Attempt QUESTIONS 1 and 2, and THREE other questions. penalised if you attempt additional questions.

Transcription

1 UNIVERSITY OF EAST ANGLIA School of Mathematics Main Series UG Examination CRYPTOGRAPHY MTHD6025A Time allowed: 3 Hours Attempt QUESTIONS 1 and 2, and THREE other questions. penalised if you attempt additional questions. You will not be Notes are not permitted in this examination. Do not turn over until you are told to do so by the Invigilator. MTHD6025A Module Contact: Dr Sinéad Lyle, MTH Copyright of the University of East Anglia Version: 1

2 - 2 - Note: Any theorem you use must be clearly stated. A theorem can be used without proof unless you are required to prove it. 1. We assume that A = {0, 1, 2,..., 25} where each number represents one of the letters A, B,..., Z as below. A B C D E F G H I J K L M N O P Q R S T U V W X Y Z (i) You receive the message KLOPWQADX which you know has been encrypted using a Vigenère cipher with key EXAM. What is the message? (ii) Give a method you can try to use to decipher a message encrypted with a Vigenère cipher whose key is of known length k. (iii) You intercept the encrypted message USW. You know that the plaintext message was YES and that it was encrypted using an affine transformation f a,b : x ax + b mod 26. What values (in the range 0 a, b < 26) can a and b have? (iv) You intercept the encrypted message FGHL. You are told that the plaintext ( message was FALL and that it was encrypted using an encryption matrix, ) a b c d that is ( ) ( ) ( ) x a b x. y c d y Explain why that information cannot be correct. MTHD6025A Version: 1

3 (i) Describe what is meant by a one-way function and give an example of such a function. Explain how these functions can be used in public-key cryptography. (ii) Describe the RSA cryptosystem. You should include a description of the public key and the private key in the RSA system and how they are used to encrypt and decrypt messages. Explain why it is believed that RSA is a secure cryptosystem. (iii) (a) Let n = 644, 591. Then n is the product of 2 distinct primes. Use the fact that ϕ(n) = 642, 912 to factorize n. (b) Let N = 280, 171. Then N is the product of 2 distinct primes which are close together. Use this fact to factorize N. [8 marks] 3. (i) (a) Let n 2 be a positive integer. Define what is meant by a primitive root modulo n and find a primitive root modulo 7. (b) Let p be an odd prime. Suppose that k 2 and that s is a primitive root modulo p k. Prove that s pk 1 (p 1) 1 mod p k+1 primitive root modulo p k+1. and hence show that s is a [10 marks] (ii) (a) Find all four solutions to the equation x mod 15. (b) Let k be a field and let f k[x] be a non-zero polynomial of degree n. Prove that there are at most n elements α k such that f(α) = 0. Find an example of a field k and a polynomial f k[x] which has no solutions in k. [10 marks] MTHD6025A PLEASE TURN OVER Version: 1

4 In this question, you may assume that if q is a prime then the only solutions to the equation x 2 1 mod q are x ±1 mod q. You may use Fermat s Little Theorem without proof. (i) State (either version of) Fermat s Little Theorem; you do not need to give a proof. Describe a primality test based on Fermat s Little Theorem and use it to show that 69 is composite. (ii) Give the definition of a Carmichael number. Suppose that n is square free. Show that if p 1 n 1 for every p n then n is a Carmichael number. (iii) Let p be an odd prime integer with p = 2 t m + 1, where m is odd. Prove that for all 1 a < p with gcd(a, p) = 1 we have a m = 1 mod p ; or There exists 0 j < t such that a 2jm = 1 mod p. Using this result, show that 4697 is composite. [8 marks] 5. In this question, you may assume that if p is a prime then there exists a primitive root modulo p. (i) Suppose that p is an odd prime and that a Z. Define the Legendre symbol ( ). State Gauss s Criterion for evaluating the Legendre symbol; you do not need a p to give a proof. (ii) Suppose that p is an odd prime with p 1 mod 12. Using Gauss s Criterion or otherwise, show that ( ) 3 = 1. [7 marks] p (iii) Suppose that p is an odd prime and that p 1 mod 3. Show that there exists c (Z/pZ) of order 3. By considering (2c + 1) 2 or otherwise, show that ( ) 3 = 1. [7 marks] p MTHD6025A Version: 1

5 (i) Find all points on the elliptic curve E(F 7 ) over F 7 given by the equation y 2 = x 3 + x + 3. Take any pair of points P, Q on the curve with P, Q o and compute P + Q. [7 marks] (ii) Suppose that y 2 = x 3 + ax + b with a, b Q defines an elliptic curve. Show that there is another equation Y 2 = X 3 + AX + B with A, B Z whose solutions are in bijection with the solutions to y 2 = x 3 + ax + b. (iii) Describe Koblitz s method for embedding elements of plaintext into an elliptic curve group over a large finite field F q, where q is odd. [8 marks] END OF PAPER MTHD6025A Version: 1

6 MTHD6025B Cryptography feedback Question 1: Everyone got full marks for (i) (including the person who thought the message was FOOD START). For (ii), some people failed to note that you were given the length of the key and tried to explain how to find this length - please read the question! (iii) contained a trap that very few people spotted: recall that for an affine cipher, a needs to be invertible. (iv) was well-done. Question 2: Again, this question was well-done. I had meant that you used Lemma 2.30 for (iiib). Some enterprising students simply found n and then tested the numbers below it until they found a factor. This did indeed answer the question satisfactorily; I shall be more careful with my wording in the future! Question 3: Part (ia) was good but not many people got (ib) completely right. (iia) was again good. The first part of (iib) was not great; for the last part, several people looked at equations modulo n where n was not a prime. Recall that a field always has p elements, where p is prime. Question 4: First part universally well done. Second part, not so much. Most people who tried the test in (iii) got it out, but some people misread the algorithm - it is, of course, Miller Rabin - and only showed that the condition a m = 1 mod p was false. n can fail the first condition but pass the second and still be prime. Question 5: Definition was well done. Good work on (ii) despite it being unseen. First part of (iii) was generaly ignored, but some people got the second part. Question 6: First part was good. Two easy points to compute - I think only one person noticed this! - would have been any two points (x, y) and (x, y). The middle part was not attempted by many people (unseen). For the last part, almost everyone who had memorized the algorithm got it correct. 1