an inverse in Z p, and therefore every equation of the form a p x = b (with a 0) has a unique solution. This leads us to focus on trying to show that for each prime p, each element of Z p has a multiplicative inverse. Thus we are interested in showing that for each nonzero a in Z p, the equation a p x =1 has a solution. What does this equation mean, though? We can re-express it as ax 1 (mod p). or This means that ax 1 is a multiple of p, so that there is some integer y such that ax 1 =py, ax py =1. (2.8) It appears this is no help; we have converted the problem of solving (in Z p ) the equation a p x = 1, an equation with just one variable x (that could only have p 1 different values), to a problem of solving Equation 2.8, which has two variables. Further, in this second equation, y can take on any integer value. This seems to have made our work harder, not easier. In fact, the greatest common divisor algorithm, first introduced by Euclid, helps us find x and y. We will discuss this algorithm later in this section.

2 2.2. INVERSES AND GCDS Greatest Common Divisors (GCD) Suppose m is not a prime, and a and x are integers such that a m x =1inZ m.what equation involving m in the integers does this give us? Suppose that a and m are integers such that ax my = 1, for some integers x and y. What does that tell us about being able to find a (multiplicative) inverse for a (mod m)? If ax my =1,cana and m have any common divisors? In Exercise we saw that if the equation a m x =1 has a solution, then there is a number y such that ax my =1. In Exercise 2.2-2, we saw that if x and y are integers such that ax my =1,thenax 1isa multiple of m, andsox is a multiplicative inverse of a in Z m. Thus we have actually proved the following: Theorem Anumbera has a multiplicative inverse in Z m if and only if there are integers x and y such that ax my =1. In Exercise 2.2-3, we saw that, given a and m, if we can find integers x and y such that ax my = 1, then there are no common integer divisors to a and m except for 1 and -1. We say that the greatest common divisor of a and m is 1. In general, the greatest common divisor of two numbers k and n is the largest number d that is a factor of both k and j. 2 We denote the greatest common divisor of k and j by gcd(i, j). One of the important tools in understanding greatest common divisors is Euclid s division theorem, a result which we also used in the last section. While it appears obvious, as do many theorems in number theory, it follows from simpler principles of number theory, and the proof helps us understand how the greatest common divisor algorithm works. Thus we present a proof here. Lemma (Euclid s division theorem). If k and n are positive integers, then there are nonnegative integers q and r with r<nsuch that k = qn + r. Proof: To prove this Lemma, assume instead, for purposes of contradiction, that it is false. Among all pairs (k, n) that make it false, choose the smallest k that makes it false. We cannot have k<nbecause then the statement would be true with q = 0, and we cannot have k = n because then the statement is true with q =1andr = 0. This means k n is a positive number smaller than k, and so there must exist a q and r such that k n = qn + r, with 0 r<n. 2 There is one common factor of k and j for sure, namely 1. No common factor can be larger than the smaller of k and j in absolute value, and so there must be a largest common factor.

3 36 CHAPTER 2. CRYPTOGRAPHY AND NUMBER THEORY Thus k =(q +1)n + r, contradicting the assumption that the statement is false, so the only possibility is that the statement is true. The proof technique used here is known as proof by smallest counterexample. In this method, you assume, as in all proofs by contradiction, that the lemma is false. This implies that there must be a counterexample which does not satisfy the conditions of the lemma. In this case that counterexample consists of numbers k and n such that no q and r exists which satisfy k = qn+ r. Further, if there are counterexamples, then there must be on that is smallest in some sense. (Here being smallest means having the smallest k.) We choose this smallest one, and then reason that if it exists, then there must actually be an even smaller one, which creates the contradiction. As we will see later in the course, this method is actually closely related to proof by induction and to recursive algorithms. In essence, the proof of Lemma describes a recursive program to find q and r in the Lemma above so that r<n. The connection with greatest common divisors appears in the following lemma. Lemma If k, q, n, andr are positive integers such that k = nq + r then gcd(k, n) = gcd(k, r). Proof: If d is a factor of k and n, then there are integers i 1 and i 2 so that k = i 1 d and n = i 2 d. Thus d is also a factor of r = n kq = i 2 d i 1 dq =(i 2 i 1 q)d. Similarly, if d is a factor of n and r, then it is a factor of k = nq + r. Thus the greatest common divisor of k and n is a factor of the greatest common divisor of k and r, and vice versa, so they must be equal. This reduces our problem of finding gcd(k, n) to the simpler (in an recursive sense) problem of finding gcd(k, r) The GCD Algorithm Write a recursive algorithm to find gcd(k, n). Use it (by hand) to find the GCD of 252 and 189. Our algorithm for Exercise is based on Lemmma and the observation that if k = nq, for any q, thenn =gcd(k, n). It is convenient to assume that n k, soifthisisnotthecase,we exchange k and n. Wefirstchecktoseeifthereisaq such that k = nq, in which case we return n as the greatest common divisor. Otherwise we first write k = nq + r in the usual way. Second, we apply our algorithm to find the greatest common divisor of n and r. Third, we return the result as the greatest common divisor of k and n. By analyzing our process in a bit more detail, we will be able to return not only the greatest common divisor, but also numbers x and y such that gcd(k, n) =kx + ny. 3 In the case that k = nq and we want to return n as our greatest common divisor; we also want to return 0 for the value of x and 1 for the value of y. Suppose we are now in the case that 3 We could use fix things so that gcd(k, n) =kx ny as we want for use above, but we have chosen to use the traditional equation with the plus sign to avoid confusing the reader who consults other texts. The negative of the y we get here will be the y we wanted earlier.

4 2.2. INVERSES AND GCDS 37 that k = nq + r with 0 <r<n. Then we recursively compute gcd(n, r) and in the process get an x and a y such that gcd(n, r) =nx + ry.sincer = k nq, we get by substitution that gcd(n, r) =nx +(k nq)y = ky + n(x qy ). Thus when we return gcd(n, r) asgcd(k, n), we want to return the x value as y and the y value as x qy. Finally, if we exchanged k and n to begin our process, we exchange the x and y values that were returned, and we have our greatest common divisor and our x and y with gcd(k, n) =kx + ny. We will refer to the process we just described as Euclid s extended GCD algorithm. We give an example of the computation of gcd(24, 14). gcd(k, n) q r x y gcd(24, 14) gcd(14, 10) gcd(10, 4) gcd(4, 2) In a row, the q and r values are computed from the k and n values. Then the n and r are passed down to the next row and k and n respectively. This process continues until we finally reach a case where k = qn and we can answer q for the gcd. Once we have done this, we can then compute x and y going up. In the bottom row, we have that x =0andy = 1. Then, letting x and y denote the values from the row below, we compute x and y for a row by setting x to y and y to x qy. We note that in every row, we have the property that kx + ny =gcd(k, n). Theorem Two positive integers k and n have greatest common divisior 1 if and only if there are integers x and y such that kx + ny=1. Proof: We see, as earlier that if there are integers x and y such that kx + ny =1,then gcd(k, n) = 1, because any common factor of k and n would have to be a factor of 1, and so 1 and 1 are the only possible common factors. (This proves the if part of the theorem.) On the other hand, we just showed above that given positive integers k and n, thereare integers x and y such that gcd(k, n) =kx+ ny. Therefore gcd(k, n) = 1 only if there are integers x and y such that kx + ny =1. Corollary gcd(a, m) =1if and only if there are integers x and y such that ax my =1. Proof: negative. We use the theorem with k = a and n = m, and then replace the y we get with its

5 38 CHAPTER 2. CRYPTOGRAPHY AND NUMBER THEORY Corollary For any positive integer m, anelementa of Z m has an inverse if and only if gcd(a, m) =1. In fact, we find the multiplicative inverse by finding the x and y in Corollary by Euclid s extended GCD algorithm, and thenx is the inverse. Exercises E2.2-1 Bob and Alice want to choose a key they can use for cryptography, but all they have to communicate is a phone line bugged by Eve. Bob proposes that he and Alice each choose a secret number, a for Alice and b for Bob. They also choose, over the phone, a prime number p with more digits than any key they want to use, and one more number q. Bob will send Alice bq (mod p), and Alice will send Bob aq (mod p). Thus, Eve will know p, q, bq mod p, andaq mod p. Their key (which they want to keep secret) will then be abq (modp), which each of them, but hopefully not Eve, is able to compute. (Here we don t worry about the details of how they use their key, only with how they choose it.) As Bob explains, Eve will know neither a nor b, so their key should be safe. Alice says You know, the scheme sounds good, but wouldn t it be more complicated for Eve if I send you q a (mod p), you send me q b (mod p) and we use q ab (mod p) as our key? What do you think? In particular, for each of the two schemes, what are the most computationally efficient methods you can think of: (a) for Alice and Bob to figure out the secret key, and (b) for Eve to figure out the secret key. E2.2-2 Write pseudocode for the extended GCD algorithm. E2.2-3 Use Euclid s extended GCD algorithm to compute the multiplicative inverse of 16 modulo 103. E2.2-4 The Fibonacci numbers F are defined as follows: { 1 if i is 1 or 2 F i = F i 1 + F i 2 otherwise. What happens when you run Euclid s extended GCD algorithm on F i and F i 1.(We are asking about the execution of the algorithm, not just the answer. E2.2-5 Write and implement a program to implement Euclid s extended GCD algorithm. Be sure to return x and y in addition to the GCD. What is the running time of your algorithm? Hand in some sample runs. E2.2-6 The least common multiple of two numbers x and y is the smallest number z such that z is an integer multiple of both x and y. Give a formula for the least common multiple that involves the GCD.