The RSA Encryption/Decryption method is based on the Euler's and Fermat's Theorem

Transcription

1 1 RSA method and Number Theory The RSA Encryption/Decryption method is based on the Euler's and Fermat's Theorem in number theory. The original task of number theory was the investigation of the properties of the integers. Its systematic development as a branch of mathematics came rather late. Individual results were known in antiquity, for example to Euclid (about 300 B.C.). and Diophantos (about 250 A.D.). In the 17th century, remarkable discoveries of scientic signicance occurred, above all, in the investigations of Pierre Fermat ( ). Great steps forward were taken in the many works of Leonhard Euler ( ). At last Carl Friedrich Gauss ( ) set up a uniform theory. 1.1 Theorems of Euler and Fermat Let p be a prime number. Euler's theorem: a (m) 1(mod m) when(a m) =1 In the special case when m = p, this becomes Fermat's theorem: a p;1 1(mod p), when a is not divisible by p. 2 Residue Class One says that a b(mod m) (read: a congruent tob modulo m) if a ; b is a multiple of m. Given a set of numbers R, R can be divided into disjoint residue classes mod m. For example, 2 5(mod 3) 18 ;2(mod 5) because 18 - (-2) = 20 is divisible by 5. We can dene a multiplication of residue classes. Let r 1 be the residue class 2 mod 6 consisting of the numbers , -4, 2, 8, 14,... Let r 2 be the residue class 5 mod 6 consisting of the numbers... -7, -1, 5, 11,... The product is dened by 2 5 = 10 = 4. 1

2 3 Prime Residue Class Notation: Let a b be two integers, we denote the greatest common divisor of a and b by (a,b). Denition: Wesay that a and b are relatively prime if (a b) = 1. That is, a is prime to b, and vice versa. By selecting from the m distinct residue classes ::: m ; 1mod m all those whose numbers are prime to m, one obtains the prime residue classes mod m. For m = 6 there are two prime residue classes 1 and5 for m = p, there are always p ; 1, namely 1 2 ::: p ; 1. The number of prime residue classes mod m is denoted by (m). For example (6) = 2, f1, 5 g (p) = p ; 1. If p and q are two prime numbers, (p q) =(p)(q) =(p ; 1)(q ; 1) = pq ; (p + q)+1. For example (6) = (2)(3) = 1 2 = 2 (15) = (3)(5) = 2 4 = 8 f 1, 2, 4, 7, 8, 11, 13, 14 g f1,..., 15 g - f 3, 6, 9, 12, 15 g - f 5, 10, 15 g 4 Some Lemmas Lemma 1: Ifa b(mod m) andc d(mod m) thenac bd(mod m) Proof: There exists integers y and z such that a = ym + b c = zm + d ac = (ym + b)(zm + d) = ymzm + ymd + zmb + bd = xm + bd 2

3 where x is an integer. Lemma 2: Ifax ay(mod m) and (a,m) = 1, then x y(mod m). Proof: There exists an integer z where ax = zm + ay a(x ; y) = zm since (a m) =1 m does not divide a exactly. therefore m must divide (x ; y) exactly. Therefore, there exists integer z 0 where x ; y = z 0 m x = z 0 m + y Hence x y(mod m) Lemma 3: Let (a, m) = 1. Let r 1 r 2 ::: r (m) be the prime residue classes module m. Then ar 1 ar 2 ::: ar (m) also denotes the prime residue classes module m. Proof: If (a, m ) = 1, and (r i m) = 1, then (ar i m) = 1, since no proper factor of m is a proper factor of a or r i. There are the same number of ar 1 ar 2 ::: ar (m) as of r 1 r 2 ::: r (m). Therefore we need only show that ar i 6 ar j (mod m) ifi 6= j. From Lemma 2, we know that ar i ar j (mod m) implies r i r j (mod m) and hence i = j. 3

4 5 Euler's Theorem Euler's Theorem: If (a,m) = 1, then Proof: a (m) 1(mod m) Let r 1 r 2 ::: r (m) be the prime residue classes mod m. Then,by Lemma 3, ar 1 ar 2 ::: ar (m) also denotes the prime residue classes modulo m. hence corresponding to each r i there is one and one only ar j such thatr i ar j (mod m). Furthermore, dierent r i will have dierent corresponding ar j. From Lemma 1, we can multiply these and obtain, and hence (m) j=1 (ar j ) (m) i=1 (r i ) (mod m) a (m) (m) j=1 (r j ) (m) i=1 (r i ) (mod m) Since (r i m) = 1, we can use Lemma 2 to cancel the r j and we obtain a (m) 1(mod m) 6 Application to the RSA protocol From the above theorem, we see that for all M such that p does not divide M,i.e.(p M) =1, M p;1 1(mod p) (1) Consider M k(p;1)(q;1)+1 M k(p;1)(q;1)+1 = M M p;1 k(q;1) (2) M(mod p) (3) M k(p;1)(q;1)+1 = k 1 p + M (4) 4

5 Note that the above is trivially true when M 0(mod p), so that this equivality is actually true for all M. Similarly, for all M such thatq does not divide M, i.e.(q M) =1, M q;1 1(mod q) (5) M k(p;1)(q;1)+1 = M M q;1 k(p;1) (6) M(mod q) (7) M k(p;1)(q;1)+1 = k 2 q + M (8) From (4) and (8), We get k 1 p = k 2 q Since p and q are prime numbers, p is not a multiple of q. Hence k 1 must be a multiple of q. Therefore k 1 p = k 3 pq for some integer k 3. M k(p;1)(q;1)+1 = k 1 p + M (9) = k 3 pq + M (10) M k(p;1)(q;1)+1 M(mod pq) (11) Together, these imply that for all M, M ed = M k(p;1)(q;1)+1 M(mod pq) =M(mod n) In the RSA method, M is less than n. Hence M cannot have bits more than n. Therefore, a long message will be divided into smaller messages for the encryption. 7 Security Factoring n would enable an enemy cryptanalyst to "break" the RSA method. The factors of n enable him to compute (n) and thus d. While factoring large numbers is not provably dicult, it is a well-known problem that has been worked on for the last three hundred years by many famous mathematicians. If each operation uses one microsecond, the fastest method known requires 74 years for n with 100 digits and 3: years for 200 digits. It is recommended that n be about 200 digits long. 5