6 The Set of Coprimes, Euler s totient

Transcription

1 6 The Set of Coprimes, Euler s totient We now know that when a has an inverse mod n, thatinverseisapowerofa related to the multiplicative order: 9 order v, a v =1 modn ) a 1 = a v 1 mod n. We would like to get our hands on the order v such that a v =1 mod n. Thisislikesolvingamodulo-orderequationbutfortheexponent. The good: if v is such a power that produces a v =1 modn, thenany multiple of v has the same property : a vk =(a v ) k =1 k =1 modn So in general we dont need the smallest order v to get a v =1 anymultiple of v would do the same. We show here that there is such a multiple common for all orders v (works for all a); we call this multiplicative order-for-all '(n) and show it is the size of the coprime set. C n =coprimes-with-n in Z n ={a 2 Z n gcd(a, n) =1} '(n) =numberofcoprimeswithn in Z n = C n. n set C n '(n) prime 2 1 1= n 1 prime 3 1,2 2= n 1 4 1,3 2 prime 5 1,2,3,4 4= n 1 6 1,5 2 prime 7 1:6 6= n 1 8 1,3,5, ,2,4,5,7, ,3,7,9 4 prime 11 1:10 10= n ,2,4,7,8,11,13, ,3,5,7,9,11,13,15 8 prime 17 1:16 16= n ,5,7,11,13,17 6 prime 19 1:18 18= n ,3,7,9,11,13,17,19 8 prime 23 1:22 22= n 1 18

2 THEOREM 7 (Lagrange) COPRIMES SET FACTORIZATION if gcd(a, n) = 1 then the multiplicative order of av= P a divides '(n) = C n In fact, we can factorize the set of coprimes C n into a set-product P a Q a where P a is the set of a-powers like before, and Q a is a set of quotients coprime/a-power as defined below. Once we prove everything, we conclude that the set sizes satisfy C n = P a Q a, which concludes the theorem since v = P a. proof idea. We define formally the quotient set Q a as follows: We start with Q a = {1}. Foreachcoprimec 2 C n, we consider the smallest quotient q c 2 Z n such that c = a k q c for some power k. We add q c to Q a,ifits not already there. So in the end Q a is the set of these smallest quotients obtained as coprime / a-power EXAMPLE: n = 26,a = 9, P a = {9, 9 2 = 3, 9 3 = 1},order = v = 3. We now calculate the smallest quotient of every coprime in C 2 6againstP 9 : coprime /9 /9 2 =3 /9 3 =1 smallest goes to Q Q 9 = {1, 5, 7, 17} NOTE: di erent coprimes c1 6= c 2 might have the same smallest quotient q c1 = q c2, because they use di erent powers of a EXAMPLE: n = 26,a = 5, P a = {5, 5 2 = 1, 5 3 = 5, 5 4 = 25 = 1},order = v = 4. We now calculate the smallest quotient (as positive remainder) of every coprime in C 2 6againstP 5 : 19

3 coprime /5 /5 2 = 1 /5 3 = 5 /5 4 =1 smallest goes to Q = = = = = = = Q 5 = {1, 3, 7} proof idea. To show C n = P a Q a we need three pieces. Proof part 1: any element in C n is also in P a Q a. This is obvious: we constructed Q a such that every coprime has a quotient, that is every c 2 C n can be written as a power of a times an element in Q a Proof part 2: any product obtained from P a Q a is also in C n. That is, if q 2 Q a then q a k is coprime with n. This is true because both q and a k 2 P a are coprime with n so Theorem 1 can be used to prove the contrapositive of part 2. Proof part 3: So far we have proved that as sets these two are the same C n = P a Q a. The only remaining issue is to show that the set sizes work out as we want : P a Q a = P a Q a.inotherwords,theissueistomake sure that making all products P a Q a does not repeat any value. It can be shown by contradiction: lets assume that two of these products are the same value mod n : q a k = t a h for q, t 2 Q a with q<t. Then q = t a h k which means only one (the smallest) of q, t belongs to Q a ;thiscontradicts the construction of quotient set Q a,asthelargerofthetwo(t) wouldnever be added to Q a. 20

4 These parts allows us to conclude that the set sizes satisfy C n = P a Q a or '(n) =order(a) Q a.thusv = order(a) divides'(n) EXAMPLE: n =9,a=4, P a = {4, 4 2 =7, 4 3 =64=1},order = v =3. We now calculate the smallest quotient (as positive remainder) of every coprime in C 9 against P 4 : coprime /4 /4 2 =7 /4 3 =1 smallest goes to Q Q 4 = {1, 2} EXAMPLE: n =15,a =2, P 2 = {2, 2 2 =4, 2 3 =8, 2 4 =1},order = v =4. We now calculate the smallest quotient (as positive remainder) of every coprime in C 1 5againstP 2 : coprime /2 /2 2 =4 /2 3 =8 /2 4 =1 smallest goes to Q Q 2 = {1, 7} 21

5 THEOREM 8 (Euler) if gcd(a, n) =1thena '(n) =1 modn proof This is simply a corollary of Lagrange theorem: if v is the multiplicative order of a (there must be one since a is coprime) and '(n) =v k then a '(n) = a vk =(a v ) k =1 k =1modn INVERSE FROM TOTIENT. The critical consequence is that '(n) acts like an order for any coprime a. The theorem also gives a quick way to compute the inverse a 1,whenthetotient'(n) isknown: a 1 = a '(n) 1 mod n second proof with modulo arithmetic - optional. We have a theorem that says if a, n coprime gcd(a, n) = 1, then multiplying all non-zero remainders (mod n) witha gives back the set of non-zero remainders. {1a, 2a, 3a,..., (n 1)a} mod n = {1, 2, 3,...n 1}. In other words:s = a Z n mod n = {1a, 2a, 3a,..., (n 1)a} mod n = Z n Now we need a version of this theorem, for the coprime remainders set: Lemma. if a, n coprime gcd(a, n) = 1, then multiplying all coprime remainders C n = {u 1,u 2,u 3,...,u '(n) } with a gives back the set of coprime remainders: {au 1, au 2, au 3,..., au '(n) } mod n = {u 1,u 2,u 3,...,u '(n) }. In other words S = a C n mod n = {ua u 2 C n } mod n = C n proof for lemma. To show this result we make a similar argument with the one in the original theorem: the left set S is a subset of C n, because every element in uv 2 S is a product of two coprimes with n (u and a), thus certainly a coprime: we can immediately show that if u 1,a 1 are u and a inverses mod n, thenu 1 a 1 is the inverse of ua, soua 2 C n. Second, S enumerates '(n) elements,andallofthemaredistinctremainders mod n. Supposetherearetwodistinctu 1,u 2 2 C n such that au 1 = au 2 mod n ) n a(u 1 u 2 ) ) n a(u 1 u 2 ). Since (a, n) arecoprime,n must divide the other factor, n (u 1 u 2 ) ) u 1 = u 2 (because n<u 1 u 2 <n) contradiction. So S is a subset of C n with all its '(n) elements.itmeanss = C n. The rest of the proof follows the derivation used to prove Fermat s theorem: if S and C n are the same set, then the product of all elements in S mod n is the same as the product of all elements in C n mod n: 22

6 a Q Cn {C n } = Q {C n } mod n a Q Q '(n) {C n } {Cn } =0 modn (a '(n) 1) Q {C n } =0 modn n (a '(n) 1) Q {C n } Since gcd(n, Q {C n })=1,n must divide the other factor, n (a '(n) 1) ) a '(n) =1 modn. EXAMPLE n =15 coprime set is C 15 = {1, 2, 4, 7, 8, 11, 13, 14} ; '(15) = C 15 =8 Then for every a 2 C 15 we have a 8 =1 mod15: 1 8 =1 mod =(2 4 ) 2 =16 2 =1 2 =1 mod =(4 2 ) 4 =(2 4 ) 4 =1 4 mod =(7 2 ) 4 =49 4 =4 4 =2 8 =1 mod =( 7) 8 =7 8 =1 mod =( 4) 8 =4 8 =1 mod =( 2) 8 =2 8 =1 mod =( 1) 8 =1 mod15 EXERCISE(di culty F) ifn is a power of prime, n = p k,then '(n) =p k 1 (p 1) hint: think of the coprimes as the elements in Z n that are not composite, in other words the ones that are not multiples of p. How many multiples of p are there? 23

7 7 Fermat s Little Theorem n=p prime In here we look at the particular case where n = p is prime. In this case the problem is easier: a known multiple for any order v (for a) isp 1. So p 1 acts as an order for every a (mod p). THEOREM 9 Fermat Let p prime. For any 0 6= a 2 Z p,wehave a p 1 =1modp EXAMPLES p =7,a =5 a p 1 =5 6 =15625= = 1( mod 7) The smallest order v for a =5isp 1=6: noneofthepreviouspowersof a =5gives1mod7: 5, 5 2, 5 3, 5 4, 5 5 6=1 mod7 p =7,a =4 a p 1 =4 6 =(4 2 ) 3 =16 3 =2 3 =1( mod7) The smallest order v for a =4isactuallyv =3,notp p 1mustbeamultipleofv: 4 3 =16 4=2 4=1( mod7) 1=6,butofcourse p =5,a =3 a p 1 =3 4 =81=1( mod5) It turns out that modulo 5, p a v =1 modp 1=4isthesmallestorderv for any a to give p =11,a =3 a p 1 =3 10 =(3 4 ) =81 2 9=4 2 9=5 9=1( mod11) For a =3,smallestorderv mod 11 is actually not p 1=10,but5(a divisor of p 1): 3 5 =243=1( mod11) proof For p=prime, we have '(p) = p 1. Thus applying Euler s theorem for a 6= 0inZ p gives the theorem: a '(p) = a p 1 =1modp 24

8 second proof. Aprevioustheoremstatedthatif(a,p)arecoprimethen these two sets are the same S = {1a, 2a, 3a,..., (p 1)a} = Z p = {1, 2, 3,...,p 1} Then the product of all elements in S mod p is the same as the product of all elements in Z p mod p: a p (p 1) = (p 1) mod p a p 1 (p 1)! = (p 1)! mod p ) p (p 1)!(a p 1 1) Since gcd(p, (p 1)!) = 1, p must divide the other factor, p (a p 1 1) ) a p 1 =1 modp EXERCISE: Given the theorem, show that for any integer a and prime p, we have a p = a (mod p). EXERCISE: Explain why p and (p to prove the theorem. 1)! are coprime, a critical fact used 7.1 Primality test OBSERVATION Fermat s Theorem statement holds sometimes when p is not prime, only for carefully chosen a. Forexamplep =15,a=4wehave =4 14 =(4 2 ) 7 =16 7 =1 7 =1( mod15) Surprisingly for very special non-prime Carmichael numbers Fermat s theorem holds entirely (for any a). So its converse its not true. Try it for p =561. Fermat s Primality Test for number p works like this : pick several random positive integers a<pand check for each a if a p 1 =1 modp. if at least one test (for a particular a) gives NO then we know for sure p is not prime if all tests (for all a) give YES, we are not sure, but with high probability p is prime. 25

9 Carmichael numbers are the numbers n with the following two properties: n is square free, meaning factorization into primes n = p 1 p 2... p t contains each prime exactly once (no exponents e>1) for every prime factor p of n, p 1 n 1 EXAMPLES First few Carmichael numbers are 561= 3*11*17; because 2, 10, 16 divide = 5*13*17; because 4, 12, 16 divide = 7*13*19 ; because 6, 12, 18 divide 1728 Carmichael numbers pass all Fermat s-primality tests but they are not primes! But Carmichael numbers are so rare, that we are OK with them passing incorrectly at primes. EXERCISE(di culty F) ShowthataCarmichaelnumbern that satisfies the definiton properties above, while not prime, passes all Fermat s tests: for every 0 <a<nwe get a n 1 =1 modn. EXERCISE(di culty FF) Anumbern passes all Fermat s tests: for every 0 <a<nwe get a n 1 =1 modn. Showthateitheritisprime,oritis acarmichaelnumber. 26

10 8 RSA : n=p*q product of two primes EXERCISE Show that if n is a prime square n = p 2,then '(n) =p(p 1) EXERCISE: THEOREM 10 RSA EQUATION if n is a product of two primes, n = pq, showthat '(n) =(p 1)(q 1) = pq p q +1 by counting the non-coprimes in Z n \ C n NOTE that in this case Euler s theorem says that for any a<n,andany integer k a '(n)k+1 = a (p 1)(q 1)k+1 = a mod pq. This is the equation that makes RSA cryptosystem work. It uses two prime numbers p, q very large (2048 bits each magnitude) to avoid factorization by brute force with present computational ability (as of year 2016). EXERCISE. Ff n is a product of three primes, n = pqr, showthat '(n) =(p 1)(q 1)(q 1) by counting the non-coprimes in Z n \ C n EXERCISE(di culty F, doneintextbook)ifn is a product of two primes, n = pq, thenweknowfrompreviousexercisethat'(n) =(p 1)(q 1) Prove Euler s theorem in this particular case a (p 1)(q 1) =1 modpq; foranya, n coprimes by following these two steps: use Fermat s theorem for a, separatelymodp and then mod q use the Chinese remainder theorem to get the result of a (p 1)(q 1) mod pq EXERCISE (RSA-1-factor). RSA is hard to break because breaking it comes down to one of the following notoriously di cult problems: Given n = pq (p, q unknown), find p and q; or Given n = pq (p, q unknown) and e, finde s inverse modulo (p 1)(q 1) without finding p and q Suppose one wants to implement an RSA-like cryptosystem based on Fermat s theorem with only one prime n = p. Theequationis a (p 1)k+1 = a mod p. and so encoding and decoding would work correctly with two keys e(public) and e 1 mod p 1 (private). What is wrong with this encryption schema? 27

11 Hint: Finding private key is easy. EXERCISE(di culty F RSA-3-factors). Suppose one wants to implement an RSA-like cryptosystem with three primes n = pqr instead of two. The equation becomes a (p 1)(q 1(r 1)k+1 = a mod pqr. Is it correct? So that encoding and decoding work correctly with two keys e(public) and e 1 mod (p 1)(q 1)(r 1) (private). Is this encryption schema weaker or stronger than the two-factor RSA? 28

12 9 Chinese Reminder Theorem If N = p q r (or more factors) then there is a matching of sizes between (Z p Z q Z r )andz N. THEOREM 11 of Chinese Reminder If the factors are pairwise coprime, i.e. gcd(p, q) =gcd(p, r) =gcd(q, r) =1, The following is a one to one mapping : take any triplet of remainders (a 2 Z p,b 2 Z q,c 2 Z r )intoauniquex2z N,suchthatx mod p = a; x mod q = b; x mod r = c This mapping function h : Z pqr! Z p Z q Z r,givenby h(x) =(x mod p, x mod q, x mod r) is called the Chines-Reminder bijection between Z pqr and (Z p Z q Z r ) EXAMPLE p =3,q =4,r =5;N =3 4 5=60 a =1,b=2,c=1, x =46 a =1,b=2,c=0, x =10 a =1,b=1,c=3, x =13 a =1,b=0,c=2, x =52 a =2,b=2,c=2, x =2 a =0,b=0,c=0, x =0 a =1,b=1,c=1, x =1 a =2,b=1,c=2, x =17 NOTE it is critical that gcd(p, q) =1. Forexampleifp =4andq =6, picking a =2,b =1itwouldbeimpossibletofindx with these remainders mod p and mod q Further, the function h maps the coprimes in Z pqr to triplets of coprimes in (Z p Z q Z r )withrespectivefactors,sameassayingthath is a bijection between C pqr and (C p C q C r ) EXERCISE. it is enough to proof the theorem for only 2 factors N = pq. Once we have that proof we can extend it to 3 factors, then to 4, then 5, and so on. From 2 to 3 factors: Say N = pqr =(pq)r. Since gcd(pq, r) =1thetheorem for two factors gives us the mapping h 1 (x) =(y, c) betweenz pqr and 29

13 (Z pq Z r ); with y 2 Z pq and c 2 Z r. Applying the 2-factor theorem again for p, q we get a second mapping Z pq and (Z p Z q ): h 2 (y) =(a, b) witha 2 Z p,b 2 Z q. Since both h 1,h 2 are bijective (one to one) then we can compound them to obtain the 3-factor theorem x h 1! (y, c) h 2! (a, b, c) proof based on uniqness (no construction of x) forthree-factor(worksfor any number of coprime factors). We want to show that h(x) =(x mod p, x mod q, x mod r) isabijection(one-to-one)betweenz pqr and (Z p Z q Z r ). First h is an injection because for any x 6= y we have h(x) 6= h(y): h(x) =h(y) ) x = y mod p ) p x y. Similarlyq x y, andr x y But p, q, r are pairwise coprime, so then pqr x y ) x = y Second, Z pqr = pqr = Z p Z q Z r (same number of elements). An injection like h between finite sets of equal sizes must be surjective (cover all elements in the result set). Then h is bijective, or one-to-one. second proof : construction of x for two factor. Given a 2 Z p and b 2 Z q we want to find x 2 Z pq such that x mod p = a; x mod q = b. gcd(p, q) = 1 ) 9k, h : pk qh = 1 ) (pk qh)(b a) = b a ) pk(b a) qh(b a) =b a ) pk(b a)+a = qh(b a)+b. Thisisthe integer we are looking for x = pk(b a)+a = qh(b a)+b mod pq because it gives precisely a mod p and b mod q. EXERCISE(di culty F) ifn is a product of two coprimes n = ab with gcd(a, b) =1,then'(n) ='(a)'(b) hint: We ll have to apply the Chinese Reminder to argue that each coprime in C ab maps (corresponds one-to-one) to a pair of coprimes from C a C b THEOREM 12 '(n) formula. Ifn factorizes into primes as n = p e 1 1 p e 2 2 p e p et t 30

14 then '(n) =p e (p 1 1) p e (p 2 1) p e (p 3 1)... p et 1 t (p t 1) = n (1 1/p 1 ) (1 1/p 2 ) (1 1/p 3 )... (1 1/p t ) proof. Since each prime factor p e in n is coprime with the other factors, we can apply repeatedly the previous exercise factorization of '(n) toget '(n) ='(p e 1 1 ) '(p e 2 2 )... '(p et t ) Now we recall an exercise from Euler s Theorem in chapter 6 that stated '() formula for prime powers: '(p k )=p k 1 (p 1) Applying to each factor above we get '(n) =p e (p 1 1) p e (p 2 1) p e (p 3 1)... p et t 1 (p t 1) EXAMPLE: n =48= Verify that '(48) = 2 3 (2 1) 3 0 (3 1) EXAMPLE: n =100= Verifythat '(100) = 2 1 (2 1) 5 1 (5 1) EXAMPLE: n =540= Verify that '(540) = 3 2 (3 1) 2 1 (2 1) 5 0 (5 1) 31

15 10 Group Theory & Lagrange Th - optional In here we show that Euler s totient theorem is a particular application of Lagrange theorem which states that the order of a subgroup divides the order of the group. It is applied with for the group of coprimes C n and the subgroup of powers of a P a DEFINITION A set and an operand like (Z n, mod +) form a group because the following are satisfied: 1) the operand result is always in the set : a, b 2 Z n ) a + b mod n 2 Z n 2) there is a neutral element, 0 + a = a +0=a, 8a 2 Z n 3) associativity holds (a + b)+c = a +(b + c), 8a, b, c 2 Z n 4) every element has an inverse 8a, 9 a, a +( a) = a + a =0 OBSERVATION (Z n, mod ) isnotagroupwithmultiplicative-mod,because 1 would be the neutral element, and then 0 has no inverse. But how about (Z n, mod ) -thatis,thesetofallremaindersexcept0, with multiplicative-mod as operand? Certainly not a group for all n: for example n =10givesZ 10 = {1, 2, 3, 4, 5, 6, 7, 8, 9} where 5 has no inverse (there is no element that multiplied with 5 gives 1 mod 10). EXERCISE Show that conditions 2 and 3 are satisfied for (Z n, mod ) to be a group. EXERCISE Show that conditions 1 and 4 for (Z n, mod ) areveryrelated in the following sense: for any x 2 Z n,eitherthereisaninverse(satisfies condition 4) or there is a particular element y 2 Z n such that x y mod n =0/2 Z n (breaks condition 1), but not both. THEOREM (Z n, mod ) isagroupifandonlyifn is prime. proof EXERCISE EXAMPLE Z 5 = {1, 2, 3, 4} with operand multiplication modulo 5 forms a group: 1) a b mod 5 2 Z 5, 8a, b 2 Z 5 2) 1 is the neutral element 3) (a b) c mod 5 = a (b c) mod 5 in general 4) 1 is its own inverse, 4 is its own inverse, 2 and 3 are eachother s inverse. 32

16 THEOREM Let C n be the set of coprimes n from Z n (listed in the table above for few n). Then (C n, mod ) isagroup. proof Lets look at each of the four rules. 1) if a, b 2 C n then we know ab mod n 2 Z n,theonlyquestionisifab is coprime with n. Sincegcd(a, n) =gcd(b, n) =1,wemusthavegcd(ab, n) =1; otherwise any prime p gcd(ab, n) willhavetobeacommonprimebetween (a, n) orcommonbetween(b, n) contradictingthepremise.soab 2 C n. 2) 1 2 C n is neutral element 3) associativity holds 4) a 2 C n means a has an inverse mod n, a 1 2 Z n.butthismeansa 1 has inverse a, soa 1 is coprime with n, ora 1 2 C n. Subgroup. A group (G, +) has a subgroup (S, +) if the operand + is the same, S G, andthe(s, +) is a group in itself, a.k.a. the four groupproperties hold for (S, +). Then G is a multiple of S (the size of a subgroup divides the size of the group). EXAMPLE (Z 6,mod+) has a subgroup formed by elements S = {0, 2, 4}; we can check the four rules: 1) a, b 2 S ) a + b 2 S: 2+2mod6=4,2+4mod6=0;4+4mod6=2etc 2) 0 is the neutral element 3) associativity holds 4) the inverse of every element in S is also in S, because2and4areeachother s inverse (addition opposite) mod 6. EXAMPLE (Z 7,mod ) isagroupwithmodulo-multiplicationoperand,and has a subgroup formed by elements S = {1, 2, 4} : 1) a, b 2 S ) a b 2 S :2 2 mod 7 = 4;4 4 mod 7 = 2;2 4 mod 7 = 1 2) 1 is the neutral element 3) associativity holds 4) the inverse of every element in S is also in S, because2and4areeachother s inverse (multiplication opposite) mod 7. EXERCISE Another subgroup of (Z 6,mod+) is given by elements S = {0, 3} 33

17 EXERCISE (Z 8,mod+) has subgroups S = {0, 2, 4, 6} and S = {0, 4} EXERCISE (Z 12,mod+) has subgroups S = {0, 2, 4, 6, 8, 10}, S = {0, 4, 8}, S = {0, 3, 6, 9} THEOREM (Lagrange). A group (G, +) has a subgroup (S, +); we use here + as generic operand, can be either addition or multiplication in Z n. Then G is a multiple of S (the size of a subgroup divides the size of the group). proof if S = {a, b, c, d,...} is a subgroup of (G, +) then we ll prove that G can be partitioned into several sets that look like h+s = {h+a, h+b, h+c, h+d...} each corresponding to a key element h 2 G. For h 1 = 0 we get the set S 1 = h 1 + S = S Consider an h 2 that is not in the first set h 1 + S. Then S 2 = h 2 + S will have all brand new elements from G, noneoftheminh 1 + S. Proof by contradiction: suppose 9a, b 2 S and S 2 3 h 2 + a = h 1 + b 2 S. Then h 2 = h 1 +b a. ButS is a group so b a 2 S, which means h 2 2 h 1 +S, contradiction. Note that S 2 = S repeat : if the sets generated so far S 1,S 2,S 3... do not fully cover G, pick next h k in G \ S 1 [ S 2 [ S 3 and repeat the argument from before. The newly generated set S k will have elements di erent than the ones in previous sets, and its size will be the same S k = S At some point the finite G will be covered by these subsets G = S 1 [ S 2 [ S 3 [... [ S k,alldisjointbutallofthesamesize S. Then G = k S EXAMPLE (G = Z 12, mod +) with S = {0, 3, 6, 9}. The sets that partion G are h 1 =0(neutralelement);S 1 = h 1 + S = {0, 3, 6, 9} h 2 =12G \ S 1 ; S 2 = h 2 + S = {1, 4, 7, 10} h 2 =52G \ S 1 \ S 2 ; S 2 = h 2 + S = {5, 8, 11, 2} EXAMPLE (G = Z 7 = {1, 2, 3, 4, 5, 6}, mod ) hassubgroups = {1, 2, 4}. The sets that partion G are h 1 =1(neutralelement);S 1 = h 1 S = {1, 2, 4} h 2 =52 G \ S 1 ; S 2 = h 2 S = {5, 3, 6} 34

18 35

19 THEOREM (Euler) if gcd(a, n) =1thena '(n) =1 modn proof with group theory. Let C n be the set of coprimes-with-n from Z n, and we know that (C n, mod ) isagroup.bydefinition'(n) = C n. Now consider the set of elements in Z n that are powers of a mod n, A = {a 1,a 2,a 3...}. ThissetA is finite, and the last non-repeated value is a v =1 (because the next power would be a). Then A = v A C n (all elements in A are coprime with n) (A, mod ) isagroup,thusasubgroupof(c n, mod ). The previous theorem says A divides C n, or equivalently v '(n) or '(n) =vk which implies a '(n) mod n =(a v ) k mod n =1 k mod n =1 EXAMPLE n =12, C n = {1, 5, 7, 11} )'(n) = mod 12 = mod 12 = 25 2 mod 12 = 1 2 mod 12 = mod 12 = 49 2 mod 12 = 1 2 mod 12 = mod 12 = ( 1) 4 mod 12 = 1 36

20 11 Summary division a to b 2: r = a mod b, a = bq + r; withquotientq and remainder r 2 Z b = {0, 1, 2,...,b 1} n = p e1 1 p e1 1 p e1 1...p et t unique decomposition in to primes gcd(a, b) =allcommon(intersection)primes(eachwithminexponent) lcm(a, b) =unionofprimes(eachwithmaxexponent) ab = all primes together (with sum of exponents) gcm(a, b) lcm(a, b) =ab a b means a divides b same as a is factor of b same as b is multiple of a same as b = ak for some integer k a, b have the same remainder mod n if and only if n divides their difference : a mod n = b mod n, n a b if prime p ab; thenp a _ p b a, b are coprimes (or relatively prime) if they have no common prime factors; then gcd(a, b) =1 if n ab and a, n coprimes gcd(a, n) =1;thenn b if n a and m a and gcd(n, m) =1;thennm a after dividing a, b by their d = gcd(a, b), one gets coprime numbers: gcd( a d, b d )=1 a has multiplicative inverse b = a 1 mod n means ab mod n =1. Thats possible if and only if gcd(a, n) =1 a inverse mod n (if exists) can be found as a v 1 for integer v with property a v = 1 mod n (v =orderofa). Trying powers to obtain the order is ine - cient, not practical for large n. 37

21 gcd-coe cient (k, h) for(a, b) alwaysexisttogivethegcd(a, b) =ak + bh. if a, b coprime, 1 = gcd(a, b) =ak + bh. Thenk, h are the two inverses k = a 1 mod b and h = b 1 mod a Euclid-Extended finds k,h coe cients by transforming the problem(a, b) into problem(b, r) recursively, and then recursively-back computing the coefficients. It is e cient, even for large a, b. Euler totient '(n) isthesizeofthesetc n ={remainders coprime with n}; inotherwords'(n) =numberofcoprimessmallerthann. Euler s theorem : a '(n) =1 modn for any a 2 C n. So we have four ways to find a 1,theinverseofa mod n: 1) Brute force. Try di erent values b<nuntil one works (ab =1 modn) 2) Best in practice. k, h =EuclidExtend(a, n). Then k = a 1 is the inverse. 3) Find order v for a, soa v =1 modn then a v 1 mod n is the inverse of a. Cant do fast exponentiation(v unknown); still usually faster than method 1) 4) Best if '(n) known. '(n) orderfora (a '(n) = 1), so the inverse is a 1 = a '(n) 1.Powermodulon is e cient with fast exponentiation. For primes p, '(p) =p 1sothattheorembecomesFermatstheorem a p 1 =1 modp when (a, p) coprimes Primality Test for n. Tryforseverala<nto see if a n 1 mod n =1. if any of the tests(a) gives NO, then n certainly not prime if all tests(a) gives YES, n is likely prime (rare exceptions: Carmichael numbers) n = pq (two primes) then '(n) =(p 1(q 1); so if a coprime with n then a '(n) = a (p 1)(q 1) =1 modn or a (p 1)(q 1)k+1 = a mod n for any k RSA. if n = pq (two large primes); e and d = e 1 are eachother inverse mod (p 1)(q 1) means ed =1 mod(p 1)(q 1). Then a ed = a (p 1)(q 1)k+1 = a mod n. n is known but the prime factors p, q are not and hard to find. RSA public key for encryption is e. ENCRYPT(a) =a e mod n RSA secret key for decryption is d. DECRYPT(a e )=(a e ) d mod n = a 38

22 RSA signature: verify that one has the correct secret key, by receiving (a, b = a d ) and decrypting b with public key b e =(a d ) e mod n = a Chinese Reminder : if p, q are coprime, any pair of remainders (a 2 Z p,b2 Z q )correspondsuniquelytoaremainderx 2 Z pq such that x mod p = a and x mod q = b 39