Finding small factors of integers. Speed of the number-field sieve. D. J. Bernstein University of Illinois at Chicago
|
|
|
- Justin Houston
- 5 years ago
- Views:
Transcription
1 The number-field sieve Finding small factors of integers Speed of the number-field sieve D. J. Bernstein University of Illinois at Chicago
2 Prelude: finding denominators in R. Easily compute digits given Can we work backwards: find given digits ? 2-dim integer-relation finding ; 2-dim lattice-basis reduction ; half-gcd computation ; etc. Yes, via continued fractions.
3 Compute successively ( ) ; ( ) ; ( ) 37428; ( ) 4; (4 ) 25; (25 2) 2 2. Evidently is very close to the continued fraction =
4 Can obtain Ý-digit numerator and Ý-digit denominator from 2Ý digits of quotient. Ý(lg Ý) Ç() bit operations using fast multiplication, fast continued fractions. Analogous polynomial algorithms find two Ý-coefficient polynomials from 2Ý coefficients of their power-series quotient. Ý(lg Ý) Ç() coefficient operations using fast algorithms.
5 Linear algebra Ý Ý matrix Å over F 2 specifies linear map F Ý 2 FÝ 2. e.g. Å = ¼ specifies (Ú Ú 2 Ú 3 Ú 4 ) (Ú + Ú 2 + Ú 3 + Ú 4 Ú + Ú 2 + Ú 3 + Ú 4 Ú + Ú 2 + Ú 3 + Ú 4 Ú + Ú 2 + Ú 3 + Ú 4 ). ½
6 Subroutine in Q sieve etc., combining smooth congruences to form a square: Find linear dependency = find nonzero kernel element = find nonzero nullspace element : find nonzero Ú ¾ F Ý 2 with ÅÚ =. e.g. previous Å(Ú Ú 2 Ú 3 Ú 4 ) is only if (Ú Ú 2 Ú 3 Ú 4 ) =, so can t find linear dependency.
7 Solve linear equations : given Û ¾ F Ý 2, find some Ú ¾ F Ý 2 with ÅÚ = Û. e.g. given Û = ( ) and Å = ¼ ½ : find (Ú Ú 2 Ú 3 Ú 4 ) with (Ú + Ú 2 + Ú 3 + Ú 4 Ú + Ú 2 + Ú 3 + Ú 4 Ú + Ú 2 + Ú 3 + Ú 4 Ú + Ú 2 + Ú 3 + Ú 4 ) = Û.
8 We have fast methods to solve linear equations. Easily apply those methods to find linear dependencies, if any dependencies exist. Choose uniform random Ö ¾ F Ý 2 ; compute Û = ÅÖ; use linear-equation solver to find Ú with ÅÚ = Û. This produces uniform random kernel element, namely Ú Ö. Try again if Ú = Ö.
9 Elimination solves linear equations using Ç(Ý 3 ) bit operations. Series denominators solve linear equations using Ý 2+Ó() bit operations if the equations are sparse. Sparse : can evaluate Ú ÅÚ using Ý +Ó() bit operations. Certainly true in Q sieve with usual choices of Ý.
10 Series denominators ¼ ½ e.g. Given Û = Å = ¼ Have magic equation and ½ : Û + Å 3 Û + Å 4 Û = implying Û = ÅÚ for Ú = Å 2 Û Å 3 Û. How did I find magic equation? First explore its consequences.
11 Consider the power series Ë = Û+(ÅÛ)Ø+(Å 2 Û)Ø 2 + = ¼ ½ + ¼ ½ Ø + ¼ ½ Ø 2 + ¼ ½ Ø 3 + ¼ ½ Ø 4 + ¼ ½ Ø 5 + ¼ ½ Ø 6 + ¼ ½ Ø 7 + in F 4 2 [[Ø]].
12 Ë is rational: Ë( + Ø + Ø 4 ) = ¼ ½ Ø 2 + ¼ ¼ ½ Ø 3. ½ + ¼ ½ Ø + For Ò 4, coefficient of Ø Ò in ( È Å ÛØ )( + Ø + Ø 4 ) is Å Ò Û + Å Ò Û + Å Ò 4 Û = Å Ò 4 (Å 4 Û + Å 3 Û + Û) = by magic equation.
13 Squeeze Ë by projecting from F 4 2 [[Ø]] to F 2[[Ø]]. e.g. Define Ö = ( ). ÖË = ÖÛ + ÖÅÛØ + ÖÅ 2 ÛØ 2 + = Ø+Ø 5 +Ø 6 +Ø 7 +Ø 8 +Ø +. Have ÖË( + Ø + Ø 4 ) = Ø + Ø 2. Similar for every Ö : F 4 2 F 2. The series ÖË ¾ F 2 [[Ø]] is rational, specifically a poly of degree 4 divided by + Ø + Ø 4. Can use continued fractions to quickly find denominator +Ø+Ø 4, and thus to find magic equation.
14 In general, given Û ¾ F Ý 2 and Å : F Ý 2 FÝ 2, find magic equation as follows. Pick Ö : F Ý 2 F 2. Compute first 2Ý terms of series ÖÛ + ÖÅÛØ + ÖÅ 2 ÛØ 2 + in F 2 [[Ø]]. Use continued fractions to find denominator of series. Repeat for a few random Ö s, compute lcm of denominators. With very high probability obtain denominator of series Û + ÅÛØ + Å 2 ÛØ 2 +.
15 If final denominator is Ô Ø Ý + Ô Ø Ý + + Ô Ý Ø then Ô Û + Ô ÅÛ + + Ô Ý Å Ý Û =. If Ô = then Û = ÅÚ where Ú = Ô Û Ô Ý Å Ý Û. If Ô = then use slightly more complicated algorithm to solve linear equation. But still easy to find linear dependency. Overall there are Ç(Ý) applications of Å. Total Ý 2+Ó() bit operations if Å is sparse.
16 Asymptotic cost exponents Number of bit operations in number-field sieve, with theorists parameters, is Ä 9+Ó() where Ä = exp((log Ò) 3 (log log Ò) 23 ). What are theorists parameters? Choose degree with (log Ò) 3 (log log Ò) 3 ¾ 4 + Ó().
17 Choose integer Ñ Ò. Write Ò as Ñ + Ñ + + Ñ + with each below Ò (+Ó()). Choose with some randomness in case there are bad s. Test smoothness of Ñ for all coprime pairs ( ) with Ä 95+Ó(), using primes Ä 95+Ó(). Ä 9+Ó() pairs. Conjecturally Ä 65+Ó() smooth values of Ñ.
18 Use Ä 2+Ó() number fields. For each ( ) with smooth Ñ, test smoothness of «and and so on, using primes Ä 82+Ó(). Ä 77+Ó() tests. Each () Ñ 286+Ó(). Conjecturally Ä 95+Ó() smooth congruences. Ä 95+Ó() components in the exponent vectors.
19 Three sizes of numbers here: (log Ò) 3 (log log Ò) 23 bits: Ý,,. (log Ò) 23 (log log Ò) 3 bits: Ñ, Ñ, (). log Ò bits: Ò. Unavoidably 3 in exponent: usual smoothness optimization forces (log Ý) 2 log Ñ; balancing norms with Ñ forces log Ý log Ñ; and log Ñ log Ò.
20 The number-field sieve is asymptotically much faster than the quadratic sieve and the elliptic-curve method. Also works well in practice. Latest record: NFS found two prime factors of RSA-2 challenge, using 5 8 Opteron cycles.
21 Batch NFS The number-field sieve used Ä 9+Ó() bit operations finding smooth Ñ; only Ä 77+Ó() bit operations finding smooth (). Many Ò s can share one Ñ; Ä 9+Ó() bit operations to find squares for all Ò s. Oops, linear algebra hurts; fix by reducing Ý. But still end up factoring batch in much less time than factoring each Ò separately.
22 Polynomial selection Many choices of NFS polynomial. Which choices are best? Consider, e.g., poly degree = 5. Select integer Ñ ¾ [Ò 6 Ò 5 ]; find integers 5 4 with Ò = 5 Ñ Ñ ; for various integers inspect ( Ñ)( ). Practically every choice of Ñ will succeed in factoring Ò. For speed want smallest possible ( Ñ)( ).
23 e.g. Ò = : Can choose Ñ =, 5 = 34, 4 = 59, 3 = 265, 2 = 358, = 979, = 323. NFS succeeds in factoring Ò by inspecting congruences ( )( ) for various integer pairs ( ). But NFS succeeds more quickly using Ñ = 37, inspecting ( 37)( ).
24 Consider, e.g., 2 45 possible choices of Ñ. Quickly identify, e.g., 2 25 attractive candidates. Will choose one Ñ later. If ËÊ and Ë Ê then ( Ñ)( ) (Ñ Ë)Ê 6 where (Ñ Ë) = (ÑË +Ë)( 5 Ë Ë 5 ). Attractive Ñ Ë: small (Ñ Ë).
25 Choosing one typical Ñ Ò 6 produces (Ñ ) Ò 26. Question: How much time do we need to save factor of to find Ñ Ë with (Ñ Ë) Ò 26? This has as much impact as chopping 3 lg bits out of Ò. Searching for good values of Ñ takes noticeable fraction of total time of optimized NFS. (If not, consider more Ñ s!) End up with rather large.
26 Conjectured time 75+Ó() : Enumerate many possibilities for Ñ near 25 Ò 6. Have 5 25 Ò could be as large as 25 Ò 6. Hope that they are smaller, on scale of 25 Ò 6, so (Ñ ) Ò 26. Conjecturally this happens within roughly 75 trials.
27 Conjectured time 6+Ó() : Skip through Ñ s with small 4. Say Ò = 5 Ñ Ñ Choose integer Write Ò in base Ñ + : Ò = 5 (Ñ + ) 5 + ( )(Ñ + ) 4 +. Now degree-4 coefficient is on same scale as 5. Hope for small 3 2.
28 Conjectured time 45+Ó() : Increase Ë. Enumerate many possibilities for Ñ near Ò 6. Have 5 5 Ò could be as large as Ò 6. Force small 4. Hope for 3 on scale of 2 Ò 6, 2 on scale of 5 Ò 6. Then (Ñ 75 ) Ò 26.
29 Conjectured time 35+Ó() : Partly control 3. Say Ò = 5 Ñ Ñ Choose integer and integer Ñ5 5. Find all short vectors in lattice generated by (Ñ ), ( Ñ ), ( Ñ ), ( Ñ).
30 Hope for Ú below with ( ) + ( )Ú + ( 5 2 )Ú 2 below Ñ 3 modulo Ñ. Write Ò in base Ñ + + Ú. Obtain degree-5 coefficient on scale of 5 Ò 6 ; degree-4 coefficient on scale of 4 Ò 6 ; degree-3 coefficient on scale of 2 Ò 6. Hope for good degree 2.
31 After selecting attractive Ñ s, how to identify best (Ñ Ý)? Could check smoothness of some congruences for each Ñ to estimate smoothness chance. But this is expensive: smooth congruences are rare; need quite a few of them before estimate is reliable. Want something faster, to test more (Ñ Ý) s.
32 Quickly and accurately estimate number of small congruences by numerically approximating a superelliptic integral. Quickly and accurately estimate congruence smoothness chance by approximating distribution of a Dirichlet series. So can estimate cost of finding more smooth congruences than exponent-vector length. In practice: Fewer required. Open: Estimate how many.
33 Given À Ñ 5 : How many congruences survive initial selection of small congruences? Consider integer pairs ( ) with Z + Z = Z and. How many congruences ( Ñ)( ) are in [ À À]? bound is quite crude. Can instead enumerate s, count s for each.
34 Faster: Numerically approximate the area of ( ) ¾ R R : ¾ [ À À]. Number of qualifying pairs is extremely close to (3 2 )À 26 Ê ½ ½ Ü((Ü)2 ) 6 where (Ü) = (Ü Ñ)( 5 Ü ). Evaluate superelliptic integral by standard techniques: partition, use series expansions.
35 What is chance that a uniform random integer in [ À] is, e.g., -smooth? Define Ë as the set of -smooth integers Ò. The Dirichlet series for Ë is È [Ò ¾ Ë]Ü lg Ò = ( + Ü lg 2 + Ü 2 lg 2 + Ü 3 lg 2 + ) ( + Ü lg 3 + Ü 2 lg 3 + Ü 3 lg 3 + ) ( + Ü lg 5 + Ü 2 lg 5 + Ü 3 lg 5 + ) ( + Ü lg Ü 2 lg ).
36 Replace primes with slightly larger real numbers 2 = 8, 3 = 2, 5 = 7,, = 45. Replace each 2 3 in Ë with 2 3, obtaining multiset Ë. The Dirichlet series for Ë is È [Ò ¾ Ë]Ü lg Ò = ( + Ü lg 2 + Ü 2 lg 2 + Ü 3 lg 2 + ) ( + Ü lg 3 + Ü 2 lg 3 + Ü 3 lg 3 + ) ( + Ü lg 5 + Ü 2 lg 5 + Ü 3 lg 5 + ) ( + Ü lg Ü 2 lg ).
37 This is simply a power series Ý + Ý + = ( + Ý 8 + Ý Ý ) ( + Ý 2 + Ý Ý ) ( + Ý 7 + Ý Ý ) ( + Ý 45 + Ý ) in the variable Ý = Ü lg. Compute series mod (e.g.) Ý 29 ; i.e., compute 299. Ë has elements , so Ë has at least that many elements 2 4.
38 Can modify Dirichlet series to modify notion of smoothness. Use + Ü lg instead of ( + Ü lg Ü 2 lg ) to throw away Ò s having more than one factor Multiply Ý Ý 299 by Ü lg Ü lg to allow Ò s that are -smooth integers 2 4 times one prime in [ 6 9 ].
39 Number-field smoothness: replace + Ü lg Ô + Ü 2 lg Ô + with + Ü lg Æ(È) + Ü 2 lg Æ(È) + where È is ideal, Æ is norm. In all of these situations, can compute an upper bound on number of smooth values to check tightness of lower bound. If looser than desired, move closer to. Achieve any desired accuracy.
40 Smoothness chance for «in Q(«) is, conjecturally, very close to smoothness chance for ideals of the same size. Same for ( Ñ «) in Q Q(«). Integrate size distribution of ( Ñ)( «) against smoothness distribution of ideals.
part 2: detecting smoothness part 3: the number-field sieve
Integer factorization, part 1: the Q sieve Integer factorization, part 2: detecting smoothness Integer factorization, part 3: the number-field sieve D. J. Bernstein Problem: Factor 611. The Q sieve forms
Integer factorization, part 1: the Q sieve. D. J. Bernstein
Integer factorization, part 1: the Q sieve D. J. Bernstein Sieving small integers 0 using primes 3 5 7: 1 3 3 4 5 5 6 3 7 7 8 9 3 3 10 5 11 1 3 13 14 7 15 3 5 16 17 18 3 3 19 0 5 etc. Sieving and 611 +
Integer factorization, part 1: the Q sieve. part 2: detecting smoothness. D. J. Bernstein
Integer factorization, part 1: the Q sieve Integer factorization, part 2: detecting smoothness D. J. Bernstein The Q sieve factors by combining enough -smooth congruences ( + ). Enough log. Plausible conjecture:
Speeding up characteristic 2: I. Linear maps II. The Å(Ò) game III. Batching IV. Normal bases. D. J. Bernstein University of Illinois at Chicago
Speeding up characteristic 2: I. Linear maps II. The Å(Ò) game III. Batching IV. Normal bases D. J. Bernstein University of Illinois at Chicago NSF ITR 0716498 Part I. Linear maps Consider computing 0
Thanks to: University of Illinois at Chicago NSF DMS Alfred P. Sloan Foundation
Building circuits for integer factorization D. J. Bernstein Thanks to: University of Illinois at Chicago NSF DMS 0140542 Alfred P. Sloan Foundation I want to work for NSA as an independent contractor.
Distinguishing prime numbers from composite numbers: the state of the art. D. J. Bernstein University of Illinois at Chicago
Distinguishing prime numbers from composite numbers: the state of the art D. J. Bernstein University of Illinois at Chicago Is it easy to determine whether a given integer is prime? If easy means computable
Factoring Algorithms Pollard s p 1 Method. This method discovers a prime factor p of an integer n whenever p 1 has only small prime factors.
Factoring Algorithms Pollard s p 1 Method This method discovers a prime factor p of an integer n whenever p 1 has only small prime factors. Input: n (to factor) and a limit B Output: a proper factor of
Code-based post-quantum cryptography. D. J. Bernstein University of Illinois at Chicago
Code-based post-quantum cryptography D. J. Bernstein University of Illinois at Chicago Once the enormous energy boost that quantum computers are expected to provide hits the street, most encryption security
A brief survey of post-quantum cryptography. D. J. Bernstein University of Illinois at Chicago
A brief survey of post-quantum cryptography D. J. Bernstein University of Illinois at Chicago Once the enormous energy boost that quantum computers are expected to provide hits the street, most encryption
There are four irrational roots with approximate values of
Power of the Quadratic Formula 1 y = (x ) - 8(x ) + 4 a = 1, b = -8, c = 4 Key 1. Consider the equation y = x 4 8x + 4. It may be a surprise, but we can use the quadratic formula to find the x-intercepts
Math 109 HW 9 Solutions
Math 109 HW 9 Solutions Problems IV 18. Solve the linear diophantine equation 6m + 10n + 15p = 1 Solution: Let y = 10n + 15p. Since (10, 15) is 5, we must have that y = 5x for some integer x, and (as we
Dixon s Factorization method
Dixon s Factorization method Nikithkumarreddy yellu December 2015 1 Contents 1 Introduction 3 2 History 3 3 Method 4 3.1 Factor-base.............................. 4 3.2 B-smooth...............................
Discrete Logarithm Problem
Discrete Logarithm Problem Çetin Kaya Koç koc@cs.ucsb.edu (http://cs.ucsb.edu/~koc/ecc) Elliptic Curve Cryptography lect08 discrete log 1 / 46 Exponentiation and Logarithms in a General Group In a multiplicative
1 The Fundamental Theorem of Arithmetic. A positive integer N has a unique prime power decomposition. Primality Testing. and. Integer Factorisation
1 The Fundamental Theorem of Arithmetic A positive integer N has a unique prime power decomposition 2 Primality Testing Integer Factorisation (Gauss 1801, but probably known to Euclid) The Computational
EAD 115. Numerical Solution of Engineering and Scientific Problems. David M. Rocke Department of Applied Science
EAD 115 Numerical Solution of Engineering and Scientific Problems David M. Rocke Department of Applied Science Computer Representation of Numbers Counting numbers (unsigned integers) are the numbers 0,
Computing Discrete Logarithms. Many cryptosystems could be broken if we could compute discrete logarithms quickly.
Computing Discrete Logarithms Many cryptosystems could be broken if we could compute discrete logarithms quickly. The first discrete logarithm algorithms below apply in any group. They are about the best
Elementary factoring algorithms
Math 5330 Spring 018 Elementary factoring algorithms The RSA cryptosystem is founded on the idea that, in general, factoring is hard. Where as with Fermat s Little Theorem and some related ideas, one can
Fully Deterministic ECM
Fully Deterministic ECM Iram Chelli LORIA (CNRS) - CACAO Supervisor: P. Zimmermann September 23, 2009 Introduction The Elliptic Curve Method (ECM) is currently the best-known general-purpose factorization
Addition laws on elliptic curves. D. J. Bernstein University of Illinois at Chicago. Joint work with: Tanja Lange Technische Universiteit Eindhoven
Addition laws on elliptic curves D. J. Bernstein University of Illinois at Chicago Joint work with: Tanja Lange Technische Universiteit Eindhoven 2007.01.10, 09:00 (yikes!), Leiden University, part of
Arithmetic, Algebra, Number Theory
Arithmetic, Algebra, Number Theory Peter Simon 21 April 2004 Types of Numbers Natural Numbers The counting numbers: 1, 2, 3,... Prime Number A natural number with exactly two factors: itself and 1. Examples:
Distinguishing prime numbers from composite numbers: the state of the art. D. J. Bernstein University of Illinois at Chicago
Distinguishing prime numbers from composite numbers: the state of the art D. J. Bernstein University of Illinois at Chicago Is it easy to determine whether a given integer is prime? If easy means computable
Elliptic Curves Spring 2013 Lecture #12 03/19/2013
18.783 Elliptic Curves Spring 2013 Lecture #12 03/19/2013 We now consider our first practical application of elliptic curves: factoring integers. Before presenting the elliptic curve method (ECM) for factoring
F O R SOCI AL WORK RESE ARCH
7 TH EUROPE AN CONFERENCE F O R SOCI AL WORK RESE ARCH C h a l l e n g e s i n s o c i a l w o r k r e s e a r c h c o n f l i c t s, b a r r i e r s a n d p o s s i b i l i t i e s i n r e l a t i o n
Integers and Division
Integers and Division Notations Z: set of integers N : set of natural numbers R: set of real numbers Z + : set of positive integers Some elements of number theory are needed in: Data structures, Random
SMOOTH NUMBERS AND THE QUADRATIC SIEVE. Carl Pomerance
SMOOTH NUMBERS AND THE QUADRATIC SIEVE Carl Pomerance When faced with a large number n to factor, what do you do first? You might say Look at the last digit, with the idea of cheaply pulling out possible
Block vs. Stream cipher
Block vs. Stream cipher Idea of a block cipher: partition the text into relatively large (e.g. 128 bits) blocks and encode each block separately. The encoding of each block generally depends on at most
Computational algebraic number theory tackles lattice-based cryptography
Computational algebraic number theory tackles lattice-based cryptography Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Moving to the left Moving to the right
The factorization of RSA D. J. Bernstein University of Illinois at Chicago
The factorization of RSA-1024 D. J. Bernstein University of Illinois at Chicago Abstract: This talk discusses the most important tools for attackers breaking 1024-bit RSA keys today and tomorrow. The same
Math 101 Study Session Spring 2016 Test 4 Chapter 10, Chapter 11 Chapter 12 Section 1, and Chapter 12 Section 2
Math 101 Study Session Spring 2016 Test 4 Chapter 10, Chapter 11 Chapter 12 Section 1, and Chapter 12 Section 2 April 11, 2016 Chapter 10 Section 1: Addition and Subtraction of Polynomials A monomial is
Number theory (Chapter 4)
EECS 203 Spring 2016 Lecture 10 Page 1 of 8 Number theory (Chapter 4) Review Questions: 1. Does 5 1? Does 1 5? 2. Does (129+63) mod 10 = (129 mod 10)+(63 mod 10)? 3. Does (129+63) mod 10 = ((129 mod 10)+(63
Another Attempt to Sieve With Small Chips Part II: Norm Factorization
Another Attempt to Sieve With Small Chips Part II: Norm Factorization Rainer Steinwandt Florida Atlantic University (joint work with Willi Geiselmann, Fabian Januszewski, Hubert Köpfer and Jan Pelzl) Setting
Factoring. there exists some 1 i < j l such that x i x j (mod p). (1) p gcd(x i x j, n).
18.310 lecture notes April 22, 2015 Factoring Lecturer: Michel Goemans We ve seen that it s possible to efficiently check whether an integer n is prime or not. What about factoring a number? If this could
Lecture 6: Cryptanalysis of public-key algorithms.,
T-79.159 Cryptography and Data Security Lecture 6: Cryptanalysis of public-key algorithms. Helsinki University of Technology mjos@tcs.hut.fi 1 Outline Computational complexity Reminder about basic number
! " # $! % & '! , ) ( + - (. ) ( ) * + / 0 1 2 3 0 / 4 5 / 6 0 ; 8 7 < = 7 > 8 7 8 9 : Œ Š ž P P h ˆ Š ˆ Œ ˆ Š ˆ Ž Ž Ý Ü Ý Ü Ý Ž Ý ê ç è ± ¹ ¼ ¹ ä ± ¹ w ç ¹ è ¼ è Œ ¹ ± ¹ è ¹ è ä ç w ¹ ã ¼ ¹ ä ¹ ¼ ¹ ±
Lecture Notes. Advanced Discrete Structures COT S
Lecture Notes Advanced Discrete Structures COT 4115.001 S15 2015-01-13 Recap Divisibility Prime Number Theorem Euclid s Lemma Fundamental Theorem of Arithmetic Euclidean Algorithm Basic Notions - Section
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 8 February 1, 2012 CPSC 467b, Lecture 8 1/42 Number Theory Needed for RSA Z n : The integers mod n Modular arithmetic GCD Relatively
The tangent FFT. D. J. Bernstein University of Illinois at Chicago
The tangent FFT D. J. Bernstein University of Illinois at Chicago Advertisement SPEED: Software Performance Enhancement for Encryption and Decryption A workshop on software speeds for secret-key cryptography
COMP4109 : Applied Cryptography
COMP409 : Applied Cryptography Fall 203 M. Jason Hinek Carleton University Applied Cryptography Day 3 public-key encryption schemes some attacks on RSA factoring small private exponent 2 RSA cryptosystem
UNIQUE FJORDS AND THE ROYAL CAPITALS UNIQUE FJORDS & THE NORTH CAPE & UNIQUE NORTHERN CAPITALS
Q J j,. Y j, q.. Q J & j,. & x x. Q x q. ø. 2019 :. q - j Q J & 11 Y j,.. j,, q j q. : 10 x. 3 x - 1..,,. 1-10 ( ). / 2-10. : 02-06.19-12.06.19 23.06.19-03.07.19 30.06.19-10.07.19 07.07.19-17.07.19 14.07.19-24.07.19
Self-Testing Polynomial Functions Efficiently and over Rational Domains
Chapter 1 Self-Testing Polynomial Functions Efficiently and over Rational Domains Ronitt Rubinfeld Madhu Sudan Ý Abstract In this paper we give the first self-testers and checkers for polynomials over
What is The Continued Fraction Factoring Method
What is The Continued Fraction Factoring Method? Slide /7 What is The Continued Fraction Factoring Method Sohail Farhangi June 208 What is The Continued Fraction Factoring Method? Slide 2/7 Why is Factoring
Math 312/ AMS 351 (Fall 17) Sample Questions for Final
Math 312/ AMS 351 (Fall 17) Sample Questions for Final 1. Solve the system of equations 2x 1 mod 3 x 2 mod 7 x 7 mod 8 First note that the inverse of 2 is 2 mod 3. Thus, the first equation becomes (multiply
Modular polynomials and isogeny volcanoes
Modular polynomials and isogeny volcanoes Andrew V. Sutherland February 3, 010 Reinier Bröker Kristin Lauter Andrew V. Sutherland (MIT) Modular polynomials and isogeny volcanoes 1 of 9 Isogenies An isogeny
2. Limits at Infinity
2 Limits at Infinity To understand sequences and series fully, we will need to have a better understanding of its at infinity We begin with a few examples to motivate our discussion EXAMPLE 1 Find SOLUTION
Introduction to Arithmetic Geometry Fall 2013 Lecture #2 09/10/2013
18.78 Introduction to Arithmetic Geometry Fall 013 Lecture # 09/10/013.1 Plane conics A conic is a plane projective curve of degree. Such a curve has the form C/k : ax + by + cz + dxy + exz + fyz with
3.4. ZEROS OF POLYNOMIAL FUNCTIONS
3.4. ZEROS OF POLYNOMIAL FUNCTIONS What You Should Learn Use the Fundamental Theorem of Algebra to determine the number of zeros of polynomial functions. Find rational zeros of polynomial functions. Find
D. J. Bernstein University of Illinois at Chicago
Algorithms for primes D. J. Bernstein University of Illinois at Chicago Some literature: Recognizing primes: 1982 Atkin Larson On a primality test of Solovay and Strassen ; 1995 Atkin Intelligent primality
Algorithms. Shanks square forms algorithm Williams p+1 Quadratic Sieve Dixon s Random Squares Algorithm
Alex Sundling Algorithms Shanks square forms algorithm Williams p+1 Quadratic Sieve Dixon s Random Squares Algorithm Shanks Square Forms Created by Daniel Shanks as an improvement on Fermat s factorization
22. The Quadratic Sieve and Elliptic Curves. 22.a The Quadratic Sieve
22. The Quadratic Sieve and Elliptic Curves 22.a The Quadratic Sieve Sieve methods for finding primes or for finding factors of numbers are methods by which you take a set P of prime numbers one by one,
All variables a, b, n, etc are integers unless otherwise stated. Each part of a problem is worth 5 points.
Math 152, Problem Set 2 solutions (2018-01-24) All variables a, b, n, etc are integers unless otherwise stated. Each part of a problem is worth 5 points. 1. Let us look at the following equation: x 5 1
Lab 2 Iterative methods and eigenvalue problems. Introduction. Iterative solution of the soap film problem. Beräkningsvetenskap II/NV2, HT (6)
Beräkningsvetenskap II/NV2, HT 2008 1 (6) Institutionen för informationsteknologi Teknisk databehandling Besöksadress: MIC hus 2, Polacksbacken Lägerhyddsvägen 2 Postadress: Box 337 751 05 Uppsala Telefon:
Industrial Strength Factorization. Lawren Smithline Cornell University
Industrial Strength Factorization Lawren Smithline Cornell University lawren@math.cornell.edu http://www.math.cornell.edu/~lawren Industrial Strength Factorization Given an integer N, determine the prime
Some Facts from Number Theory
Computer Science 52 Some Facts from Number Theory Fall Semester, 2014 These notes are adapted from a document that was prepared for a different course several years ago. They may be helpful as a summary
Discrete Math, Fourteenth Problem Set (July 18)
Discrete Math, Fourteenth Problem Set (July 18) REU 2003 Instructor: László Babai Scribe: Ivona Bezakova 0.1 Repeated Squaring For the primality test we need to compute a X 1 (mod X). There are two problems
Polynomial Selection. Thorsten Kleinjung École Polytechnique Fédérale de Lausanne
Polynomial Selection Thorsten Kleinjung École Polytechnique Fédérale de Lausanne Contents Brief summary of polynomial selection (no root sieve) Motivation (lattice sieving, monic algebraic polynomial)
How many elliptic curves can have the same prime conductor? Alberta Number Theory Days, BIRS, 11 May Noam D. Elkies, Harvard University
How many elliptic curves can have the same prime conductor? Alberta Number Theory Days, BIRS, 11 May 2013 Noam D. Elkies, Harvard University Review: Discriminant and conductor of an elliptic curve Finiteness
Topics in Computer Mathematics
Random Number Generation (Uniform random numbers) Introduction We frequently need some way to generate numbers that are random (by some criteria), especially in computer science. Simulations of natural
MATH 2112/CSCI 2112, Discrete Structures I Winter 2007 Toby Kenney Homework Sheet 5 Hints & Model Solutions
MATH 11/CSCI 11, Discrete Structures I Winter 007 Toby Kenney Homework Sheet 5 Hints & Model Solutions Sheet 4 5 Define the repeat of a positive integer as the number obtained by writing it twice in a
LARGE PRIME NUMBERS (32, 42; 4) (32, 24; 2) (32, 20; 1) ( 105, 20; 0).
LARGE PRIME NUMBERS 1. Fast Modular Exponentiation Given positive integers a, e, and n, the following algorithm quickly computes the reduced power a e % n. (Here x % n denotes the element of {0,, n 1}
4 Number Theory and Cryptography
4 Number Theory and Cryptography 4.1 Divisibility and Modular Arithmetic This section introduces the basics of number theory number theory is the part of mathematics involving integers and their properties.
1 Overview and revision
MTH6128 Number Theory Notes 1 Spring 2018 1 Overview and revision In this section we will meet some of the concerns of Number Theory, and have a brief revision of some of the relevant material from Introduction
Homework #2 solutions Due: June 15, 2012
All of the following exercises are based on the material in the handout on integers found on the class website. 1. Find d = gcd(475, 385) and express it as a linear combination of 475 and 385. That is
Slide 1 / 69. Slide 2 / 69. Slide 3 / 69. Whole Numbers. Table of Contents. Prime and Composite Numbers
Slide 1 / 69 Whole Numbers Table of Contents Slide 2 / 69 Prime and Composite Numbers Prime Factorization Common Factors Greatest Common Factor Relatively Prime Least Common Multiple Slide 3 / 69 Prime
Basic Equation Solving Strategies
Basic Equation Solving Strategies Case 1: The variable appears only once in the equation. (Use work backwards method.) 1 1. Simplify both sides of the equation if possible.. Apply the order of operations
Shor s Prime Factorization Algorithm
Shor s Prime Factorization Algorithm Bay Area Quantum Computing Meetup - 08/17/2017 Harley Patton Outline Why is factorization important? Shor s Algorithm Reduction to Order Finding Order Finding Algorithm
Computational algebraic number theory tackles lattice-based cryptography
Computational algebraic number theory tackles lattice-based cryptography Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Moving to the left Moving to the right
Math 131 notes. Jason Riedy. 6 October, Linear Diophantine equations : Likely delayed 6
Math 131 notes Jason Riedy 6 October, 2008 Contents 1 Modular arithmetic 2 2 Divisibility rules 3 3 Greatest common divisor 4 4 Least common multiple 4 5 Euclidean GCD algorithm 5 6 Linear Diophantine
Basic elements of number theory
Cryptography Basic elements of number theory Marius Zimand By default all the variables, such as a, b, k, etc., denote integer numbers. Divisibility a 0 divides b if b = a k for some integer k. Notation
Basic elements of number theory
Cryptography Basic elements of number theory Marius Zimand 1 Divisibility, prime numbers By default all the variables, such as a, b, k, etc., denote integer numbers. Divisibility a 0 divides b if b = a
Computing modular polynomials with the Chinese Remainder Theorem
Computing modular polynomials with the Chinese Remainder Theorem Andrew V. Sutherland Massachusetts Institute of Technology ECC 009 Reinier Bröker Kristin Lauter Andrew V. Sutherland (MIT) Computing modular
With Question/Answer Animations. Chapter 4
With Question/Answer Animations Chapter 4 Chapter Motivation Number theory is the part of mathematics devoted to the study of the integers and their properties. Key ideas in number theory include divisibility
Chapter 3: Polynomial and Rational Functions
Chapter 3: Polynomial and Rational Functions 3.1 Polynomial Functions A polynomial on degree n is a function of the form P(x) = a n x n + a n 1 x n 1 + + a 1 x 1 + a 0, where n is a nonnegative integer
CMSC Discrete Mathematics SOLUTIONS TO SECOND MIDTERM EXAM November, 2005
CMSC-37110 Discrete Mathematics SOLUTIONS TO SECOND MIDTERM EXAM November, 2005 Instructor: László Babai Ryerson 164 e-mail: laci@cs This exam contributes 20% to your course grade. 1. (6 points) Let a
3 The fundamentals: Algorithms, the integers, and matrices
3 The fundamentals: Algorithms, the integers, and matrices 3.4 The integers and division This section introduces the basics of number theory number theory is the part of mathematics involving integers
This is a recursive algorithm. The procedure is guaranteed to terminate, since the second argument decreases each time.
8 Modular Arithmetic We introduce an operator mod. Let d be a positive integer. For c a nonnegative integer, the value c mod d is the remainder when c is divided by d. For example, c mod d = 0 if and only
Overview of Computer Algebra
Overview of Computer Algebra http://cocoa.dima.unige.it/ J. Abbott Universität Kassel J. Abbott Computer Algebra Basics Manchester, July 2018 1 / 12 Intro Characteristics of Computer Algebra or Symbolic
2x 1 7. A linear congruence in modular arithmetic is an equation of the form. Why is the solution a set of integers rather than a unique integer?
Chapter 3: Theory of Modular Arithmetic 25 SECTION C Solving Linear Congruences By the end of this section you will be able to solve congruence equations determine the number of solutions find the multiplicative
CHAPTER 1 REAL NUMBERS KEY POINTS
CHAPTER 1 REAL NUMBERS 1. Euclid s division lemma : KEY POINTS For given positive integers a and b there exist unique whole numbers q and r satisfying the relation a = bq + r, 0 r < b. 2. Euclid s division
Applications of Discrete Mathematics to the Analysis of Algorithms
Applications of Discrete Mathematics to the Analysis of Algorithms Conrado Martínez Univ. Politècnica de Catalunya, Spain May 2007 Goal Given some algorithm taking inputs from some set Á, we would like
Rounding and Chaining LLL: Finding Faster Small Roots of Univariate Polynomial Congruences
Rounding and Chaining LLL: Finding Faster Small Roots of Univariate Polynomial Congruences J. Bi, J-S. Coron, J-C. Faugère, P. Nguyen, G. Renault, R. Zeitoun Public Key Cryptography 2014 26-28 March, 2014
Discrete Structures Lecture Primes and Greatest Common Divisor
DEFINITION 1 EXAMPLE 1.1 EXAMPLE 1.2 An integer p greater than 1 is called prime if the only positive factors of p are 1 and p. A positive integer that is greater than 1 and is not prime is called composite.
AN ALGEBRA PRIMER WITH A VIEW TOWARD CURVES OVER FINITE FIELDS
AN ALGEBRA PRIMER WITH A VIEW TOWARD CURVES OVER FINITE FIELDS The integers are the set 1. Groups, Rings, and Fields: Basic Examples Z := {..., 3, 2, 1, 0, 1, 2, 3,...}, and we can add, subtract, and multiply
Factorization & Primality Testing
Factorization & Primality Testing C etin Kaya Koc http://cs.ucsb.edu/~koc koc@cs.ucsb.edu Koc (http://cs.ucsb.edu/~ koc) ucsb ccs 130h explore crypto fall 2014 1/1 Primes Natural (counting) numbers: N
A Number Theorist s Perspective on Dynamical Systems
A Number Theorist s Perspective on Dynamical Systems Joseph H. Silverman Brown University Frontier Lectures Texas A&M, Monday, April 4 7, 2005 Rational Functions and Dynamical Systems
The number field sieve in the medium prime case
The number field sieve in the medium prime case Frederik Vercauteren ESAT/COSIC - K.U. Leuven Joint work with Antoine Joux, Reynald Lercier, Nigel Smart Finite Field DLOG Basis finite field is F p = {0,...,
(x 1 +x 2 )(x 1 x 2 )+(x 2 +x 3 )(x 2 x 3 )+(x 3 +x 1 )(x 3 x 1 ).
CMPSCI611: Verifying Polynomial Identities Lecture 13 Here is a problem that has a polynomial-time randomized solution, but so far no poly-time deterministic solution. Let F be any field and let Q(x 1,...,
Number Theory Math 420 Silverman Exam #1 February 27, 2018
Name: Number Theory Math 420 Silverman Exam #1 February 27, 2018 INSTRUCTIONS Read Carefully Time: 50 minutes There are 5 problems. Write your name neatly at the top of this page. Write your final answer
Algorithmic number theory. Questions/Complaints About Homework? The division algorithm. Division
Questions/Complaints About Homework? Here s the procedure for homework questions/complaints: 1. Read the solutions first. 2. Talk to the person who graded it (check initials) 3. If (1) and (2) don t work,
CONTINUED FRACTIONS, PELL S EQUATION, AND TRANSCENDENTAL NUMBERS
CONTINUED FRACTIONS, PELL S EQUATION, AND TRANSCENDENTAL NUMBERS JEREMY BOOHER Continued fractions usually get short-changed at PROMYS, but they are interesting in their own right and useful in other areas
Equations in Quadratic Form
Equations in Quadratic Form MATH 101 College Algebra J. Robert Buchanan Department of Mathematics Summer 2012 Objectives In this lesson we will learn to: make substitutions that allow equations to be written
The Completion of a Metric Space
The Completion of a Metric Space Let (X, d) be a metric space. The goal of these notes is to construct a complete metric space which contains X as a subspace and which is the smallest space with respect
RSA Implementation. Oregon State University
RSA Implementation Çetin Kaya Koç Oregon State University 1 Contents: Exponentiation heuristics Multiplication algorithms Computation of GCD and Inverse Chinese remainder algorithm Primality testing 2
MAT 243 Test 2 SOLUTIONS, FORM A
MAT Test SOLUTIONS, FORM A 1. [10 points] Give a recursive definition for the set of all ordered pairs of integers (x, y) such that x < y. Solution: Let S be the set described above. Note that if (x, y)
CDM. Recurrences and Fibonacci
CDM Recurrences and Fibonacci Klaus Sutner Carnegie Mellon University 20-fibonacci 2017/12/15 23:16 1 Recurrence Equations Second Order The Fibonacci Monoid Recurrence Equations 3 We can define a sequence
MA094 Part 2 - Beginning Algebra Summary
MA094 Part - Beginning Algebra Summary Page of 8/8/0 Big Picture Algebra is Solving Equations with Variables* Variable Variables Linear Equations x 0 MA090 Solution: Point 0 Linear Inequalities x < 0 page
Bjorn Poonen. MSRI Introductory Workshop on Rational and Integral Points on Higher-dimensional Varieties. January 17, 2006
University of California at Berkeley MSRI Introductory Workshop on Rational and Integral Points on Higher-dimensional (organized by Jean-Louis Colliot-Thélène, Roger Heath-Brown, János Kollár,, Alice Silverberg,
Shor s Algorithm. Elisa Bäumer, Jan-Grimo Sobez, Stefan Tessarini May 15, 2015
Shor s Algorithm Elisa Bäumer, Jan-Grimo Sobez, Stefan Tessarini May 15, 2015 Integer factorization n = p q (where p, q are prime numbers) is a cryptographic one-way function Classical algorithm with best
Chapter 9 Mathematics of Cryptography Part III: Primes and Related Congruence Equations
Chapter 9 Mathematics of Cryptography Part III: Primes and Related Congruence Equations Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 9.1 Chapter 9 Objectives
2x 1 7. A linear congruence in modular arithmetic is an equation of the form. Why is the solution a set of integers rather than a unique integer?
Chapter 3: Theory of Modular Arithmetic 25 SECTION C Solving Linear Congruences By the end of this section you will be able to solve congruence equations determine the number of solutions find the multiplicative
Part 2 - Beginning Algebra Summary
Part - Beginning Algebra Summary Page 1 of 4 1/1/01 1. Numbers... 1.1. Number Lines... 1.. Interval Notation.... Inequalities... 4.1. Linear with 1 Variable... 4. Linear Equations... 5.1. The Cartesian